DoD and CMMC Requirements

The Department of Defense (DoD) is responsible for ensuring the protection of the United States from external and internal threats, maintaining lawful and effective military operations, and developing and maintaining the capability of the United States to conduct any military missions necessary to protect the nation. These responsibilities also include providing for national security policy and oversight, responding to national security threats, and managing research and development of new technologies.

The DoD cannot perform these functions in a vacuum; it relies on over 300,000 contractors and subcontractors for support. This vast supply chain network is called the Defense Industrial Base (DIB). Given the sensitive nature of the DoD’s work, it is imperative the contractors in the DIB are equipped with the appropriate cybersecurity tools to protect the sensitive information they share with the DoD. In response, the DoD developed the Cybersecurity Maturity Model Certification (CMMC) to protect the confidentiality of this information. CMMC is intended to build security protections around the DIB supply chain by assessing the security of defense contractors’ networks and systems to ensure compliance with government standards on data security.

Understanding the Department of Defense and CMMC

The DoD’s DIB is a vital ecosystem comprised of private sector companies that enable the DoD to achieve its goals. It supplies essential materials, components, and services. Following is a quick snapshot of some of the products and services provided by the DIB:

1. Military Aircraft: Manufacture, modification, and maintenance of military aircraft, including transport, combat, and reconnaissance aircraft.
2. Guidance and Navigation Systems: Design and production of guidance and navigation systems for warfighting platforms, including non-GPS-based inertial navigation systems.
3. Weapons Systems: Manufacture, maintenance, and support services for weapons systems such as missiles and rockets, artillery, torpedoes, bombs, and electronic countermeasures.
4. Communications Systems: Design and production of communications systems for both operational and intelligence networks.
5. Logistics and Support Services: Provision of logistics and support services, such as warehousing, transportation, supply chain management, and personnel support.
6. Unmanned Platforms: Design, manufacture, and maintenance of unmanned platforms such as drones, robots, and autonomous underwater vehicles.
7. Cybersecurity Solutions: Design and implementation of cybersecurity solutions, including firewalls, malware protection, and network security monitoring.
8. Shipbuilding and Repair: Design, construction, and maintenance of both military and civilian vessels.
9. Training and Simulation: Provision of training and simulation services for military personnel, as well as logistics and mission support.
10. Research and Development: Research and development of emerging warfighting technologies, including artificial intelligence, biometrics, and robotics.

CMMC 2.0 sets out a series of measures for DoD suppliers to protect their networks and data from malicious and accidental threats. The certification scheme is a three-level framework that evaluates the security practices and capabilities of organizations operating in the DIB. Companies seeking to become CMMC certified must meet the criteria of one of the three levels, depending on the complexity of their operations and the sensitivity of the information they possess.

CMMC Level 1 places basic security requirements on organizations, such as properly securing physical access to sensitive information and using good password management processes. CMMC Level 2 includes additional controls, such as identifying user roles and assigning privileges accordingly, and ensuring access is restricted to only those who need it. CMMC Level 3 incorporates the most stringent cybersecurity requirements, including advanced threat detection and response capabilities, and is reserved for those organizations working with controlled unclassified information (CUI).

What Is Controlled Unclassified Information (CUI)

CUI refers to information that is considered by the DoD to be sensitive but not classified. CUI includes information that is regulated or restricted by both federal and non-federal laws and regulations. Examples of CUI include proprietary information, confidential business information, or government-owned or government-controlled information.

 

CMMC vs. NIST SP 800-171

CMMC 2.0 Level 2 aligns with the practice requirements in NIST 800-171, a list of 110 practice controls with which government contractors handling CUI must comply. In comparison to the NIST Special Publication (SP) 800-171, CMMC 2.0 Level 2 is more thorough and requires more in-depth and reliable evaluations that are unavailable with the NIST SP 800-171. CMMC 2.0 Level 2 requires organizations to implement advanced cybersecurity practices, such as encryption, vulnerability management, and incident response. On the other hand, NIST 800-171 only requires the implementation of basic cybersecurity practices. CMMC 2.0 also requires organizations to provide evidence of compliance with the framework. Organizations must document their implementation of the different requirements and controls and submit their compliance documentation to the DoD. The NIST 800-171 does not require the same level of documentation. Organizations must only make sure that their data security practices meet the requirements.

CMMC 2.0 Level 2 is an effective tool for increasing security in the DoD supply chain, as it requires contractors to constantly update their security practices and ensure they meet the highest security standards. This helps ensure that CUI is kept safe and secure and is not put at risk. Furthermore, it allows the DoD to have a better understanding of the security measures their contractors are taking, so they can feel confident that they are working with organizations that can protect CUI and at the appropriate level of security needed.

Understanding the Three CMMC 2.0 Levels

CMMC 2.0 levels range from basic to expert, and each level requires more stringent security measures from whatever level previously addressed. As a result, contractors are forced to take a more proactive approach to security and risk management. These must be embedded as part of an organization’s cybersecurity risk management strategy.

CMMC 2.0 Level 1 requires organizations to establish basic security measures. This includes physical security, access control, system inventory, data protection, and incident response. Organizations must also comply with NIST SP 800-171 requirements, such as encryption and user authentication.

CMMC 2.0 Level 2 requires organizations to have a more comprehensive set of security measures in place. This includes not only the Level 1 requirements, but also more detailed policies and procedures, such as limiting access to sensitive systems and data, identifying user roles, and assigning privileges accordingly, and maintaining an inventory of system assets. Organizations must also comply with NIST SP 800-171 requirements, such as preventing unauthorized access and authenticating users.

