CMMC (cybersecurity maturity model certification) is most
likely the toughest and least forgiving compliance framework most businesses
will ever have to work with.
Mandatory for any business working in defense contracting or
adjacent to defense contracting, CMMC is a multi-level compliance framework
build on varying security controls.
Differentiating between the first two levels of CMMC (most businesses
realistically won't ever need to deal with level 3) is complicated enough as is
before you go through all the different security controls to consider.
These controls are built off of the Federal Contract
Information (FCI) and NIST 800-171 regulations, two hefty documents that can
weigh down businesses trying to handle these rules on their own.
Business should always work towards CMMC compliance with the
help of a dedicated compliance professional, but they should know the broad
strokes of what their CMMC process needs to look like.
At The Network Doctor, we've spent 40+ years helping our
Santa Clarita clients reach and maintain CMMC compliance. When working with a
CMMC professional, make sure they're helping your business update and polish
these documents so you have your business in order.
Gap analysis
A gap analysis is a process that lays out the gap between
where a business's cybersecurity posture is and where it wants to be. In the
context of CMMC, the IT service provider would reference everything against the
requirements for the desired CMMC level.
This should be the first step of any CMMC process, and done
long before any government contract work is considered.
Once your gap analysis or similar plan is ready, then the
work stars. We begin with our shared control set (MFA, encryption, EDR,
logging, backup, and vendor view) and then go from there, to fortify and
improve business security, but some IT providers may start differently.
What matters is that everything in the gap analysis gets
taken care of. Depending on the business it can be a long and costly process,
so the analysis can help you budget the time and money you'll need to close the
security gap.
System security plan
While a System Security Plan (SSP) may on its face seem
similar to a gap analysis, the main difference is that an SSP is an
auditor-facing document instead of the internal-facing gap analysis.
An SSP outlines how your business meets the necessary CMMC
requirements so auditors can overview your business at a glance.
Having a comprehensive and clear SSP makes the auditing
process smooth and painless, and it is a mandatory feature of CMMC level 2
compliance.
The drafting of your SSP should be done in tandem with your
IT provider so they can help you format and store your SSP where it can be
easily pulled and referenced.
Plan of action & milestones
If your SSP is the official document on how you're meeting
all the required controls, your Plan of Action & Milestone (POA&M) is
the official document of what still needs to be done.
It applies only to non-critical CMMC requirements, so don't
think a POA&M document will save you if you haven't taken care of the
serious security controls.
It can provide an audit with your future roadmap, though,
and if your POA&M is thorough and no serious controls are still pending,
you can get CMMC certified.
Again, double check all of this with your IT provider who
should be leading the charge in what can go in a POA&M and what needs to be
taken care of ASAP.
Cyber insurance
Cyber insurance requirements aren't exclusive to CMMC, or
any single compliance framework.
Any business under any framework is likely to need a cyber
insurance plan as part of compliance, and as these frameworks evolve, the
affected frameworks will only increase.
The requirements for a cyber insurance plan are likely less
stringent than the CMMC requirements, so if you don't have a plan in place, you
could already apply.
Cyber insurance documentation comes down to attestation
evidence like MFA, EDR, backup, and patching, all parts of regular
cybersecurity hygiene that your business should have with CMMC compliance.
These are some of the primary pieces of the CMMC puzzle that
we've offered to our clients in our many decades of working with
compliance-regulated industries.
For businesses looking to get into defense contracting or
needing CMMC compliance because they work with another company in the defense
pipeline, these starting processes and documents can give you a clear picture
of what CMMC compliance looks like now and down the road.
Need that IT advisor to help you get these documents in
order and start your CMMC journey? Schedule a 15-Minute Discovery Call today to
speak with an expert and get started.
