Achieve CMMC Security Maturity with Verve Security Center

Achieve CMMC Maturity with Verve

What is CMMC Maturity?

The Cybersecurity Maturity Model Certification (CMMC) is the U.S. Department of Defense’s acquisition standard for ensuring the defense industrial base supply chain and “controlled unclassified information” is secure from potential cyber attack. Launched in early 2020, the certification builds on NIST 800-171 which was the DOD’s primary cyber standard in the past. 

CMMC differs from the prior model in 3 key ways: 

1. Establishes a maturity model that enables suppliers to grow in their rating over time as they implement more controls
2. A robust third-party audit and certification process, rather than the self-assessment and assertion-based approach used in the prior 800-171 (DFARS) standard
3. A more comprehensive and integrated group of controls that not only aligns with 800-171, but even more broadly to NIST 800-53

CMMC applies to Controlled Unclassified Information (CUI). CUI is defined by DOD as: CUI is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. DOD has created a taxonomy of included information here http://www.archives.gov/cui.

Importantly, these security standards apply to both IT and OT systems as CUI can be present on both sides. In addition, attackers may leverage IT to access OT and vice versa. Therefore, maturity will have to cover IT and OT. 

There is also discussion by the GSA that it too will adopt CMMC. As GSA stated in its recent STARS III contract: “STARS III contractors should begin preparing for CMMC… (GSA) reserves the right to survey 8(a) STARS III awardees from time-to-time in order to identify and to publicly list each industry partner’s CMMC level and ISO certifications.”

Time is of the essence. DOD plans to issue 15 “pathfinder” contracts during FY2021 and fully implement the rest by 2022. The accreditation process with assessors ensuring controls are in place to issue certificates may take up to six months. The time is now to begin preparing for the defense industrial base. 

The Maturity Model

The CMMC defined 5 levels of maturity as outlined in the chart below.

As shown above, the levels begin with “basic cyber hygiene” and proceed through an advanced Level 5 called “advanced/progressive” that includes 40 controls and practices beyond what NIST 800-171 called for. In total, in Level 5 CMMC includes 173 sub-controls. 

The purpose of the levels approach is that a small manufacturer may not have the resources to achieve Level 5 immediately – or ever. Different contracts will require differing levels of maturity certification. In addition, the level requirements will increase over time as the defense industrial base becomes more mature in its cyber security efforts.