Achieve CMMC compliance faster

The Cybersecurity Maturity Model Certification (CMMC) is a framework set by the Department of Defense (DoD) to ensure that contractors and suppliers handling sensitive information meet specific cybersecurity standards. It helps protect federal contract information (FCI) and controlled unclassified information (CUI) within the defense supply chain.

CMMC 2.0 requirements are expected to start appearing in Department of Defense contracts as early as mid-2025, following a phased rollout. Contractors should begin preparing now, as organizations will need certification before they can bid on contracts that include CMMC requirements.

NIST 800-171 is a set of cybersecurity controls focused on protecting FCI and CUI within non-federal systems, which many contractors already follow. CMMC builds on NIST 800-171 by adding verification requirements and multiple maturity levels, which assess not just the presence of controls but also the effectiveness and robustness of cybersecurity practices across organizations.

CMMC applies to all organizations within the DoD supply chain, including contractors, subcontractors, and any business handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) as part of their work with the DoD.

NIST SP 800-171 provides recommended requirements for protecting the confidentiality of controlled unclassified information, or CUI, for government contractors and subcontractors. Therefore, if an organization is a part of the Department of Defense (DoD), General Services Administration (GSA), National Aeronautics and Space Administration (NASA), or other federal or state agencies’ supply chain, it must implement the security requirements included in NIST SP 800-171.

NIST 800-171 has 110 controls organized across 14 control families. These control families include:

• Access control: Determines who has access to data and whether or not they’re authorized
• Audit and accountability: Ensures your staff is adequately trained on the handling of CUI
• Awareness and training: Ensures you know who’s accessing CUI and who’s responsible for what
• Configuration management: Ensures you follow guidelines to maintain secure configurations
• Identification and authentication: Allows you to manage and audit all instances of CUI access
• Incident response: Ensures you prepare a response plan for breaches of CUI data
• Maintenance: Ensures ongoing security and change management in order to safeguard CUI
• Media protection: Secures the handling of external drives, backups, and other backup equipment
• Personnel security: Ensures you train your staff to identify and prevent insider threats
• Physical and environmental protection: Ensures only authorized personnel are in physical spaces where CUI lives
• Risk assessment: Helps you develop a risk profile for CUI breaches as well as evaluate your current level of risk
• Security assessment: Audits and verifies the effectiveness of your security procedures
• System and communications protection: Secures your comms systems and channels
• System and information integrity: Addresses new vulnerabilities and system downtime