The new CMMC version 1 was published in January 2020. This presentation was provided to small businesses's that are part of the DoD supply chain. It helps to understand the requirements.

1. CYBERSECURITY MATURITY MODEL
CERTIFICATION (CMMC)
Presented by: Dr. Shawn P. Murray, C|CISO, CISSP CRISC
February 18, 2020

2. www.pikespeaksbdc.org
Funded in part through a cooperative agreement with the U.S. Small Business Administration

3. Cybersecurity Maturity Model Certification
Agenda
• Govt. Contracts
• OUSD(A&S) Perspective
• CMMC Version 1.0
• Assessing NIST SP 800-171
• CMMC Certification
• Maturity levels for NIST 800-171/CMMC compliance
• Questions
© 2020 Colorado SBDC TechSource

4. Susan Cassidy, Government Contracts Attorney
• “The concept of a CMMC framework arose in response to a series of high-
profile breaches of DoD information,” writes Susan Cassidy, Government
Contracts Attorney, Covington.”
• “This new program was designed to strengthen the defense industrial base
and be a relevant benchmark to secure the supply chain, she said.”
• “The framework aims to certify a company’s compliance with federal
cybersecurity regulations around controlled unclassified information (CUI).”
© 2020 Colorado SBDC TechSource

5. OUSD(A&S) Perspective
• The Office of the Under Secretary of Defense for Acquisition and
Sustainment (OUSD(A&S)) recognizes that security is foundational to
acquisition and should not be traded along with cost, schedule, and
performance moving forward.
• The Department is committed to working with the Defense Industrial
Base (DIB) sector to enhance the protection of controlled unclassified
information (CUI) within the supply chain.
© 2020 Colorado SBDC TechSource

6. CMMC Partners
• OUSD(A&S) is working with DoD stakeholders, University Affiliated Research Centers (UARCs),
Federally Funded Research and Development Centers (FFRDC), and industry to develop the
Cybersecurity Maturity Model Certification (CMMC).
• The CMMC will review and combine various cybersecurity standards and best practices
and map these controls and processes across several maturity levels that range from basic
cyber hygiene to advanced.
• For a given CMMC level, the associated controls and processes, when implemented, will reduce risk
against a specific set of cyber threats.
• The CMMC effort builds upon existing regulation (DFARS 252.204-7012) that is based on
trust by adding a verification component with respect to cybersecurity requirements.
• The goal is for CMMC to be cost-effective and affordable for small businesses to
implement at the lower CMMC levels.
• The intent is for certified independent 3rd party organizations to conduct audits and
inform risk.
© 2020 Colorado SBDC TechSource

7. © 2020 Colorado SBDC TechSource
DoD
Announces
Release of
CMMC
Version 1.0

8. © 2020 Colorado SBDC TechSource

9. DoD Announces the Release of CMMC Version 1.0
First:
• Secretary Lord emphasized the significant national security threat that
contractors and their subcontractors face from sophisticated cyber adversaries.
• She noted that cyber attacks are low cost to conduct, but that in the past year
alone, cyber attacks resulted in approximately $600 billion dollars of global GDP
lost through cyber theft.
• She also emphasized that DoD has expended considerable efforts communicating
with and receiving input from industry and sees this as a key partnership
between DoD and the defense industry to protect sensitive government
information.
© 2020 Colorado SBDC TechSource

10. Second:
• DoD representatives explained that DoD is taking a “crawl, walk, run” approach with
implementation of the CMMC.
• Although the rollout will begin this year, DoD’s goal is to have the requirement fully implemented
by Fiscal Year 2026.
• This year, DoD intends to select third party accreditation vendors, to be called “C3PAOs.”
• Although no significant details as to content were shared, DoD also plans to publish a new DFARS
regulation in late spring or in early summer.
• Finally, DoD plans to add CMMC requirements to ten procurements at the end of this year with
contractors and subcontractors expected to meet all applicable CMMC requirements at the time
of award.
• DoD’s expectation is that each individual procurement will affect a relatively large number of
contractors once subcontract awards at various levels of the supply chain are taken into account.
• These procurements are expected to include a mix of CMMC Levels.
© 2020 Colorado SBDC TechSource
DoD Announces the Release of CMMC Version 1.0

11. Third:
• DoD provided some insight into the Accreditation Body, which it stood up in early January 2020.
• The Accreditation Body is charged with overseeing training, quality, and administration of the
C3PAOs and will consist of 13 members from the defense industrial base, cybersecurity
community, and academic community who self-nominate to join.
• The names of the members of the Accreditation Body were not provided at the press
conference, but DoD shared that the Body has elected a Chairman and that it has a Board of
Directors.
• DoD is currently drafting a memorandum of understanding (“MOU”) with the Accreditation Body
that will outline the roles, rules, and responsibilities of the parties.
• Given the sensitive information that the Accreditation Body and the auditors will have access to,
the MOU is expected to address potential conflicts of interest.
© 2020 Colorado SBDC TechSource
DoD Announces the Release of CMMC Version 1.0

