Defense Department Releases Companion CMMC Public Comment

Defense Department Releases Companion Video for CMMC Public Comment Period

Feb. 15, 2024 | By C. Todd Lopez, DOD News

In a bid to demystify the intricacies and significance of the recently published proposed rule for its Cybersecurity Maturity Model Certification (CMMC) program, the Defense Department has unveiled an informative video resource.

Tailored to enlighten members of the defense industrial base and other stakeholders, the video elucidates the nuances of the proposed rule for the CMMC program. Its primary objective is to assist stakeholders in comprehending the intricacies of the program and to facilitate their preparation of comments and feedback for the upcoming review process, shaping the finalization of the CMMC program proposed rule.

A 60-day public comment period on the proposed rule commenced on Dec. 26, 2023, and will conclude on Feb. 26 at 11:59 p.m. The feedback received during this period will be meticulously reviewed and will play a pivotal role in informing the final rule.

At its core, the Cybersecurity Maturity Model Certification program serves as a mechanism for the Defense Department to ascertain the preparedness of defense contractors, regardless of size, in managing controlled unclassified information and federal contract information in compliance with federal regulations.

Central to the program's execution are the authorized CMMC "third-party assessment organizations" (C3PAOs), tasked with conducting CMMC Level 2 certification assessments for interested companies. The Department will oversee CMMC Level 3 assessments.

Although the Department does not remunerate C3PAOs, it does establish the requirements governing their operations. Gurpreet Bhatia, the DOD Chief Information Officer's principal director for cybersecurity, underscores the program's significance in safeguarding crucial DOD information from adversarial incursions.

Bhatia emphasizes that the CMMC program is pivotal in bolstering defense contractors' compliance with cybersecurity regulations while enabling the DOD to monitor compliance status effectively.

He underscores the Department's unwavering commitment to implementing the CMMC Program, underscoring its pivotal role in fortifying the protection of DOD's sensitive information. Bhatia urges stakeholders to seize the opportunity to provide feedback on the proposed CMMC rule, underscoring the importance of collaborative efforts in enhancing cybersecurity and safeguarding DOD information assets.

The Majority Of US Defense Contractors Fails To Meet Basic Cybersecurity Standards.

 According to the study, this could have severe consequences for defense contractors, with nearly half losing up to 60% of their revenue if DoD contracts are lost.

"CMMC is a set of commercially reasonable standards to protect data," said CyberSecOp CISO. Organizations must address it as a part of doing business or risk losing the contract. “Nearly nine in ten (90%) of US defense contractors need to meet basic cybersecurity regulatory requirements.

According to the survey, defense contractors still need to implement basic standards. A sampling:

·        35% have security information and event management (SIEM)

·        39% have an endpoint detection response solution (EDR)

·        18% have a vulnerability management solution

·        28% have multi-factor authentication (MFA)

Defense contractors are being targeted by state hackers.

Defense contractors are a popular target for nation-state groups due to the sensitive information they possess about the US military. The Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory in October 2022 highlighting advanced persistent threat (APT) activity detected on a defense organization's enterprise network.

CyberSecOp CISO is concerned that four out of five defense contractors reported a cyber-related incident, with nearly three out of five reporting business loss due to a cyber-related event.

CyberSecOp is a CMMC-AB REGISTERED PROVIDER ORGANIZATION (RPO)

DOD has made an effort to simplify CMMC, but it is undoubtedly still complicated. CMMC is based on several other standards, including DFARS, 800-171, and ISO 27001. Utilizing all the above information security standards make it very challenging for most DOD contractors to copy with CMMC. Get compliant with CyberSecOp CMMC Assessment, Security Program & Advisory Services.

CyberSecOp Becomes A CMMC Register Provider Organization

CyberSecOp is a leading Cybersecurity Services Provider offering a comprehensive portfolio of Cybersecurity Maturity Model Certification (CMMC) advisory services and cyber security solutions.  

