CMMC 2.0 Level 3 Compliance

For any Department of Defense (DoD) contractor or supplier that has access to controlled unclassified information (CUI), compliance with Cybersecurity Maturity Model Certification (CMMC) 2.0 is essential. CMMC 2.0 compliance allows private sector contractors to demonstrate the highest possible level of cybersecurity, and continue doing business with the DoD. CMMC 2.0 Level 3, also called Expert, focuses on the effectiveness of cybersecurity controls and practices around protecting CUI from advanced persistent threats (APTs). It replaces the previous CMMC 1.0 Level 5 and brings with it a number of significant changes. CMMC 2.0 Level 3 applies to companies that handle CUI for DoD programs with the highest priority.

For any contractor or organization that has access to CUI, compliance with CMMC 2.0 Level 3 is essential for maintaining the highest possible level of cybersecurity. This article will provide a comprehensive overview of the compliance requirements for CMMC 2.0 Level 3 and will help ensure that your organization starts the journey to compliance with the latest security regulations.

CMMC Level 3 Compliance: Business Benefits

The primary benefit of adhering to CMMC Level 3 requirements is that it provides the DoD needed assurance that the CUI contractors process, collect, send, receive, and store is secure and protected from unauthorized access. Ultimately, CMMC Level 3 compliance instills confidence in an organization’s ability to protect CUI and demonstrate a commitment to cybersecurity. Compliance with CMMC Level 3 requirements can also provide an organization with opportunities for increased access to government contracts and make them a more attractive potential partner for companies in the defense industry, and with potential private sector customers.

Is CMMC 2.0 Level 3 Compliance Mandatory?

No, CMMC 2.0 Level 3 compliance is not mandatory. Organizations that do business with the DoD are required to meet a minimum security posture as outlined by the CMMC, but the specific level of certification required depends on the required services of the organization. Organizations can achieve different levels of CMMC certification, namely Level 1, 2, or 3, depending on the security requirements of their contracts.

CMMC Level 3 Domains and Requirements

For CMMC 2.0 Level 3, there are 134 required controls (110 from NIST SP 800-171 and an additional 24 from NIST SP 800-172). These controls are a means of managing risk that includes policies, procedures, guidelines, practices, or organizational structures, which can be of an administrative, technical, management, or legal nature, and are specified by NIST SP 800-171, NIST SP 800-172, and FAR 52.204-21. These practices sit under 14 different domains, listed below, that are a subset of NIST SP 800-172. CMMC 2.0 requires the contractor to go beyond mere documentation of processes and instead have an active role in the management and implementation of the controls in order to provide the highest level of security possible. The 14 domains include:

Access Control

The Access Control domain introduces 2 additional requirements under CMMC Level 3. They include:

• Restrict access to systems and system components to only those information resources that are owned, provisioned, or issued by the organization.
• Employ organization-defined secure information transfer solutions to control information flows between security domains on connected systems.

Awareness and Training

There are two practices introduced under the Awareness and Training domain in CMMC 2.0 Level 3:

• Provide awareness training upon initial hire, following a significant cyber event, and at least annually, focused on recognizing and responding to threats from social engineering, advanced persistent threat actors, breaches, and suspicious behaviors; update the training at least annually or when there are significant changes to the threat.
• Include practical exercises in awareness training for all users, tailored by roles, to include general users, users with specialized roles, and privileged users, that are aligned with current threat scenarios and provide feedback to individuals involved in the training and their supervisors.

Configuration Management

Under the Configuration Management domain, CMMC 2.0 Level 3 introduces three additional practices that include:

• Establish and maintain an authoritative source and repository to provide a trusted source and accountability for approved and implemented system components.
• Employ automated mechanisms to detect misconfigured or unauthorized system components; after detection, remove the components or place the components in a quarantine or remediation network to facilitate patching, re-configuration, or other mitigations.
• Employ automated discovery and management tools to maintain an up to-date, complete, accurate, and readily available inventory of system components.

Identification and Authentication

There are two additional requirements in the Identification and Authentication domain under CMMC 2.0 Level 3:

• Identify and authenticate systems and system components, where possible, before establishing a network connection using bidirectional authentication that is cryptographically based and replay resistant.
• Employ automated or manual/procedural mechanisms to prohibit system components from connecting to organizational systems unless the components are known, authenticated, in a properly configured state, or in a trust profile.

Incident Response

Under Incident Response, CMMC 2.0 Level 3 introduces two additional practices:

• Establish and maintain a security operations center capability that operates 24/7, with allowance for remote/on-call staff.
• Establish and maintain a cyber-incident response team that can be deployed by the organization within 24 hours.