12. Assessing NIST SP 800-171
• NIST Handbook 162 "NIST MEP Cybersecurity Self-Assessment Handbook For Assessing NIST SP
800-171 Security Requirements in Response to DFARS Cybersecurity Requirements.”
• The Handbook provides a step-by-step guide to assessing a manufacturer’s information systems
against the security requirements in NIST SP 800-171 rev 1.
• In addition to helping defense contractors comply with DFARS, the Handbook may also be useful
for other manufacturers interested in applying the NIST SP 800-171 security requirements,
including those seeking to comply with the Controlled Unclassified Information Federal Acquisition
Regulation (FAR) clause.
• Additionally, manufacturers operating in commercial supply chains may consider implementing
the NIST security requirements as an integral aspect of managing their organizational risks.
• The MEP National NetworkTM has been active in providing awareness and assistance to help U.S.
manufacturers protect their information assets from the risks of cyberattacks.
• MEP Centers can provide valuable assistance to small manufacturers seeking reduction of their
cyber risks and DFARS compliance.
© 2020 Colorado SBDC TechSource

13. CMMC Certification
• To be certified at a specific Level, contractors are required not only to
implement each of the Practices required for the specific Level, but also
to achieve a certain level of maturity for the specific Level regarding the
implementation of all the Practices.
• For example,
• Level 1, simply requires contractors to “Perform” the Practices,
• Level 3 requires all the related Practices to be “Managed”
• Level 5 requires all the Practices to be “Optimized.”
© 2020 Colorado SBDC TechSource

14. CMMC Certification
Term Description Number
Domains Key sets (or families) of cybersecurity requirements. 17 Domains in total.
Capabilities Sub-set of requirements within each Domain. 43 Capabilities in total.
Practices
Security controls required by Level necessary to
achieve a certain Capability.
171 Practices when aggregated across
all certification Levels.
Processes
Measure of maturity (or institutionalization) of
policies, plans, and activities associated with
Practices.
5 Processes when aggregated across all
certification Levels.
© 2020 Colorado SBDC TechSource
Along with the release of the updated model, DoD announced that it was working on a Defense Federal Acquisition Regulation
Supplement (“DFARS”) rule that should cover some of the implementation issues associated with the CMMC.

15. Maturity levels for NIST 800-171/CMMC compliance.
• The Department of Defense currently mandates that its contractors
meet the requirements of NIST Special Publication 800–171 but there is
no audit or accountability for protecting CUI.
• This shortcoming has led to the devising of the Cybersecurity Capability Model
Certification (CMMC), which will require third-party audits and certification for
the DoD supply chain for compliance built on the Defense Federal Acquisition
Regulation Supplement (DFARS) 252.204-7012.
• This requires defense contractors handling sensitive, unclassified
information to implement the 110 security controls of NIST SP 800-171.
© 2020 Colorado SBDC TechSource

16. Maturity levels for NIST 800-171/CMMC compliance
• Implementing cybersecurity in DoD supply chains is based on the
identification of five certification tiers for CMMC:
• CMMC Level 1 | Basic Cyber Hygiene | 17 security controls (NIST SP 800-171 rev 1)
• CMMC Level 2 | Intermediate Cyber Hygiene | 46 security controls (NIST SP 800-171 rev 1)
• CMMC Level 3 | Good Cyber Hygiene | 47 security controls (NIST SP 800-171 rev 1)
• CMMC Level 4 | Proactive | 26 security controls (NIST SP 800-171B)
• CMMC Level 5 | Advanced/Progressive | 4 security controls (NIST SP 800-171B)
© 2020 Colorado SBDC TechSource

17. The maturity levels for NIST 800-171/CMMC
compliance.
• Previous guidance under NIST’s SP
800-171 allowed for self-
assessment, and attestation in
order for companies to be awarded
a certification at the appropriate
CMMC level.
• This year, under CMMC,
organizations will now need to
demonstrate to assessors and
certifiers the following:
• appropriate capabilities;
• organizational maturity,
• proper controls and processes in place
to reduce the risk of specific
cyberthreats.
© 2020 Colorado SBDC TechSource

18. Resources
• https://www.acq.osd.mil/cmmc/index.html
• https://www.nist.gov/mep/cybersecurity-resources-manufacturers/dfars-compliance
• https://nvlpubs.nist.gov/nistpubs/hb/2017/NIST.HB.162.pdf
• https://www.insidegovernmentcontracts.com/2020/02/dod-announces-the-release-of-
cmmc-version-1-
0/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+InsideGove
rnmentContracts+%28Inside+Government+Contracts%29
• https://www.insidegovernmentcontracts.com/2020/02/a-closer-look-at-version-1-0-of-
dods-cybersecurity-maturity-model-
certification/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+I
nsideGovernmentContracts+%28Inside+Government+Contracts%29
© 2020 Colorado SBDC TechSource

19. Questions?
© 2020 Colorado SBDC TechSource
Thank you!

20. www.pikespeaksbdc.org
Funded in part through a cooperative agreement with the U.S. Small Business Administration