The Cybersecurity Maturity Model Certification (CMMC framework), is a new cyber security standard unveiled by the Department of Defense (DoD). CMMC will replace the 2013 DFARS regulations that required specific cyber security standards for the Defense Industrial Base (DIB).
DFARS and CMMC aim to protect Controlled Unclassified Information (CUI), but there are some differences between them. This article aims to delve into these differences and emphasize why it’s crucial for DoD contractors to be cognizant of them.
Why Has DFARS Been Replaced?
The DoD created the Defense Federal Acquisition Regulation Supplement (DFARS) in 2000 to address the increasing cyber attacks on its contractors.
DFARS imposed specific cybersecurity requirements for defense contractors, mostly based on the NIST Cyber Security Framework. NIST is the National Institute of Standards and Technology and creates standards for multiple industries. The DoD has replaced the DFARS regulation with a more extensive cyber security standard known as the CMMC.
The CMMC constitutes a set of compliance measures that seek to safeguard crucial military data against cyber threats. It extends the NIST Cyber Security Framework by introducing supplementary prerequisites for defense contractors, such as vulnerability scanning and penetration testing. Moreover, the CMMC outlines baseline cyber security requirements for varying classification levels, ranging from low-risk to top secret.
Numerous reasons led to the replacement of DFARS with the CMMC, such as:
- CMMC compliance encompasses a more comprehensive set of cyber security measures than DFARS. CMMC adds additional prerequisites for some defense contractors, including vulnerability scanning and penetration testing.
- The CMMC is based on the updated NIST Cyber Security Framework and reflects current cyber security risks and trends.
- The CMMC makes it easier to enforce cyber security standards by setting baseline security controls for different levels of classification. This helps the DoD oversee contractors’ compliance with minimum cyber security requirements.
The CMMC 2.0 Updates
In October 2019, DoD unveiled the most recent edition of its cyber security compliance framework, the CMMC 2.0. The updates were imperative to rectify discrepancies in the initial framework released in 2017.
The CMMC 2.0 introduces several new features and enhancements, such as:
- A redefined interpretation of what qualifies as a Critical Cyber Asset (CCA).
- Updated requirements for cyber hygiene and disaster recovery plans.
- Additional advice on managing third-party cyber security risks.
CMMC 2.0 puts CCAs into four levels based on their potential risk to the DoD.
The four tiers are as follows:
- Tier 1: Low Risk
- Tier 2: Moderate Risk
- Tier 3: High Risk
- Tier 4: Very High Risk
Contractors handling CCAs at Tier 3 or above must incorporate specific security measures to protect these assets from cyber attacks. Such security measures include MFA, restricted access to sensitive data, and malware protection.
In addition, the CMMC 2.0 brings in new prerequisites for contractor cyber hygiene and incident response plans. Contractors must plan for all types of emergencies that could impact their business, not just cyber incidents. Furthermore, cyber hygiene controls must be established at all tiers, rather than solely at Tier 3 and 4.
CMMC 2.0 represents a significant stride towards reinforcing the DoD’s commitment to protecting the DIB from cyber threats. Through the CMMC, contractors handling sensitive information will be required to establish and maintain adequate protections against cyber threats.
Why Adhering To The CMMC 2.0 Framework Is Important
Compliance with the CMMC 2.0 framework is vital as it enables organizations to fortify their data and systems against cyberattacks. The framework is established on NIST SP 800-53rev4, which is widely recognized as the foremost standard for information security. The framework enables organizations to evaluate their risk stance, and determine and execute suitable cyber security measures.
The CMMC incorporates a tiered certification approach that offers organizations a means to gauge their cyber security maturity and advancement. Depending on the cyber security risk level, different certification levels can be attained. To achieve certification, organizations will have to pass a third party assessment by a Certified Third Party Assessment Organization (C3PAO). Certifications are effective for three years, following which the organization must pass an additional certification every three years to ensure compliance.
Companies doing business with the DoD should make getting a CMMC assessment a top priority. It provides a customized and thorough cyber security approach that meets the specific needs of the DoD.
Achieve full compliance with the CMMC framework by leveraging the expertise of professionals.
We invite you to get in touch with FirstCall Consulting as soon as possible to discuss the benefits of CMMC certification. By adhering to these requirements, you can strengthen your cyber security and bolster your resilience against potential cyber attacks. Meeting CMMC requirements can help you stand out from competitors who don’t prioritize cyber security.
For small businesses operating with the DoD, it is essential to implement CMMC requirements to safeguard sensitive DoD information. Failure to comply with these regulations may result in severe consequences, such as contract termination or hefty fines. We urge you to take the necessary steps to comply with the level of CMMC requirements to avoid any negative outcomes.
