A CMMC Compliance Checklist

The Cybersecurity Maturity Model Certification (CMMC) is a widely recognized framework used to evaluate how mature an organization's cybersecurity is. It aims to assist organizations in strengthening their cybersecurity through greater awareness of best practices and the adoption of a roadmap.  

On November 4, 2021, the Department of Defense announced the strategic direction for the Cybersecurity Maturity Model Certification (CMMC) program, which marked the completion of an internal review of the program conducted by senior Department of Defense leaders (DoD). The CMMC 2.0 program keeps the original objective of safeguarding sensitive information while making the CMMC standard simpler and clarifying its requirements. 

If any organization is interested in complying with CMMC Compliance standards to protect sensitive data, Unified Security Stack will provide them with a straightforward CMMC Compliance Checklist to follow. 

What is CMMC, the Cybersecurity Maturity Model Certification? 

CMMC (Cybersecurity Maturity Model Certification) is a framework of compliance levels that allows the government, particularly the Department of Defense, to decide if an organization possesses the security required to handle controlled or otherwise vulnerable data. 

 CMMC Compliance Checklist 

1. Determine which category of unclassified information your organization will manage. 
2. Identify which CMMC certification level you require. 
3. Deploy a SIEM solution to assist you in satisfying CMMC requirements. 
4. Engage a C3PAO for a CMMC assessment, or opt for self-certification. 
5. CMMC Assessment Process. 

Determine which category of unclassified information your organization will manage. 

On December 3, 2021, the DoD released CMMC 2.0 Model Overview. This updated model incorporates the core protection requirements for FCI set out in the Federal Acquisition Regulation (FAR) 52.204-21 and the security requirements for CUI in NIST SP 800-171r2 under clause 252.204-7012 of the Addendum to the Federal Regulation on Defense Acquisitions (DFARS). 

• If you deal with Controlled Unclassified Information Where CUI is involved, you will have to satisfy CMMC Level 2 or Level 3. 
• If you only protect Federal Contract Information Where FCI is involved, you will only be required to meet CMMC Level 1. 

Determine the CMMC certification level you need

 The CMMC level you must achieve is determined by the contract you are working under (CUI/FCI). 

 AAlthough CMMC 1.0 had 5 levels, the current CMMC model, with the announcement of CMMC 2.0, contains 3 maturity levels.  

The 3 levels in CMMC 2.0 are:  

  

• Level 1 (foundational) for organizations that handle only FCI. This information needs protection but is not critical to national security; it calls for 17 basic protection practices. CMMC Level 1 Analysis GuideFurthermore, every Level 1 company is eligible to self-certify.
• Level 2 (advanced) for organizations with CUI. It will call for the 110 practices of NIST SP 800-171r2; may require external or own evaluations, depending on the type of information; CMMC Level 2 Analysis Guide. 
• Level 3 (expert) for CUI programs with the highest priority. It will employ a subset of NIST SP 800-172. Companies at Level 3 will require a government-led assessment. 

Implement a SIEM solution to help you meet CMMC requirements 

Unified Security Stack can help you to meet with the 14 domains from the CMMC model:

1.  Access Control (AC) 
2. Awareness and Training (AT) 
3. Audit and Accountability (AU) 
4. Configuration Management (CM) 
5. Identification and Authentication (IA) 
6. Incident Response (IR) 
7. Maintenance (MA) 
8. Media Protection (MP) 
9. Personnel Security (PS) 
10. Physical Protection (PE) 
11. Risk Assessment (RA) 
12. Security Assessment (CA) 
13. System and Communications Protection (SC) 
14. System and Information Integrity (SI) 

Every domain has its own associated practices for each level. How practices are distributed within each domain differs across the compliance levels. 

A SIEM tool is a Security Information and Event Management system that gathers security information from various sources, analyzes and correlates log data to find patterns that could signal a threat or breach. It is used to monitor an organization's network activities, helping IT experts respond to incidents in real time. In addition, when organizations deploy a SIEM, they can easily detect vulnerabilities that cybercriminals might exploit. Advanced SIEMs rely heavily on machine learning and artificial intelligence to aggregate and analyze data at a scale that would be practically impossible for people to handle alone. 

Unified Security Stack is a SIEM solution built for hybrid environments and can be readily deployed across on-premises and cloud providers for any modern cybersecurity strategy. With Unified Security Stack, companies can lower the cost burden of CMMC compliance. This is especially true for small and mid-sized businesses that sometimes lack the finances to cover the cybersecurity upgrades required for CMMC compliance.  

Unified Security Stack bundles several cybersecurity products under a single platform, including:  

• Threat detection and response 
• Compliance management 
• Log management (SIEM) 
• Vulnerability management 
• Network/host IDS/IPS 
• Asset Discovery  
• Endpoint Protection 
• Identity Management 
• Incident Response 
• File Classification 
• Dark Web Monitoring together with threat Intelligence.  

Keeping all data in one place improves the performance of correlation engines and machine learning algorithms. The platform also provides a robust dashboard and report builder that organizations can use to tailor their monitoring experience or advanced compliance auditing and reporting.   

As you can see, Unified Security Stack is a strong solution for meeting the security practices required in every domain of the CMMC model. These good practices will help you prepare for any CMMC assessment. 

Hire a C3PAO to Perform a CMMC Assessment or Self-Certify 

The CMMC Accreditation Body (CMMC-AB) is responsible for creating procedures to certify Third-Party Assessment Organizations (C3PAOs) and assessors who will evaluate compliance levels. CMMC will also establish a CMMC Marketplace where companies can locate an accredited C3PAO and arrange an assessment.  

As the Organization Seeking Compliance (OSC), your company should engage the C3PAO to conduct your CMMC assessment. 

The price of a CMMC assessment will be based on multiple factors, such as the level of certification required and how complex your IT infrastructure is. 

• Level 1 CMMC

Level 1 organizations are allowed to self-certify for CMMC compliance on an annual basis.  

• Level 2 CMMC 

A number of Level 2 companies will be able to self-certify for CMMC compliance, while others will need an outside third-party assessment. 

Level 2 contractors that do not handle information critical to national security may complete yearly self-assessments to meet CMMC compliance. 

Level 2 contractors that manage information critical to national security are required to undergo third-party assessments once every three years. 

• Level 3 CMMC

Every Level 3 company needs a government-led assessment once every three years. 

CMMC Assessment Process 

The process for a CMMC assessment is: 

1. After you have hired a C3PAO company, you will arrange the assessment with the C3PAO. 
2. The C3PAO evaluates your company and produces an assessment report. 
3. If you satisfy all security practices for your level, the C3PAO provides a CMMC certificate. 
4. The C3PAO delivers a copy of the assessment report and CMMC certificate to the DoD. That CMMC certificate lasts for three years. 
5. As soon as the C3PAO sends the CMMC certificate to the DoD, your obligation to comply with CMMC has been satisfied.