Monthly Archives: September 2022

Real-time communication and the ability to compete globally have been a boon for business leaders. But the internet also gave hackers halfway around the world a way to break into your network and steal valuable and sensitive information.

The U.S. Department of Defense (DoD) is circling the national security wagons by rolling out an updated version of the Cybersecurity Maturity Model Certification (CMMC). This comprehensive set of protocols is designed to protect sensitive information stored and transmitted by companies in the military-industrial base.

As the federal government moves to complete the final details of the digital defense mandate, organizations of every size must start planning to meet CMMC compliance. Those who fail to meet the standards will likely find themselves sidelined, losing lucrative government work as competitors increase market share. If your operation generates profits from direct or DoD-related contracts, this is what you need to know about CMMC compliance and its requirements.

What is the CMMC 2.0?

The second version of CMMC simplifies some of the guidelines outlined in the initial version. However, it maintains the overall thinking about protecting classified and unclassified military information held by contractors, subcontractors, and even seemingly peripheral supplies.

The CMMC 2.0 mandates companies to adopt a standardized set of cybersecurity controls that protect sensitive Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) data against unauthorized disclosure. Many cybersecurity measures were already active parts of the NIST SP 800-171, NIST SP 800-53, and ISO 27001 policies. CMMC 2.0 brings the best protections under one roof and applies them across the military-industrial base.

Why Does My Company Need CMMC Compliance?

When you add up all the direct and indirect contractors supporting the DoD, there are more than 300,000. So it’s not unreasonable for a small business owner who provides disposable cafeteria products to question why they are required to achieve and maintain CMMC compliance.

Enemy states are funding what are known as “advanced persistent threats” with the highest hacking skills. Understanding that a direct cyberattack on the DoD or other federal agencies proves difficult — if not futile — these threat actors gather fragments of information housed on the devices of military supply chain outfits. By piecing together low-level information, rogue nations can better exploit cybersecurity gaps at the highest levels of government.

Hackers are not necessarily trying to steal your credit cards. Instead, they’re often using hard-working Americans to get to the DoD. That’s why CMMC compliance is a necessary element of our national security. 

What are the CMMC Compliance Requirements?

The 2.0 version reduced the number of cyber hygiene levels from five to three and changed the CMMC compliance process. Small, mid-sized, and large corporations must determine their appropriate cyber hygiene level and meet the accompanying standards. These include the following.

• Level 1: Considered “Foundational” cyber hygiene, supply chain organizations must adopt 17 essential protection outlined in NIST 800-171. The goal of level 1 cybersecurity is to protect FCI, which can be used as a piece of the puzzle for nation-state hackers to grow their understanding of America’s national defense. Under the soon-to-be rolled-out CMMC 2.0 protocols, companies that fall under this standard have the option of self-assessment and reporting their findings.

• Level 2: Considered “Advanced” cyber hygiene, companies that store or transmit CUI are tasked with meeting the same 17 controls as Level 1 outfits. Companies are also required to onboard 93 other NIST practices. The DoD has indicated that self-assessment and reporting may be an option for some companies. However, determining where you fall requires an expert to review your data and network. Working with a Third Party Assessment Organization (C3PAO) from the start may be the best way to ensure your company does not lose its contract.

• Level 3: Considered “Advanced” cyber hygiene, military contractors and those dealing with sensitive CUI must meet the most stringent CMMC compliance standards. This involves all 110 NIST controls, and the DoD expects to add significant cybersecurity measures soon. Companies that require this level of CMMC compliance need to enlist a C3PAO to conduct an impartial assessment.

To say the fast-approaching CMMC 2.0 rollout is causing business professionals consternation would be an understatement. Determining which cyber hygiene level an operation falls under requires substantial cybersecurity knowledge and a deep understanding of CMMC compliance expectations. Therefore, every company’s best interest is to undergo a CMMC compliance assessment before the regulations hit the industry.

How Does a CMMC Compliance Assessment Work?

Businesses that procrastinate when the DoD sets a CMMC compliance start date will likely create a bottleneck. There are a limited number of C3PAO organizations — like ours — and they will be in high demand. Rather than delay — potentially missing a deadline— we strongly recommend enlisting cybersecurity professionals to conduct an unofficial CMMC assessment now and be prepared. A CMMC compliance assessment typically involves the following steps.

• Enlist the support of a C3PAO.
• Identify the type and sensitivity of the FCI or CUI you handle.
• Apply those findings to the three CMMC levels.
• Conduct a preliminary cybersecurity gap assessment to identify shortcomings.
• Harden your cybersecurity defenses to achieve the appropriate CMMC compliance level.
• Have an official C3PAO audit conducted.
• Report your score to the DoD’s Supplier Performance Risk System.

It’s essential to keep in mind the DoD expects contractors and supply chain organizations to maintain their CMMC compliance year-round. Companies should not address this process like your operation is studying to pass a test. Our national defense is constantly under attack from global enemies. Maintaining CMMC compliance is everyday people doing their part to ensure American prosperity.

