CMMC Compliance Services

CMMC RPO | NIST 800-171 | CMMC Policy | CMMC Compliance

CyberSecOp is an CMMC-AB Registered Provider Organization (RPO) providing CMMC readiness services.

Cybersecurity Maturity Model Certification (CMMC) is a unified standard for implementing cybersecurity across DoD contractors. CMMC has been in development for a number of years, but the first details on the framework were released in January 2020. CMMC framework “maturity” model, in which audits will be conducted by third-party assessors, and firms will be assigned a “level” that represents the cybersecurity protections they have in place. Prior to the CMMC, companies could self-certify their compliance and hide security gaps to continue to provide products and services to DoD.

CMMC-AB Registered Provider Organization (RPO)

CMMC Compliance – Cybersecurity Maturity Model COnuslting

Our Governance, Regulation, and Compliance experts have helped many federal contractors meet their compliance requirements. 

How can CyberSecOp help your organization with CMMC?

CyberSecOp has created a suite of advisory services to help organizations effectively plan and prepare for an official CMMC assessment:

CMMC Scoping Workshop – determine the type of data and the required CMMC maturity level needed. Identify how data is received, stored, shared and handled on all information systems.

 CMMC Gap Analysis – identify discrepancies between current state and CMMC maturity levels as determined in the scoping workshop. The CMMC Gap Analysis will provide areas of weakness that need to be targeted to reach the desired maturity level.

 CMMC Remediation Strategy –assist the organization with remediation efforts, including resolving discrepancies identified in the CMMC Gap Analysis and creating a strategic plan for remediation. This process may include security control testing, polices, procedures and plan creation to close all known gaps related to the desired maturity level.

 VCISO (Virtual Chief Information Security Officer) – CyberSecOp provides a board-level security expert backed by a team of professionals to ensure continuous compliance and maintain the maturity level as threats, infrastructure and business objectives evolve. Services include the following.

• Compliance Advisory Consulting Services

• CMMC Readiness

• Vulnerability and Penetration Testing Assessment

• Ransomware Response

• Forensic Analysis

• 24/7/365 Security Operations Center (SOC)

Leveled Practices

The majority of the practices (110 of 171) originate from the safeguarding requirements and security requirements specified in FAR Clause 52.204-21 and DFARS Clause 252.204-7012. The practices fall into five levels:

• CMMC Level 1 represents basic cyber hygiene and focuses on the protection of federal contract information (FCI). It consists of practices that correspond only to the basic safeguarding requirements specified in 48 CFR 52.204-21 ("Basic Safeguarding of Covered Contractor Information Systems").

• CMMC Level 2 is a transitional step in cybersecurity maturity progression to protect CUI. Level 2 consists of a subset of the security requirements specified in NIST SP 800-171, as well as practices from other standards and references.

• CMMC Level 3 focuses on the protection of CUI. It encompasses all of the security requirements specified in NIST SP 800‑171, as well as additional practices from other standards and references.

Who does CMMC compliance affect

Department of Defense (DoD) contractors are now well aware of the cybersecurity mandates that have been sweeping across the defense industry over the past several years. In 2015, The U.S. Department of Defense published the Defense Acquisition Federal Regulation Supplement, known as DFARS, which mandates that private DoD Contractors adopt cybersecurity standards according to the NIST SP 800-171 cybersecurity framework. This is all part of a government-led effort to protect the U.S. defense supply chain from foreign and domestic cyber threats, and reduce the overall security risk to DOD. DOD extablis CMMC has a third party management program, to ensure all DOD contracts has the same security controls in place, which will inturn provide each DOD contractor with and optimized security posture, which will also increase overall security for DOD.

CMMC Security Mapping frameworks

• FAR 52.204-21

• NIST 800-171 rev2

• NIST 800-171B

• NIST 800-53 rev4

• CERT RMM v1.2

• ISO 27002

• NIST Cybersecurity Framework

• CIS Critical Security Controls v7.1

• Secure Controls Framework (SCF)

 CMMC COMPLIANCE SUPPORT & AUDIT READINESS

Our team of CMMC experts will simplify and accelerate your CMMC compliance for DoD contracts,

• CMMC NIST SP 800-171 DOD regulations: The DoD plans to engage a non-profit organization to certify third-party auditors. Once CMMC auditors are certified, they will be responsible for conducting third-party assessments of DoD contractors beginning in mid-2020.DoD contractors. Unlike before organization would self attest and security gaps that were identified were noted in a Plan of Actions and Milestones (POA&M), allowing a contractor to continue to provide products and services without achieving compliance with all 110 security controls.

• CMMC Risk Categorization: Organizations must categorize their information and information systems in order of risk to ensure that sensitive information and the systems that use it are given the highest level of security. 

• CMMC System Security Plan: CMMC requires agencies to create a security plan which is regularly maintained and kept up to date. The plan should cover things like the security controls implemented within the organization, security policies, and a timetable for the introduction of further controls.

• CMMC Security Controls: CMMC outlines an extensive catalog of suggested security controls for NIST compliance. CMMC does not require an agency to implement every single control; instead, they are instructed to implement the controls that are relevant to their organization and systems. Once the appropriate controls are selected and the security requirements have been satisfied, the organizations must document the selected controls in their system security plan.

• CMMC Risk Assessments: Risk assessments are a key element of CMMC’s information security requirements. NIST offers some guidance on how agencies should conduct risk assessments. According to the NIST guidelines, risk assessments should be three-tiered to identify security risks at the organizational level, the business process level, and the information system level.

  CMMC Certification and Accreditation: CMMC requires program officials and agency heads to conduct annual security reviews to ensure risks are kept to a minimum level. Agencies can achieve NIST Certification and Accreditation (C&A) through a four-phased process which includes initiation and planning, certification, accreditation, and continuous monitoring.