CMMC is already a comprehensive framework that the DoD uses to secure its digital supply chain. The maturity model includes three levels corresponding to the increasingly deep incorporation of NIST controls targeting the protection of Controlled Unclassified Information (CUI), specifically from Special Publications 800-171 and 800-172. 

Organizations meeting CMMC requirements, therefore, meet the standards required to provide IT services to defense agencies. However, businesses that work with the DoD most likely work with other companies in other industries–thus necessitating that they meet different requirements in other frameworks. 

It’s critical then that these organizations can map their security controls and policies across multiple regulations and frameworks. Fortunately, CMMC can serve as a solid foundation for these efforts. 

Take the guesswork out of control mapping with the automation of Continuum GRC.

Read More

CMMC is a crucial framework developed by the Department of Defense to enhance the cybersecurity posture of contractors within the Defense Industrial Base. The CMMC model is crucial for organizations dealing with Controlled Unclassified Information (CUI) because it ensures that these entities meet specific cybersecurity requirements to protect sensitive information. 

More likely than not, however, you are not just handling CMMC requirements. Changes are you are juggling multiple frameworks and regulations, all of which have unique and overlapping expectations. This is where automapping comes in.

Read More

Our previous articles on CMMC Level 1 certification focused on what organizations need to know when conducting self-assessments. These documents relied primarily on the fact that the contractor would do their assessments and reporting. 

With Level 2 certification, the game changes. Not only are nearly all assessments performed by C3PAOs, but their requirements expand nearly tenfold. That said, some basics of what to expect in the assessment remain the same. 

Here, we’re discussing the CIO’s guidance for Level 2 assessments. 

Read More