If you do business with or supply the U.S. Department of Defense (DoD) – or have plans to – you must be CMMC certified. The Cybersecurity Maturity Model Certification (CMMC) framework exists to protect sensitive DoD information and its industrial base from ever-increasing risk, both from cyber threats and its own supply chain.  

Certification is achieved through alignment to the CMMC framework and a successful assessment by a CMMC Third-Party Assessment Organization (C3PAO). The process can take up to 6 months, but once certification is achieved it’s valid for 3 years and allows companies to bid on DoD contracts that align to their maturity level. 

What is the CMMC Framework? 

The framework itself is built on the NIST cybersecurity standards, which are widely accepted as de facto standards when it comes to cybersecurity best practices and processes. CMMC defines three maturity tiers that individual companies can align to based on the organization's size and the types and volume of sensitive information it has. 

CMMC Model 2.0 Tiers 

Level 1 - Foundational 

Level 2 - Advanced 

Level 3 - Expert 

17 practices 

Best fit for smaller organizations 

Annual self-assessment required 

Lowest cost and time investment 

110 practices aligned with NIST SP 800-171 

Higher cost and time investment 

Annual self-assessment required for select programs 

Triennial third-party assessments required for critical national security information 

110+ practices based on NIST SP 800-171 

Required tier for large organizations 

Highest time and cost investment 

Triennial government-led assessments

Source: https://www.acq.osd.mil/cmmc/about-us.html

How does the certification process work? 

Certification can take up to 6 months, depending on which maturity tier your business aligns to. All vendors applying for certification must be audited and certified by a C3PAO. Higher maturity levels require multiple assessors, adding more time and complexity to the application and review process. A level 1 maturity assessment may only take a few days to complete, versus a level 3 assessment, which could take weeks.  

Regardless of which tier you’re aligning to, the following tips can help you navigate the CMMC certification process: 

  1. Do your homework and understand CMMC requirements. CMMC resource websites outline the process itself and its requirements, which will help you self-select the maturity level that matches your organization’s size and scope. 
  2. Evaluate your security processes in line with CMMC requirements and kick-off a gap analysis. Whether you conduct the analysis internally or source third-party support, a gap analysis is vital to proactively identify any weaknesses and necessary corrections before you formally enter the assessment phase.
  3. Schedule your assessment. Once you’ve remediated any weaknesses identified through your gap analysis, schedule and complete your assessment with a certified C3PAO assessor. You can source assessor support here. 
  4. Review the findings. At this point you’ll enter a 90-day remediation window to review and correct any findings identified by the assessor (if there are any). 
  5. Be patient. After the 90-day remediation window closes CMMC-AB will review the submitted assessment and then issue your certification. 

Why certification matters 

The assessment itself is a process designed to evaluate the cybersecurity practices and controls a business uses to ensure that strong security hygiene and data protection measures are in place. Contrary to popular belief, compliance and alignment to frameworks and standards like CMMC requires more than just ticking a box.  

CMMC assessors examine controls, not policy documentation. That means that throughout the assessment process you must be able to demonstrate ‘how’ you’re safeguarding data and the actual controls and processes you have in place to do so.  

 

The DoD and CMMC review process looks at data through two primary lenses: classified information and controlled unclassified information (CUI). The CMMC maturity tiers apply specifically to the types of classified information your business has, however having the ability to demonstrate how you’re protecting CUI is equally as important as attackers can use CUI as a pathway to larger targets.  

The CMMC certification process ensures you have clear cybersecurity controls in place to protect all sensitive data (classified or unclassified), but understanding the different types of data your business has seems easier said than done. 

Leveraging data discovery for CMMC certification 

CMMC maturity tiers are designed to fit the overall maturity of businesses applying for certification. For example, a small or midsized business won’t have the same level of documentation and policies in place that a large enterprise would, however the expectation of CMMC is that all businesses, regardless of size will have business processes and role expectations in place to manage and protect company data. 

Establishing data discovery and inventory processes within the business proactively supports CUI tracking requirements through the assessment process and annual CMMC assessments after certification is achieved.  

Discovering, classifying, managing and tracking CUI manually or with disparate technology adds unnecessary complexity, time and frustration to the certification process. Proactively putting tools and technology in place that supports the certification process and regular assessments will ultimately save you time and money.  

The Cavelo platform is an all-in-one platform that supports CUI data tracking on an ongoing basis.  

Continuously scan your company’s cloud applications, cloud hosted servers and on-premises servers and desktops to identify, classify and track CUI data types.  

Easily find CUI data types anytime by using the platform’s keyword search function. 

Generate reports that support certification requirements like demonstrating ‘how’ you’re managing and tracking CUI data. 

The CMMC certification process highlights the importance of aligning to industry best practices and ensuring that your business has security controls to properly identify, classify, track and protect sensitive data. Understanding what types of data your organization has, how it’s used, stored and shared is mission critical and the best place to start.  

We’re here to help. 

Let’s talk about how the Cavelo platform can help you get a head start and keep your CMMC certification process on track. 

LET'S TALK