Commentary Addressing Risks and Opportunities Through the Life Cycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

With all the noise and hype around Cybersecurity Maturity Model Certification (CMMC) compliance, it can be hard to track what practical steps an organization should take to ensure that it is still able to bid on government contracts or participate as a subcontractor within the Defense Industrial Base. The good news is that CMMC is just another data security standard, and, as with many other standards, compliance can be broken down into small, achievable steps regardless of the starting point.

core/paragraph

At a high level, any entity that wants to achieve CMMC certification should begin by answering the following questions:

What level of CMMC will I need for opportunities in the next 24 months?

core/list-item

Does my organization have a system security plan (SSP)?

Does my organization currently follow any other security standards that could be used as a starting point?

Do we have a data map showing the data flows, involved systems and third parties that receive information from my organization?

What policies, procedures and training are currently in place?

What types of documentation could my organization produce to evidence the implementation of the policies and procedures?

core/list

core/heading

Even if your organization does not yet have a contract with the Department of Defense (DoD) that requires a specific CMMC level, you can still estimate the level you may be required to meet for future opportunities. First, look at past contract terms to see if your organization received or created controlled unclassified information – information that will require CMMC Level 2 – or if your contract only involved federal contract information – information that will require CMMC Level 1. Second, review the required CMMC level in new contracts and solicitations that are similar to the type your organization would like to bid on in the future. This exercise will shed light on the CMMC level that the organization should work to achieve. Third, particularly if you are a subcontractor, discuss with your teaming partners and prime contractors the CMMC level they anticipate needing from your organization in the future.

The specific level your organization may need to achieve will be business-dependent. However, the DoD estimates that when CMMC is fully operational, the following number of certified contractors will be needed at each level:

Estimated Number of Contractors

core/table

See <a href="https://www.bakerlaw.com/insights/ready-or-not-cmmc-is-here-dod-issues-final-rule-establishing-contract-clauses-implementing-cmmc-program/" target="_blank" rel="noreferrer noopener">Ready or Not, CMMC Is Here: DoD Issues Final Rule Establishing Contract Clauses Implementing CMMC Program</a>.

An SSP functions as a guide to explain how an organization complies with required security contracts. More specifically, an SSP is a document that describes how an organization meets the security requirements for a system or how an organization plans to meet the requirements. The SSP describes the system boundary, the environment in which the system operates, how security requirements are implemented, and the relationships with or connections to other systems. See NIST SP 800-172.

In other words, the SSP describes how the organization is meeting the controls required by the applicable CMMC level. While there is rigidity in the controls that must be met, there is more flexibility in how to meet them. If you do not already have an SSP, work with your appropriate legal, information security and compliance team members to develop one that aligns with the appropriate anticipated CMMC level. While the exact process for developing an SSP will be specific to your organization, here are some key points to consider:

If you already follow another security standard, start by assessing the overlap of controls so that you can leverage work that has already been accomplished.

Understand the types of data you collect and process, the systems that touch that data, and any third parties that receive the data. This will help you better scope your CMMC obligations and may potentially allow you to keep portions of your environment out of scope for any assessment.

The language used in the SSP matters and has legal ramifications. SSPs are representations that an organization is making regarding its security posture and compliance. As such, plan to include your legal stakeholders in the process of drafting and reviewing the SSP.

Drafting the SSP will likely be an iterative process that needs clear coordination. It involves collecting data from across your organization, interviewing stakeholders, understanding and documenting evidence, and potentially coordinating with third parties such as cloud service providers.

There is no one-size-fits-all approach because every organization is different and will have a different starting point. Organizations should discuss where they are starting, the end goal and the parties (internally and externally) that should be involved in the process. And then, with that information in mind, map out a plan.

Organizations that already have an SSP should work with the same stakeholders described above to review and, as needed, update the SSP to match the controls needed for the business’s goals. The review should assess whether the SSP’s representations are still accurate based on the organization’s current practices and ensure that the SSP addresses all required controls.

Wait! My Documentation Needs Its Own Documentation?!

Yes, the CMMC process involves a lot of documentation. The SSP is essentially the master document that helps steer your information security compliance program. The SSP will describe how the organization implements each control. But the SSP is just the starting point that will lead to a list of additional documents and actions that will be required to bring the organization into compliance with the target CMMC level. The next layer of documents are the policies and procedures. These policies and procedures will act as a part of the supporting documentation and evidence showing the implementation of the security measures described in the SSP.

The policies and procedures will cover a number of topics. When writing the SSP, organizations reference specific policies and procedures to show how the organization meets the specific controls. In some cases, a policy is explicitly required, while in other cases, having the policy in place is the best method to evidence the implementation of a control.

The SSP and the organization’s policies and procedures will work hand in hand to show exactly how the organization meets each of the required controls.

Relatedly, the workforce will need to be trained on the policies and procedures. Organizations with fully implemented programs will have trainings in place to ensure the workforce is aware of the requirements. CMMC also especially requires incident response training to ensure the workforce understands what to do if there is a potential security incident.

The extensive documentation required to create the compliance program is another reason it is critical to have someone who understands the requirements, considers the big picture and ensures that the right boxes are checked. There should be multiple reviews throughout this process to confirm that all documents align with each other and with how the organization operates in practice.

In an upcoming post, we will discuss additional evidence that an organization will need as it moves closer to the CMMC audit.

If your organization is considering CMMC certification, the process to assess what must be completed to pass the CMMC assessment should be started as soon as possible. Depending on where your organization is starting, there may be a significant amount of work to complete before it is ready for the audit. Every organization needs to start somewhere and there are many ways to meet the controls, but implementation takes time.

Starting the process as soon as possible is particularly important for organizations that have lines of business connected to the federal government. Without the required level of CMMC certification, organizations risk being excluded from future procurements that include CMMC requirements and may be left out of the supply chains for larger contracts.

CMMC … Where Do I Even Begin? Scratching the Surface with Audit Preparation