Personal Security

The Personal Security domain adds one additional practice under CMMC 2.0 Level 3:

• Ensure that organizational systems are protected if adverse information develops or is obtained about individuals with access to CUI.

Risk Assessment

There are seven additions to Risk Assesment under CMMC 2.0 Level 3:

• Employ threat intelligence, at a minimum from open or commercial sources, and any DoD-provided sources, as part of a risk assessment to guide and inform the development of organizational systems, security architectures, selection of security solutions, monitoring, threat hunting, and response and recovery activities.
• Conduct cyber threat hunting activities on an on-going aperiodic basis or when indications warrant, to search for indicators of compromise in organizational systems and detect, track, and disrupt threats that evade existing controls.
• Employ advanced automation and analytics capabilities in support of analysts to predict and identify risks to organizations, systems, and system components.
• Document or reference in the system security plan the security solution selected, the rationale for the security solution, and the risk determination.
• Assess the effectiveness of security solutions at least annually or upon receipt of relevant cyber threat information, or in response to a relevant cyber incident, to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence.
• Assess, respond to, and monitor supply chain risks associated with organizational systems and system components.
• Develop a plan for managing supply chain risks associated with organizational systems and system components; update the plan at least annually, and upon receipt of relevant cyber threat information, or in response to a relevant cyber incident.

Security Assessment

There is one addition to Security Assessment under CMMC 2.0 Level 3:

• Conduct penetration testing at least annually or when significant security changes are made to the system, leveraging automated scanning tools and ad hoc tests using subject matter experts.

System and Communications

For System and Communications, the additional requirement under CMMC 2.0 Level 3 is:

• Employ physical isolation techniques or logical isolation techniques or both in organizational systems and system components.

System and Information Integrity

There are three additions under CMMC 2.0 Level 3 and they include:

• Verify the integrity of security critical and essential software using root of trust mechanisms or cryptographic signatures.
• Ensure that specialized assets including IoT, IIoT, OT, GFE, Restricted Information Systems, and test equipment are included in the scope of the specified enhanced security requirements or are segregated in purpose specific networks.
• Use threat indicator information and effective mitigations obtained from, at a minimum, open or commercial sources, and any DoD provided sources, to guide and inform intrusion detection and threat hunting.

CMMC Level 3 Compliance Challenges

Common challenges in implementing CMMC Level 3 requirements include an insufficient understanding of security processes, difficulty in assessing specific security controls, difficulty implementing technical controls, and difficulty obtaining or keeping personnel trained in the required areas. Additionally, organizations may face challenges in developing policies, procedures, and processes that are compliant with CMMC Level 3 requirements, and ensuring that all stakeholders understand their roles and responsibilities in ensuring the organization’s security posture.

Overcoming CMMC 2.0 Level 3 Challenges

Organizations can overcome the challenges associated with implementing CMMC Level 3 requirements by developing a comprehensive security plan, investing in security training and education for personnel, leveraging outside resources, leveraging automated solutions and/or outsourcing service providers to assist with implementation, and keeping stakeholders informed. Additionally, organizations should regularly monitor the security posture of the organization to ensure compliance and address any areas that may require additional attention. Organizations should also take a proactive approach to security and should prioritize responding to threats and vulnerabilities identified during their security assessment process.

CMMC 2.0 Level 3 Noncompliance Risks

If an organization fails to comply with CMMC 2.0 Level 3 requirements, it may lead to a loss of access to government contracts, and the organization may be subject to penalties and fines. Additionally, failure to comply with the requirements may lead to reputational damage and a loss of trust in the organization’s ability to secure CUI and other sensitive content.

Kiteworks Accelerates Time to Achieve CMMC 2.0 Compliance for DoD Suppliers

The Kiteworks Private Content Network (PCN) is FedRAMP Authorized for Moderate Level Impact. As a result, the Kiteworks PCN helps DoD contractors and subcontractors demonstrate CMMC 2.0 compliance. In fact, Kiteworks supports nearly 90% of CMMC Level 2 requirements out of the box. Other compliance vendors without FedRAMP Authorized certification are unable to achieve this level of compliance. Kiteworks, therefore, accelerates the time it takes DoD suppliers to achieve CMMC Level 2 compliance.

Using a content-defined zero-trust approach, supported by a FedRAMP-authorized platform featuring a hardened virtual appliance, Kiteworks protects sensitive communications involving CUI and FCI content across numerous channels—including email, file sharing, managed file transfer, web forms, and application programming interfaces (APIs). 

Schedule a custom demo today to see how the Kiteworks Private Content Network enables DoD contractors and subcontractors to accelerate and simplify their CMMC certification process.

Back to Risk & Compliance Glossary