CyberSecOp is an CMMC Registered Provider Organization (RPO) listed on the CMMC-AB Marketplace. Our organization staff have passed the RP Exam, Background Check and signed the RPO agreement, indicating our commitment to comply with the CMMC-AB Code of Professional Conduct. CyberSecOp is also an ISO 27001-certified organization.

 What are CMMC-AB, CMMC, and the Responsibility of the RPO Designation?

 CMMC-AB authorizes RPOs to provide CMMC consulting services in support of government contractors, supply chain/DoD suppliers, and organizations seeking certification within the Defense Industrial Base (DIB).

The CMMC-AB is an independent accreditation body that manages the CMMC on behalf of the DoD. The CMMC framework is a set of mandatory cybersecurity requirements that all contractors within the DoD supply chain will be required to implement and, beginning this year, to have verified by an independent CMMC Third Party Assessment Organization (C3PAO). CMMC was created to address the ongoing theft of and unauthorized access to Controlled Unclassified Information (CUI) by foreign adversaries through the enforcement of good cyber hygiene and best practices. 

It initially launched in June 2020 and formally announced in August 2020 that it was accepting applications for five types of credentialed roles within the CMMC ecosystem. These include the following:

·         C3PAOs

·         Certified Assessors (CAs)

·         Certified Professionals (CPs)

·         Licensed Partner Publishers (LPPs)

·         Registered Practitioners (RPs)

·         Registered Provider Organizations (RPOs)

The CMMC framework establishes five certification levels with a defined security posture or maturity level an organization must achieve, determined by the sensitivity of the information they handle. These are outlined below:

How can CyberSecOp help your organization with CMMC?

CyberSecOp has created a suite of advisory services to help organizations effectively plan and prepare for an official CMMC assessment: CMMC Consulting, CMMC Readiness, Assessments, CMMC-RPO, CMMC Gap Analysis, DFARS, ITAR, VCISO, MSSP, NIST 800 53, and NIST Cybersecurity Framework (CSF), NIST 800-171, Security Services.

 CMMC Scoping Workshop – determine the type of data and the required CMMC maturity level needed. Identify how data is received, stored, shared and handled on all information systems.

CMMC Gap Analysis – identify discrepancies between current state and CMMC maturity levels as determined in the scoping workshop. The CMMC Gap Analysis will provide areas of weakness that need to be targeted to reach the desired maturity level.

 CMMC Remediation Strategy –assist the organization with remediation efforts, including resolving discrepancies identified in the CMMC Gap Analysis and creating a strategic plan for remediation. This process may include security control testing, polices, procedures and plan creation to close all known gaps related to the desired maturity level. 

VCISO (Virtual Chief Information Security Officer) – CyberSecOp provides a board-level security expert backed by a team of professionals to ensure continuous compliance and maintain the maturity level as threats, infrastructure and business objectives evolve. Services include the following.

•  Compliance Advisory Consulting Services

• CMMC Readiness

• Vulnerability and Penetration Testing Assessment

• Ransomware Response

• Forensic Analysis

• 24/7/365 Security Operations Center (SOC)

• Cyber Security Consulting

• CMMC Cybersecurity RP, RPO

• Incident Response & Incident Management

• Security Assessments

• Security Awareness

• Data Loss Prevention 

About CyberSecOp

 Cyber Security Operations Consulting (CyberSecOp) is an innovative cybersecurity firm, providing consultants and managed security services to empower businesses since 2001. Our IT & cybersecurity consulting services protect you from cyber criminals in myriad ways. From implementing individualized Cyber Security Programs, which include written Information Security Programs, Incident Response Policies and Plans, and Cybersecurity Assessments, to offering the best-in-class cybersecurity consulting, tools, and IT security solutions, we do it all.

CyberSecOp is an CMMC-AB RPO & ISO 27001 Certified Organization - join thousands of businesses by putting your security in our hands. For more information about CyberSecOp and CMMC, contact us at 866-973-2677, Sales@CyberSecOp.com or visit: www.CyberSecOp.com.

