Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


02:00 PM
Nahla Davies
Nahla Davies
Connect Directly
E-Mail vvv

The Cybersecurity Maturity Model Certification: Are You in Compliance?

Not only can this framework help companies remain solvent, but it will also protect critical information from getting into the wrong hands.

Let's face it: Cybersecurity threat risk isn't going anywhere, and it's only going to get worse. This realization caused the Department of Defense (DoD) to create the Cybersecurity Maturity Model Certification (CMMC) early this year. This is a unified standard for the successful implementation of cybersecurity across the more than 300,000 companies in the supply chain.

Related Content:

Solving the Problem With Security Standards

State of Endpoint Security: How Enterprises Are Managing Endpoint Security Threats

New on The Edge: Securing Slack: 5 Tips for Safer Messaging, Collaboration

The CMMC takes into account how most businesses can't keep up with the influx of vulnerabilities affecting their infrastructure and software. It's the DoD's answer to widespread compromises of critical defense information that is usually stored on the information systems of the contractors.

Why Is CMMC Compliance So Crucial? 
There has been a steady increase in the number of data breaches and other cybercrimes in the past few years. Keeping this in mind, companies have started implementing artificial intelligence and machine learning in cybersecurity to curb cybercriminal activities — such solutions are still a work in progress.

Companies need to work on boosting their security from the prying eyes of hackers to protect their online identities and simultaneously block malware that could potentially harm their network.

Back in 2015, the DoD published the Defense Acquisition Federal Regulation Supplement (DFRS). As a result, contractors needed to ensure compliance with the NIST SP 800-171 cybersecurity framework.

Understanding and implementing DFARS's requirements has been a constant struggle for contractors. While a few firms had the resources to make themselves compliant, others were subcontracting their cybersecurity responsibilities to managed service providers.

Although the DoD took steps to make the adoption of DFARS easier, many companies were still lagging behind with the implementation of the earlier framework. Some companies even falsely said they were in compliance through deliberate deception or claiming ignorance. Hence, CMMC was introduced to solve this issue.

These standards make sure that the appropriate levels of cybersecurity controls and processes are in place, which, in turn, will protect controlled unclassified information (CUI) on the DoD's contractor systems.

CUI is the information that needs safeguarding or dissemination controls agreeable to and consistent with applicable laws and policies under the Atomic Energy Act. In other words, it's the data that must be strictly protected within an information system. This includes many types of data, such as health documents, legal material, technical drawings and blueprints, and intellectual property.

The Four Levels of CMMC Compliance That Venders Should Know About
CMMC compliance has five defined levels that include different areas ranging from basic hygiene to advanced security. Additionally, each one of these levels has its own set of practices and processes. Vendors have to meet the practices and processes of each of these levels, which ends up creating an "all or nothing" approach.

Level 1:
Every company must perform "basic cyber-hygiene" practices. This includes ensuring that companies change passwords regularly to protect federal contract information and using antivirus software for keeping their network secure and safe from threats.

This level excludes public information or specific transactional information.

Level 2:
Companies should document "intermediate cyber hygiene" practices to enhance their efforts to protect any CUI, and they must implement some of the NIST 800-171 r2 security requirements.

National Archives describes CUI as "any information that law, regulation, or government-wide policy requires to have safeguarding or disseminating controls.” However, it doesn't include certain classified information.

Level 3:
In order to successfully implement "good cyber-hygiene" practices to safeguard CUI, companies must have an institutionalized management plan. This plan includes all the NIST 800-171 r2 security requirements, along with other additional standards.

Level 4:
Company owners should take the necessary steps to implement processes for measuring and reviewing the effectiveness of practices.

In addition, already established, enhanced practices should also be put in place to detect and respond to changing tactics, techniques, and procedures of advanced persistent threats (APTs).

What Can Suppliers Do to Ensure They Are in Compliance With the CMMC?
The following are the five steps through which DoD contractors can prepare to pass a CMMC compliance audit:

1. Learning the 17 Technical Requirements
Contractors have to learn and understand the 17 different technical requirements mentioned in the program, including access control, audit and accountability, media protection, risk management, security assessment, and system and information integrity.

2. Choosing Between In-House Compliance and Outsourcing
Contractors should decide whether they want to achieve compliance in-house, or whether they would like to outsource this process by subcontracting some of their IT infrastructures.

3. Carrying Out a Readiness Assessment and Gap Analysis
Conducting a readiness assessment and gap analysis is necessary for a company's growth. Useful information about data storage, incident response plans, IT staff and personnel training, and security protocol implementation could help them gain key insights about their industry, especially in this era of digitization.

4. Implementing Cybersecurity Monitoring
Contractors who work on high-value projects have to implement robust cybersecurity monitoring, which includes investing in a high-quality threat detection system.

5. Developing a System Security Plan
Developing a detailed system security plan is crucial. Contractors have to clearly outline their company policies, administration tasks, and employee security responsibilities in this plan.

Overall Goal
CMMC is complex, but achieving compliance with this cybersecurity framework could help organizations prevent data breaches and stop unauthorized access into their networks.

Companies must realize that compliance with this cybersecurity framework is for their own good. Not only can this help them remain solvent but will also protect critical information from getting into the wrong hands.

Nahla Davies is a software developer and tech writer. Before devoting her work full time to technical writing, she managed -- among other intriguing things -- to serve as a lead programmer at an Inc. 5,000 experiential branding organization whose clients include Samsung, Time ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Author
12/16/2020 | 4:22:33 PM
Making it sustainable
Thank you, Nahla. One thing I would add, from a sustainability perspective, is to ensure the processes are continually monitored for compliance. This will serve to reduce the audit overhead while integrating into key value stream processes for delivery.
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: George has not accepted that the technology age has come to an end.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-03-07
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened r...
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length...
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system...
PUBLISHED: 2021-03-07
An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings/settings.xml file containing admin panel credentials), as demonstrated by dav/server.php/files/personal/%2e%2e when using the caldav_public_...