Contact Sedulous Consulting Services For A CMMC Compliance Assessment

Based in Triangle, Virginia, Sedulous Consulting Services ranks among the first 100 organizations to qualify as a Third-party Assessment Organization. We work diligently with military contractors, subcontractors, and businesses in the supply chain to assess cybersecurity vulnerabilities, secure their networks, and maintain CMMC compliance. If your company enjoys profits from a military contract or works in the supply chain, contact Sedulous Consulting Services.

Small businesses working in the military supply chain are being urged to begin the process of meeting federal cybersecurity mandates as final rulemaking nears completion.

The U.S. Department of Defense (DoD) has been diligently working on an updated version of the Cybersecurity Maturity Model Certification (CMMC) that reduces cyber hygiene levels from five to three. Being hailed as CMMC 2.0, much of the framework is already available for small businesses to integrate into the defenses. High-profile military contractors and organizations handling sensitive digital assets can anticipate additional stringent measures that could exceed the control outlined in the initial version.

The good news for small businesses that primarily handle Federal Contract Information (FCI) or relatively routine Controlled Unclassified Information (CUI) is that you can get ahead of the anticipated CMMC compliance logjam. At the same time, the federal government completes its rulemaking process.

What CMMC Level Applies to Small Businesses?

The Pentagon indicated that small businesses providing essential products, materials, and services to contractors in the military-industrial base may have the option to self-assess their cybersecurity. But the complicated nature of the CMMC framework and identifying which level and controls apply to your operation can be something of a Herculean task. Unless you possess in-depth cybersecurity knowledge and an intimate understanding of federal regulations, we advise entrepreneurs and other decision-makers to enlist a third-party CMMC expert’s support promptly.

The first step in preparing for the CMMC rollout involves understanding which cyber hygiene applies to your company. The federal government isn’t making CMMC 2.0 user-friendly. Professionals won’t have simple metrics to follow, such as the number of employees, annual revenue, or even categories based on products, services, or materials.

To determine which of the three cyber hygiene levels applies to your organization, a managed IT professional with cybersecurity expertise will likely need to review the mandate and weigh its contents against the type of digital information you store or transmit. You see the problem if that seems like a steep hill to climb.

The Pentagon expects small businesses with few employees and a limited IT budget to determine the type of FCI or CUI they possess or transmit. Modestly sized subcontractors and supply chain operations will likely fall into one of the following two CMMC levels.

• Level 1: The DoD considers Level 1 cyber hygiene “foundational,” and small businesses are tasked with meeting 17 protocols that have already been published as part of the NIST 800-171 regulations. Level 1 controls are designed to protect FCI because foreign threats try to piece together this information to learn about the larger national security strategy. Although FCI is not necessarily sensitive, basic cyber hygiene generally deters hackers.

• Level 2: The Pentagon considers Level 2 cyber hygiene “advanced,” which involves upwards of 110 NIST protective measures. The Level 2 focus remains on CUI, and a great deal of uncertainty surrounds its CMMC compliance. According to early reports, the DoD plans to allow some outfits to self-assess while others need to bring in a Third Party Assessment Organization (C3PAO), such as ours. Determining where your small business falls can be complicated. And a misstep could result in getting sidelined from profitable DoD supply chain work.

• Level 3 CMMC compliance is primarily designed to protect susceptible digital assets stored and transmitted by military contractors and their closest subcontractors. That determination is based on the type of information they handle and requires a diligent assessment of the digital assets. But the elephant in the room revolves around the critical next step small businesses need to take to meet the CMMC requirements right now.

How Small Businesses Can Stay Ahead of the CMMC Mandate

It’s important to note that companies currently engaged in lucrative DoD work are expected to maintain appropriate cybersecurity defenses. The federal government has made it abundantly clear its dissatisfaction in recent years stems from companies failing to meet long-standing expectations. The decision to implement CMMC 1.0 and 2.0 stems from the fact too many contractors and subcontractors got hacked, and the Pentagon discovered their lackluster defensive posture after the fact.

So moving forward, businesses must file self-assessment results with the Pentagon’s Supplier Performance Risk System. Subpar scores are likely to be flagged, and small, mid-sized, and large corporations will be tasked with implementing corrective measures swiftly. If an outfit continues to miss the mark, business professionals can anticipate temporarily shutting out of the military-industrial base.

Of course, risking your livelihood by waiting until the mandates go into full effect can be avoided. So we urge small businesses that help military defense agencies and soldiers do their job to enlist the support of a C3PAO now.

By implementing an FCI and CUI review, you can get ahead of the curve by knowing precisely which CMMC level applies to your operation. Then Sedulous can bring a cost-effective cybersecurity assessment to bear that tests your defenses, ability to deter hackers and keep pieces to the national security puzzle out of the hands of bad actors.

Strategies such as penetration testing, gap assessment, and providing your staff with basic cybersecurity awareness training can harden your defenses. Remember that most data breaches involve clever hackers tricking employees into clicking on a malicious link, downloading a tainted file, or innocently revealing login credentials.

Contact Sedulous Consulting Services For A CMMC Compliance Assessment

Based in Triangle, Virginia, Sedulous Consulting Services ranks among the first 100 organizations to qualify as a Third-party Assessment Organization. We work diligently with small business leaders in the supply chain to assess cybersecurity vulnerabilities, secure their networks, and maintain CMMC compliance. If your company enjoys profits from a military contract or works in the supply chain, contact Sedulous Consulting Services.