CMMC 2.0 Level 3 is the highest level of certification and aligns with NIST SP 800-172. Organizations must implement risk-based security measures and establish more advanced data security controls, such as advanced threat detection and response capabilities. They must also ensure that all personnel, subcontractors, and vendors comply with CMMC requirements. Organizations must also comply with NIST SP 800-171 requirements, such as encryption and user authentication.

Understanding CMMC Requirements

Understanding CMMC requirements is essential for any organization that currently works with, or hopes to eventually work with, the DoD. Understanding CMMC requirements can help ensure that contractors’ systems are meeting the security measures necessary to conduct sensitive operations.

To ensure adherence to the various CMMC requirements, DoD contractors must map out their existing cybersecurity practices and processes. Many organizations have utilized a C3PAO (CMMC Third Party Assessor Organization), which provides an assessment of a contractor’s compliance level, gives guidance on areas of improvement, and helps develop and execute an approved CMMC action plan. For DoD contractors that rely heavily on data sharing, a private content network can also be leveraged to simplify and accelerate the process of achieving CMMC compliance.

DoD contractors should also be aware of the possible penalties they may face if they fail to meet the necessary CMMC requirements. This includes fines, suspension of contracts, or in extreme cases, loss of contracts and the right to bid on new DoD contracts. It is important for DoD contractors to understand the implications of not meeting CMMC requirements, so they can adequately prepare and implement long-term measures to satisfy CMMC requirements.

Benefits of CMMC Certification

CMMC certification reassures the DoD that the contractors they work with are desirable partners because they have met the DoD’s stringent cybersecurity requirements. Because the CMMC framework requires DoD contractors to implement robust security measures, contractors who achieve CMMC certification gain a competitive advantage in the broader (private sector) marketplace. CMMC certification establishes a security baseline across the DoD supply chain based on the type of private data they send, share, receive, and store. Contractors that have achieved CMMC certification (especially Level 2 and Level 3) generally have a stronger cybersecurity posture that should help to prevent cyberattacks, data breaches, compliance violations, and other potential cybersecurity threats.

CMMC certification also helps contractors build a reputable brand name and increase customer confidence. Certification can also provide legal and contractual advantages for contractors, including access to more desirable or lucrative contracts and other important benefits. Ultimately, DoD contractors that achieve CMMC certification enjoy many business benefits.

Achieving CMMC Certification

Organizations wishing to become certified at any of the three CMMC levels must first ensure that they meet all the requirements of that level. This includes implementing the security measures specified in the CMMC 2.0 practice controls. (Note: Businesses that demonstrate compliance with CMMC 2.0 Level 2 practice requirements do not automatically comply with NIST 800-171.)

Once a business has met the requirements for CMMC Level 2 and Level 3 through self-attestation, the business must then seek certification from a CMMC-accredited third-party certification body (C3PAO). The certification process involves assessing the business’s security measures and determining whether the business meets the requirements of the desired level of certification. If the business meets the requirements, it will be awarded the appropriate CMMC certification.

Businesses that seek to achieve CMMC certification face common challenges during the certification process. These challenges include a difficulty in understanding CMMC requirements and a difficulty in implementing the required security measures. Businesses can frequently overcome these challenges by consulting a CMMC-certified consultant or working with a CMMC-accredited third-party organization that specializes in providing CMMC-related services.

Kiteworks Helps Organizations Achieve CMMC Compliance

Kiteworks supports nearly 90% of CMMC 2.0 Level 2 requirements out of the box. The Kiteworks Private Content Network unifies email, file sharing, managed file transfer (MFT), web forms, and application programming interfaces (APIs) into one platform comprised of automated policy controls and tracking that align with CMMC 2.0 Level 2 practices.

The Kiteworks Private Content Network accelerates CMMC certification for DoD suppliers. Some of the key capabilities of the platform that pertain include:

• Enterprise-grade security such as file-level TLS 1.2 encryption in transit and AES 256-bit encryption at rest
• Self-contained, preconfigured hardened virtual appliance optimized for security
• FedRAMP authorized for Moderate Level Impact
• FIPS 140-2 validated
• SOC 2 Level 1 attestation and enables SOC 2 certification
• ISO 27001, 27017, and 27018 certified
• Compliant with NIST SP 800-171, NIST SP 800-172, FISMA, and others

Kiteworks also provides current and aspiring DoD contractors and subcontractors complete control and visibility of the CUI that is sent, received, shared, or stored. Kiteworks, for example, enables organizations to apply granular policy controls, standardize security policy across all communication channels, and even define role-based permissions for external users.

In addition, Kiteworks provides a real-time and historical view of all inbound and outbound file movement and records this activity, namely who’s sending what to whom, when, and where, creating a comprehensive audit trail. Complete control and visibility of the content that enters and leaves the organization enables DoD contractors to demonstrate compliance with data privacy regulations all over the world, including, but not limited to the General Data Protection Regulation (GDPR), Health Insurance Portability and Accountability Act (HIPAA), California Consumer Privacy Act (CCPA), Information Security Registered Assessors Program (IRAP), Personal Information Protection and Electronic Documents Act (PIPEDA), and many more.

To see the Kiteworks platform in action and learn how it can accelerate your CMMC compliance journey, schedule a custom demo today.

Back to Risk & Compliance Glossary