Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

10/20/2020
02:00 PM
Nahla Davies
Nahla Davies
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

The Cybersecurity Maturity Model Certification: Are You in Compliance?

Not only can this framework help companies remain solvent, but it will also protect critical information from getting into the wrong hands.

Let's face it: Cybersecurity threat risk isn't going anywhere, and it's only going to get worse. This realization caused the Department of Defense (DoD) to create the Cybersecurity Maturity Model Certification (CMMC) early this year. This is a unified standard for the successful implementation of cybersecurity across the more than 300,000 companies in the supply chain.

Related Content:

Solving the Problem With Security Standards

State of Endpoint Security: How Enterprises Are Managing Endpoint Security Threats

New on The Edge: Securing Slack: 5 Tips for Safer Messaging, Collaboration

The CMMC takes into account how most businesses can't keep up with the influx of vulnerabilities affecting their infrastructure and software. It's the DoD's answer to widespread compromises of critical defense information that is usually stored on the information systems of the contractors.

Why Is CMMC Compliance So Crucial? 
There has been a steady increase in the number of data breaches and other cybercrimes in the past few years. Keeping this in mind, companies have started implementing artificial intelligence and machine learning in cybersecurity to curb cybercriminal activities — such solutions are still a work in progress.

Companies need to work on boosting their security from the prying eyes of hackers to protect their online identities and simultaneously block malware that could potentially harm their network.

Back in 2015, the DoD published the Defense Acquisition Federal Regulation Supplement (DFRS). As a result, contractors needed to ensure compliance with the NIST SP 800-171 cybersecurity framework.

Understanding and implementing DFARS's requirements has been a constant struggle for contractors. While a few firms had the resources to make themselves compliant, others were subcontracting their cybersecurity responsibilities to managed service providers.

Although the DoD took steps to make the adoption of DFARS easier, many companies were still lagging behind with the implementation of the earlier framework. Some companies even falsely said they were in compliance through deliberate deception or claiming ignorance. Hence, CMMC was introduced to solve this issue.

These standards make sure that the appropriate levels of cybersecurity controls and processes are in place, which, in turn, will protect controlled unclassified information (CUI) on the DoD's contractor systems.

CUI is the information that needs safeguarding or dissemination controls agreeable to and consistent with applicable laws and policies under the Atomic Energy Act. In other words, it's the data that must be strictly protected within an information system. This includes many types of data, such as health documents, legal material, technical drawings and blueprints, and intellectual property.

The Four Levels of CMMC Compliance That Venders Should Know About
CMMC compliance has five defined levels that include different areas ranging from basic hygiene to advanced security. Additionally, each one of these levels has its own set of practices and processes. Vendors have to meet the practices and processes of each of these levels, which ends up creating an "all or nothing" approach.

Level 1:
Every company must perform "basic cyber-hygiene" practices. This includes ensuring that companies change passwords regularly to protect federal contract information and using antivirus software for keeping their network secure and safe from threats.

This level excludes public information or specific transactional information.

Level 2:
Companies should document "intermediate cyber hygiene" practices to enhance their efforts to protect any CUI, and they must implement some of the NIST 800-171 r2 security requirements.

National Archives describes CUI as "any information that law, regulation, or government-wide policy requires to have safeguarding or disseminating controls.” However, it doesn't include certain classified information.

Level 3:
In order to successfully implement "good cyber-hygiene" practices to safeguard CUI, companies must have an institutionalized management plan. This plan includes all the NIST 800-171 r2 security requirements, along with other additional standards.

Level 4:
Company owners should take the necessary steps to implement processes for measuring and reviewing the effectiveness of practices.

In addition, already established, enhanced practices should also be put in place to detect and respond to changing tactics, techniques, and procedures of advanced persistent threats (APTs).

What Can Suppliers Do to Ensure They Are in Compliance With the CMMC?
The following are the five steps through which DoD contractors can prepare to pass a CMMC compliance audit:

1. Learning the 17 Technical Requirements
Contractors have to learn and understand the 17 different technical requirements mentioned in the program, including access control, audit and accountability, media protection, risk management, security assessment, and system and information integrity.

2. Choosing Between In-House Compliance and Outsourcing
Contractors should decide whether they want to achieve compliance in-house, or whether they would like to outsource this process by subcontracting some of their IT infrastructures.

3. Carrying Out a Readiness Assessment and Gap Analysis
Conducting a readiness assessment and gap analysis is necessary for a company's growth. Useful information about data storage, incident response plans, IT staff and personnel training, and security protocol implementation could help them gain key insights about their industry, especially in this era of digitization.

4. Implementing Cybersecurity Monitoring
Contractors who work on high-value projects have to implement robust cybersecurity monitoring, which includes investing in a high-quality threat detection system.

5. Developing a System Security Plan
Developing a detailed system security plan is crucial. Contractors have to clearly outline their company policies, administration tasks, and employee security responsibilities in this plan.

Overall Goal
CMMC is complex, but achieving compliance with this cybersecurity framework could help organizations prevent data breaches and stop unauthorized access into their networks.

Companies must realize that compliance with this cybersecurity framework is for their own good. Not only can this help them remain solvent but will also protect critical information from getting into the wrong hands.

Nahla Davies is a software developer and tech writer. Before devoting her work full time to technical writing, she managed -- among other intriguing things -- to serve as a lead programmer at an Inc. 5,000 experiential branding organization whose clients include Samsung, Time ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-21270
PUBLISHED: 2020-12-03
Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).
CVE-2020-26248
PUBLISHED: 2020-12-03
In the PrestaShop module "productcomments" before version 4.2.1, an attacker can use a Blind SQL injection to retrieve data or stop the MySQL service. The problem is fixed in 4.2.1 of the module.
CVE-2020-29529
PUBLISHED: 2020-12-03
HashiCorp go-slug before 0.5.0 does not address attempts at directory traversal involving ../ and symlinks.
CVE-2020-29534
PUBLISHED: 2020-12-03
An issue was discovered in the Linux kernel before 5.9.3. io_uring takes a non-refcounted reference to the files_struct of the process that submitted a request, causing execve() to incorrectly optimize unshare_fd(), aka CID-0f2122045b94.
CVE-2020-17527
PUBLISHED: 2020-12-03
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this woul...