It is important for government contractors to reach CMMC compliance.

CMMC Compliance for DoD Contractors

Amidst the headlines, regular updates, and industry buzz, many across the Defense Industrial Base (DIB) have been left with more questions than answers on CMMC. At IsI, our expertise lies at the intersection of compliance, cybersecurity, and managed IT solutions, making us the go-to partner to guide Department of Defense (DoD) contractors through the complexities of CMMC and compliance requirements as a whole. With a seasoned team boasting hundreds of years of collective experience and four Registered Practitioners (RPs) on staff, we’re dedicated to ensuring adherence to the latest compliance standards. 

Government compliance around CMMC is coming in 2025.
The Big Picture: Plain and simple- DoD contractors must achieve CMMC compliance requirements to bid on new contracts (starting in 2025) and keep their existing ones (starting in 2028). However, this is not an isolated event; it builds upon existing frameworks such as the NIST 800-171, which contractors should already comply with. Beyond regulatory obligations, compliance is pivotal for fortifying cybersecurity defenses, mitigating risks of data breaches, and upholding the integrity of critical infrastructure. Achieving and sustaining compliance is a strategic imperative for ensuring the resilience and reliability of the DIB in an increasingly interconnected and digitized landscape.
There are three levels to CMMC.

What is CMMC?

Let’s get back to the basics. CMMC stands for Cybersecurity Maturity Model Certification. It is a program designed by the DoD to protect the Pentagon’s supply chain and standardize compliance across the DIB. CMMC expands upon an existing compliance framework called NIST 800-171 which has been in place since 2017. CMMC was initially announced in July 2019 with the primary goal of replacing the existing self-assessment model used by contractors with a standardized process. In November 2021, CMMC 2.0 was announced to streamline the original program and revise overall requirements. CMMC 2.0 is expected to become law in 2025.

Understanding CMMC Certification Levels

CMMC has three defined certification levels; Foundational (level 1), Advanced (Level 2), and Expert (level 3). Contractors can determine the CMMC level that they fit into based on the sensitivity of the data that they handle. Questions here? An IsI team member would be happy to help when you schedule your consultation!

 

The Three Levels of CMMC

Foundational (Level 1): Contractors dealing with just Federal Contract Information (FCI) will largely fall into level 1. This level requires the implementation of the 17 controls outlined in the Federal Acquisition Regulation (FAR) clause 52.

Advanced (Level 2): Contractors handling Controlled Unclassified Information (CUI) will fall into level 2. This level requires compliance with the 110 security controls outlined in NIST SP 800-171. These controls are broken into 14 control families and must be met to reach compliance. Friendly hint– Contractors should not proceed with a CMMC assessment until they comply with these controls achieving a Supplier Performance Risk System (SPRS) score of 110.

Expert (Level 3): The Expert level is designated for contractors handling CUI in the DoD’s highest priority programs. The assessment requirements for Level 3 are still under development at this time.

As a leading Registered Practitioner Organization (RPO), IsI excels in guiding companies to achieve compliance with CMMC Levels 1 and 2. Further, we are proud to have attained a Cyber AB Certification which speaks to our dedication to compliance excellence. Our proven track record and highly experienced team are here to help make your compliance journey a smooth one, so you can focus more of your time on growing your business. Partnering with IsI as your RPO offers numerous advantages including:

Streamlined Assessment Preparation

We’ll help you navigate the compliance process so you can save both time and money in the long run.

Vendor Management

We handle comprehensive vendor management, leveraging a meticulously vetted tool stack to meet compliance and cybersecurity requirements.

Cost-Effective Guidance

Our support will help ensure that you won’t need to pay for costly corrective actions following your CMMC assessment.

The Path to CMMC Compliance

DoD contractors will need to meet the compliance requirements of NIST 800-171 to prepare for their CMMC assessment. Preparation can be handled in-house if the necessary resources are available, however, contractors may consider partnering with an RPO to help guide them through this tedious process. At IsI, we break the preparation for CMMC assessment into five steps:

  1. Identify your CMMC level.

  2. Specify your CMMC assets

  3. Select a technical design.

  4. Ensure cloud compliance.

  5. Plan, record, and adopt.

Upon completion of these critical steps, contractors unlock the gateway to their CMMC assessment, however, the path ahead is not forecasted to be a quick one.

Team members discuss compliance journey.

With approximately 50 Certified Third-Party Assessor Organizations (C3PAOs) available in the market, and an overwhelming 100,000 DoD contractors awaiting assessment, the demand far exceeds the available resources. The linked infographic depicts what the compliance timeline looks like through 2025. With the impending enforcement of CMMC regulations in 2025, the urgency for DoD contractors to act has never been more pressing. Our team estimates that the preparation period leading up to the CMMC assessment could span a daunting 3-4 quarters. This timeline underscores the critical need for swift and decisive action.

What does the foreseeable future look like?
The public comment period for CMMC 2.0 came to a close on February 26, 2024. Here are the important upcoming dates:

  • Approximately November 2024: Comment Adjudication Ends (300 comments submitted)
  • December 2024 – CMMC is Published as a Final Rule, making CMMC 2.0 active. Assessments can begin in earnest by C3PAOs at this point.
  • Late Q1/Early Q2 2025 – The CMMC requirement will begin to appear in new DoD contracts and potentially in modifications to existing contracts.
  • 2028 – CMMC requirement appears in ALL applicable DoD contracts

As we continually refine this page with the latest insights on CMMC, your comprehensive compliance solution is just a consultation away. We’re proud to emphasize that IsI stands as an accredited RPO, certified by Cyber AB, ensuring the highest standards of expertise and service. Are you ready to navigate the evolving landscape of compliance requirements for your organization? Reach out to us today!