Read Time:8 Minute, 35 Second
Introduction
Since my previous blog CMMC Readiness was published in September 2021, the Department of Defense (DoD) has made modifications to the program structure and requirements of the Cybersecurity Maturity Model Certification (CMMC) interim rule first published in September 2020. CMMC 2.0 was officially introduced in November 2021 with the goal of streamlining and improving CMMC implementation.
In this blog, I will identify the key changes occurring with CMMC 2.0 and discuss an implementation roadmap to CMMC readiness.
Key changes
Key changes in CMMC 2.0 include:
Maturity Model reduced from 5 compliance levels to 3
Level 3 – Expert
Level 2 – Advanced (old Level 3)
Level 1 – Foundational
Improved alignment with National Institute of Standards and Technology (NIST)
NIST SP 800-171
NIST SP 800-172
Practices reduced from 130 to 110 for Level 2 Certification
Independent assessment by C3PAO at Level 2 – Advanced
Self-assessment at Level 1 – Foundational, limited at Level 2 – Advanced
Removed processes (ML.2.999 Policy, ML.2.998 Practices, and ML.3.997 Resource Plan)
Figure 1. CMMC Model
Source: Acquisition & Sustainment – Office of the Under Secretary of Defense
CMMC requirements at Level 1 and Level 2 now align with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 – Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations. This alignment should be beneficial to most DIB organizations since they have been subject to FAR 52.204-21 or DFARS 252.204-7012 and should have been self-attesting to NIST SP 800-171 practices whether it be the 17 NIST practices required for those handling only FCI or the 110 NIST practices for those handing FCI and CUI. Those organizations that took self-attestation seriously over the years should be able to leverage the work they have previously performed to place themselves in a strong position for CMMC certification.
CMMC 2.0 may have dropped the three Processes (ML.2.999 Policy, ML.2.998 Practices, and ML.3.997 Resource Plan), but that does not eliminate the requirement for formal security policies and control implementation procedures. CUI security requirements were derived in part from NIST Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations (NIST SP 800-53). The tailoring actions addressed in Appendix E of NIST SP 80-171R2 specify that the first control of each NIST SP 800-53 family (e.g., AC-1, AT-1, PE-1, etc.), which prescribe written and managed policies and procedures, are designated as NFO or “expected to be routinely satisfied by nonfederal organizations without specification”. This means that they are required as part of the organization’s information security management plan and are applicable to the CUI environment. Refer to Appendix E for other NIST SP 800-53 controls that are designated as NFO and include them in your program.
Implementation roadmap
Although there have been welcomed changes to the structure of CMMC, my recommended approach to implementation first presented last September has changed little. The following presents a four-step approach to get started down the road to CCMC Level 2 certification.
Education
I cannot stress the importance of educating yourself and your organization on the CMMC 2.0 requirements. A clear and complete understanding of the statute including the practice requirements and the certification process is critical to achieving and maintaining CMMC certification. This understanding will be integral to crafting a logical, cost-effective approach to certification and will also provide the information necessary to effectively communicate with your executive leadership team.
Start your education process by reading the CMMC 2.0 documents relevant to your certification level found at OUSD A&S – Cybersecurity Maturity Model Certification (CMMC) (osd.mil).
Cybersecurity Maturity Model Certification (CMMC) Model Overview Version 2.0/December 2021 – presents the CMMC model and each of its elements
CMMC Model V2 Mapping Version 2 December 2021 – Excel spreadsheet that presents the CMMC model in spreadsheet format.
CMMC Self-Assessment Scope – Level 2 Version 2 December 2021 – Guidance on how to identify and document the scope of your CMMC environment.
CMMC Assessment Guide – Level 2 Version 2.0 December 2021 – Assessment guidance for CMMC Level 2 and the protection of Controlled Unclassified Information (CUI).
Define
The CMMC environment that will be subject to the certification assessment must be formally defined and documented. The first thing that the CMMC Third-Party Assessor Organization (C3PAO) engaged to perform the Level 2 certification must do is review and agree with the CMMC scope presented by the DIB organization. If there is no agreement on the scope, the C3PAO cannot proceed with the certification assessment.
Scope
CMMC environment includes all CUI-related associated assets found in the organization’s enterprise, external systems and services, and any network transport solutions. You should identify all of the CUI data elements that are present your environment and associate them with one or more business processes. This includes CUI data elements provided by the Government or a Prime Contractor, as well as any CUI created by you as part of the contract execution. Formally document the CUI data flow through each business process to visualize the physical and logical boundaries of the CMMC environment. The information gleaned during this process will be valuable input to complete your System Security Plans (SSPs).