What you need to know about CMMC Compliance

What is CMMC?

In the face of unacceptable risks to the Controlled Unclassified Information that resides on its contractors' systems, the Pentagon introduced the CMMC standards to ensure that the companies it does business with, adhere to an appropriate level of cybersecurity protections.

The United States Department of Defense is implementing the Cybersecurity Maturity Model Certification (CMMC) to normalize and standardize cybersecurity preparedness across the federal government’s defense industrial base (DIB). This piece will cover the concept of a maturity model in the context of cybersecurity, key depictions of the DIB, the anatomy of CMMC levels, and how CyberSecOp can fast-track CMMC certification with our CMMC Compliance services.

CUI is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls.

A CUI registry provides information on the specific categories and subcategories of information that the Executive branch protects.

What are CMMC protected data

Natural and Cultural Resources

• NATO

• Nuclear

• Privacy

• Procurement and Acquisition

• Proprietary Business Information

• Provisional

• Statistical

• Critical Infrastructure

• Defense

• Export Control

• Financial

• Immigration

• Intelligence

• International Agreements

• Law Enforcement

• Legal

Why was CMMC created?

Department Of Defence Create Cybersecurity Maturity Model Certification (CMMC Guidelines

In the face of unacceptable risks to the Controlled Unclassified Information that resides on its contractors' systems, the Pentagon introduced the CMMC standards to ensure that the companies it does business with, adhere to an appropriate level of cybersecurity protections

DOD is planning to migrate to the new CMMC framework in order to assess and enhance the cybersecurity posture of the Defense Industrial Base (DIB). The CMMC is intended to serve as a verification mechanism to ensure appropriate levels of cybersecurity controls and processes are adequate and in place to protect controlled unclassified information (CUI) that resides on the Department’s industry partners’ networks.

How can my organization become CMMC certified?

Your organization will coordinate directly with an accredited and independent third party commercial certification organization to request and schedule your CMMC assessment. Your company will specify the level of the certification requested based on your company’s specific business requirements. Your company will be awarded certification at the appropriate CMMC level upon demonstrating the appropriate maturity in capabilities and organizational maturity to the satisfaction of the assessor and certifier.

How do I request certification assessment?

We call us for a fee consultation, we provide 3rd party CMMC assessment and certification.

I am a subcontractor on a DoD contract. Do I need to be certified?

• Yes, all companies doing business with the Department of Defense will need to obtain CMMC.

• How often does my Organization need to be reassessed? The duration of a certification is still under consideration.

What are the CMMC Levels?

CMMC Level 1

• Process: At this level, practices are performed in an ad-hoc manner so there is no process requirement.

• Practice: It addresses protection of FCI and 17 practices are required for the basic safeguarding requirements specified in 48 CFR 52.204.21.

CMMC Level 2

• Process: Policy and documentation of practice are required to develop mature capabilities and achieve process Level 2.

• Practice: Progression from Level 2 to Level 3. The majority of practices (65 of 72) comes from NIST SP 800-171 and new 7 practices from other standards are added to Level 2, such as audit log review, event detection/reporting, analyzing triaging events, incident response, Incident RCA (root cause analysis), regular data backup and testing, and encrypted session for device mgmt..

CMMC Level 3

• Process: Not just policy and documentation of practices, a plan is required to demonstrate management of practice implementation activities. The plan needs to address missions, goals, project plans, resourcing, required training and involvement of stakeholders.

• Practice: All 110 control requirements of NIST SP 800-171 are required for this level. In addition, 13 new practices from other standards are added to Level 3, such as defining procedures of CUI data handling, collecting audit info into central repositories, regular data backups, periodical risk assessment, risk mitigation plan, separate management of non-vendor-supported products, security assessment of enterprise software, cyber threat intel response plan, DNS filtering, restriction of CUI publication, spam protection mechanisms, email forgery protections, and sandboxing.

