The Department of Defense has made a significant push to improve the security of its cyberinfrastructure and supply chain (known as the Defense Industrial Base), and the result of this push is the Cybersecurity Maturity model Certification (CMMC) initiative. This framework uses existing security guidelines to provide an overview of necessary security requirements for federal contractors working with the DoD.

This framework isn’t just for large corporations. Many DoD agencies work with small and mid-sized businesses to leverage flexible cloud platforms, SaaS technology, or other IT services. That’s why it is just as important for SMBs to consider the impact of CMMC on their business now and over the next 5 years. 

What is CMMC?

The Cybersecurity Maturity Model Certification Program (CMMC) is a framework that oversees regulations and security for any contractor that handles government information. Specifically, this information includes data that relates to the operations of the Department of Defense (DoD) and certain agencies under the Executive Branch. This information includes:

1. Controlled Unclassified Information (CUI): Government-created information that must be protected within the bounds of relevant controls, regulations, and laws applicable for federal use. This information is not classified nor is it necessarily intellectual, but there is reason to maintain its privacy. 
2. Federal Contract Information (FCI): FCI is information generated for the government as part of a contract with a vendor but is not made public for citizens on places like websites. 

CMMC uses the concepts of security levels to measure the responsibility of an organization, with each level corresponding to the types of data they will handle (and accordingly the capabilities and security measures they have in place). Each level divides security into different stages of “hygiene” that correspond to different practices and technical implementations. 

1. Level 1 simply means that the contractor can meet basic security requirements specified in government documentation and that they can perform the practices of these requirements as needed.
   
2. Level 2 bridges the gap between levels 1 and 3 as an intermediary step, requiring that contractors meet some (but not all) of the requirements in NIST SP 800-171 and that they can implement documentation practices as part of their security policy.
   
3. Level 3 calls for a contractor to practice “good” cyber hygiene, including requirements in NIST 800-171 and an additional 20 controls. Contractors must also demonstrate that they can establish, maintain and support plans to manage security implementation. This is the level required to handle CUI.
   
4. Level 4 calls for adherence to SP 800-171B (with more advanced requirements than the initial version) including more controls pertaining to detection and response. Vendors must also show that they can implement reviews of their existing systems and that they can remediate problems.
   
5. Level 5 calls for complete implementation of advanced security and prevention controls against Advanced Persistent Threats and the ability to optimize security processes and implementation.

A complete approach to CMMC Authorization means taking a comprehensive look at your security infrastructure in terms of capabilities, technology, and management. 

Why Should Small Businesses Consider CMMC Authorization?

There are two obvious reasons why a small or mid-sized business would want to consider CMMC authorization:

1. Securing government contracts: Small businesses working with agencies within the umbrella of the Defense Department, or the Executive branch will eventually undergo CMMC authorization. As of September 2020, select agencies began to include CMMC as a requirement for their RFPs, and CMMC will become fully mandatory for all DoD RFPs by 2026. It goes without saying then that contractors of any size that want to work with the DoD must meet at least CMMC Level 1 authorization (or at least Level 3 if they will handle CUI). However, sub-contractors that work with DoD contractors must also have CMMC authorization–at least Level 1 if handling FCI, and Level 3 if handling CUI.
   
2. Maintaining the highest levels of security: Even if your business is not explicitly seeking government contract work, CMMC is a rather rigorous security framework. Working with specialists to get CMMC authorization will prepare you for equally rigorous requirements in other places (notably federal compliance frameworks like FedRAMP) but it also guarantees a high level of security just by going through the process. 

This second item is important for SMBs that handle important data in other industries: the security controls required for CMMC are some of the strongest around, so meeting them guarantees a rather high level of security whether they choose to work with DoD information or not.

What Do SMBs Need to Do to Prepare for CMMC Compliance?

If your business has never undergone compliance audits for government contracts, then there may be a few procedures and participants that are new. 

When preparing for CMMC authorization, you’ll have to consider the following:

• Your required security level will relate to the information you handle as part of your contract and will be dictated by the RFP. So, if you are seeking CMMC authorization as part of a request from a DoD agency, they will tell you what CMMC Level you need to meet.
  
• You’re required to work with a Third-Party Assessment Organization, or C3PAO. This organization is certified by the CMMC governing body to assess contractors like you and certify them based on their meeting requirements. Not only are C3PAOs necessary parts of the process, but they are also usually security experts in their own right who can help you meet compliance and manage your cybersecurity properly. Many C3PAOs will also offer automated or managed security services.
  
• Following that, ensure that you do CMMC authorization work with a reputable company. While many security agencies are advertising C3PAO status, look to ones that have additional credentials, ideally for compliance with frameworks like FedRAMP.
  
• If you work with subcontractors as a daily part of your business operations, and they handle your data, then you will either have to convince them to achieve their own level of CMMC authorization or find new partners with certification.
  
• CMMC isn’t a complete security solution, but it can fit into your existing infrastructure. If you handle other kinds of data, like financial data for transactions or Personal Health Information (PHI) then you will still have to ensure that you’re meeting relevant compliance standards for frameworks like HIPAA or PCI DSS.

Making Security A Priority with Continuum GRC

Small businesses approaching their cybersecurity for the first time might see the processes and requirements and think that the work just isn’t meant for them. However, cybersecurity is rapidly becoming a necessary part of doing business. In a world of cloud platforms, always-on services, and mobile, remote workforces, having the best security in place is not an option. 

Working with an experienced security partner makes this task much, much easier. Instead of working through emails and spreadsheets, these partners can automate your security and compliance operations so that audits and documentation are simple and streamlined. 

If you’re a small or mid-sized business interested in providing deferral services for or in the Defense Industrial Base, or you just want to learn more about your security positioning and how to automate compliance, call Continuum GRC at 1-888-896-6207 or contact us with the form below.