Not sure which data elements are CUI? Work directly with your legal counsel and DoD business partner(s) to reach a consensus on what data elements will be classified as CUI. Visit the NARA website at (Controlled Unclassified Information (CUI) | National Archives) for more information concerning the various categories of CUI. Ensure that the classification discussions held by the team and any decisions that are made are documented for posterity. Do not forget to include CUI data elements that are anticipated to be present under any new agreements.
Figure 2. High-Level CMMC Assessment Scope
Based on image from CMMC Assessment Scope – Level 2 Version 2.0 | December 2021
During the scoping exercise, you should look for ways to optimize its CMMC footprint by enclaving CUI business processes from non-CUI business processes through physical or logical segmentation. File and database consolidation may be helpful in reducing the overall CMMC footprint, as well as avoiding handling CUI that serves no business purpose.
GCC v GCC High
Heads up to those DIB organizations that utilize or plan to utilize cloud-based services to process, store, or transit CUI. The use of cloud services for CUI introduces the GCC vs. GCC High considerations. The GCC environment is acceptable in those instances where only Basic CUI data elements are present. GCC High is required if CUI-Specified or ITAR/EAR designated data elements are present. In some instances, prime contractors that utilized GCC High may require their subcontractors to do the same.
Asset Inventory
Asset inventory is an mandatory and is an important part of scoping. The table below describes the five categories of CUI assets defined by CMMC 2.0.
Asset
Description
CUI
Assets that process, store, or transmit CUI
Security Protection
Assets that provide security functions or services to the contractor’s CMMC scope.
Contractor Risk Managed
Assets that can, but are not intended to process, store, or transmit CUI due to security controls (policies, standards, and practices) put in place by the contractor.
Specialized
Special group of assets (government property, Internet of Things (IoT), Operational Technology (OT), Restricted Information Systems, and Test Equipment) that may or may not process, store, or transmit CUI.
Out-Of-Scope
Assets that cannot process, store, or transit CUI because they are physically or logically separated from CUI assets.
DIB contractors are required to formally document all CUI assets in an asset inventory as well as in their SSPs. There are no requirements expressed for what information is to be captured in the inventory, but I would recommend in addition to capturing basic information (i.e., serial numbers, make, models, manufacturer, asset tag id, and location) you consider mapping the assets to their relevant business processes and identify asset ownership. Owners should be given the responsibility for overseeing the appropriate use and handling of the CUI-associated systems and data throughout their useful lifecycles. An asset management system is recommended for this activity, but Microsoft Excel should be adequate for capturing and maintaining the CUI inventory for small to midsize organizations.
Figure 3. Asset Inventory
Assess
Once you have your asset inventories completed and your CMMC scope defined, it’s time to perform a gap analysis to determine your security posture alignment with CMMC requirements. If you have been performing your annual self-attestation against NIST SP 800-171, you can leverage this work but be sure to assess with greater rigor. Consider having a CMMC Registered Practitioner from a third-party provider perform the assessment since will provide an unbiased opinion of your posture. The results of the gap assessment should be placed into a Plan of Action and Milestones (POAM) where you will assign priorities, responsibilities, solutions, and due dates for each gap requiring corrective action.
Remediate
Finally, use the POAM to drive the organizations remediation efforts in preparation for CMMC certification. Remember that if you contract 3rd-party services as part of remediation (e.g., managed security services, cloud services, etc.) those services become part of your CMMC scope. Consider performing a second posture assessment after remediation efforts are complete to ensure you are ready for the certification assessment by the C3PAO. CMMC certification is good for 3 years, so be sure to implement a governance structure to ensure your program is positioned for recertification when the time comes.
Conclusion
I hope this implementation roadmap provides a benefit to you on your CMMC Level 2 certification journey. Keep in mind, there are no surprising or unusual safeguards involved in the process as CMMC requirements align with industry best practices for cybersecurity. As with any strong information security program, it is critical that you fully understand the IT environment, relevant business processes, and data assets involved. As we like to say in cybersecurity, “you can’t protect an asset if you don’t know what it is or where it’s at”. Completing the upfront administrative work such as education, scope, and inventory will pay dividends as you progress toward independent certification.