CMMC Level 4

• Process: Practices are reviewed and measured for effectiveness. In addition, correct actions when necessary and communication to higher level mgmt. on a recurring basis are required.

• Practice: In order to protect CUI from APTs, 26 practices enhance the detection and response capabilities to address and adapt to TTPs used by APTs.

CMMC Level 5

• Process: Process standardization and optimization.

• Practice: The additional 15 practices increase the depth and sophistication of cybersecurity capabilities.

What is Cybersecurity Maturity Model Certification (CMMC)

The Cybersecurity Maturity Model Certification (CMMC) is a unified standard intended for implementing cybersecurity across DoD contractors.

The CMMC has been in development for a number of years, but the first details on the framework were released in January 2020. The framework makes use of a “maturity” model, in which audits will be conducted by third-party assessors. Firms will be assigned a “level” that represents the cybersecurity protections, or maturity level they have demonstrated.

Breach Report and predicted loss by 2024

A recent study predicted that business losses due to cybercrime will exceed $4.5 trillion by 2024. The threat to the Defense Industrial Base (DIB)--the network of more than 300,000 businesses, organizations, and universities that research, engineer, develop, acquire, design, produce, deliver, sustain, and operate military weapons systems--is especially alarming due to current cyber warfare activities by cybercriminals and state-sponsored actors.

Security is a foundational component of acquisition

The Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S) recognizes that security is a foundational component of acquisition and that some contractors are trading security to benefit cost, schedule, and performance. It's estimated that the DoD supply chain consists of more than 300,000 businesses and organizations, all of which are targets. Most of these organizations are small to mid-size businesses, which are the most vulnerable to cyber-attacks. Based on over 100 Data Breach Investigation's CyberSecOp recognized that organizations between 100 -300 employees are prime victims for cyber criminals because of lack of security controls.

CMMC Model Structure

The goal of CMMC is to provide a framework for the improvement of cybersecurity in DIB sector organizations. CMMC currently defines 17 domains of technical capability, each with five levels of certification (L1 through L5) and specific practices. The DoD will require an organization to have CMMC Level 3 certification before it can receive Controlled Unclassified Information (CUI) in any domain.

CMMC Domains

CMMC Leveled Practices

The majority of the practices (110 of 171) originate from the safeguarding requirements and security requirements specified in FAR Clause 52.204-21 and DFARS Clause 252.204-7012. The practices fall into five levels:

• Level 1 represents basic cyber hygiene, and focuses on the protection of federal contract information (FCI). It consists of practices that correspond only to the basic safeguarding requirements specified in 48 CFR 52.204-21 ("Basic Safeguarding of Covered Contractor Information Systems").

• Level 2 is a transitional step in cybersecurity maturity progression to protect CUI. Level 2 consists of a subset of the security requirements specified in NIST SP 800-171, as well as practices from other standards and references.

• Level 3 focuses on the protection of CUI. It encompasses all of the security requirements specified in NIST SP 800‑171, as well as additional practices from other standards and references.

• At Level 4, the model begins to focus more on the proactive activities an organization can take to protect, detect, and respond to threats. These practices enhance the organization's ability to address and adapt to the changing tactics, techniques, and procedures (TTPs) used by advanced persistent threats (APT)s.

• Level 5 focuses on the protection of CUI from APTs. The practices increase the depth and sophistication of cybersecurity capabilities.

CMMC Cyber Compliance Services

DOD has made the effort to simplify CMMC, but it is surely still complicated. CMMC is based on several other standards, including DFARS, CERT RMM, 800-171, AU ACSC Essential Eight, UK NCSC Cyber Essentials, ISO 27001, CIS Critical Security Controls, and the NIST Cyber Security Framework. Utilizing all the above information security standards make it very challenging for most DOD contractors to copy with CMMC. Get compliant with CyberSecOp CMMC Assessment, Security Program & Advisory Services.

Author: Kaushik Reddy