How to map Department of Defense CMMC to NIST CSF

When considering the various cyber security frameworks, I can’t help to wonder how it all comes together: Who is the audience? Does it actively portray risk? Does it help with threat reductions? And the biggest of all questions – is it usable?

While the Department of Defense’s Cyber Maturity Model (CMMC) is now onto its 0.4 release, when looking at it – I see something that looks very similar to the NIST CSF. It has tables that outline:

• Domain
• Capability
• Target level of maturity

Figure 1: DoD CMMC table

Anyone with a simple spreadsheet or Excel could merely transfer the CMMC framework over to a simple file-based questionnaire.  This is great news for resources and organization that are focused on implementing NIST CSF.

But this doesn’t come without a couple of challenges:

• Do individuals following these vague details truly understand what is required for cybersecurity? Or do they pick and choose applicability (to a similar extent) for the standard based on their interpretation? Often customers looking at NIST see a whole bunch of information, and the interpretation could lead to some perilous decisions/assumptions.
• Is the coverage sufficient in this document for enhanced controls? The model is highly generic, which isn’t necessarily a bad thing, but it could be insufficient where stronger security level targets are not being addressed.

The latter point speaks more directly to today’s topic: if NIST CSF and DoD CMMC do not have adequate language or clarity on defining scenarios or organization/target security levels, where do I find that answer?

Well the answer (today at least) is currently in draft form – NIST SP 800-171B, and the concept of overlays used in SP 800-82 to enhance NIST CSF controls for usage with critical infrastructure. The first document sticks to the same terminology used to cluster capabilities and domains, but it has several sections for each item within it (where applicable) to discuss challenges, and the logic/solutions for each. Additionally, there is typically a hyperlink to cross-reference related NIST special publications to help readers find and be aware that additional reference documentation can be used.