As a Managed Security Service Provider (MSSP) that specialises in helping DoD contractors navigate the complexities of cybersecurity and compliance, we’ve been closely monitoring the evolution of the Cybersecurity Maturity Model Certification (CMMC) since its inception in 2020 and going back to 2016 when DFARS 7012 was just getting off the ground.

On November 4th, 2021, the DoD released CMMC 2.0 which includes several updates and changes to the original framework.

This short guide was written for DoD contractors so that they can understand what these changes mean for their organizations and take the appropriate actions for their company.

Summary of Key Updates: CMMC 1.0 vs. CMMC 2.0

• Only 3 CMMC Levels: CMMC Levels 2 and 4 from the original CMMC framework have been eliminated, leaving only 3 current CMMC Levels. These Levels are detailed below.
• Level 1: Now only requires an annual self-assessment and affirmation by company leadership. No changes to the 17 basic cyber hygiene practices required.
• Level 2: The “old” CMMC Level 3 now becomes Level 2. 20 controls have been eliminated from the original framework’s Level 3 requirements, leaving contractors only having to implement the 110 controls from NIST 800-171. The DoD will identify “prioritized acquisitions” that must undergo an independent third-party assessment against the new Level 2 requirements. All other organizations will only need to perform a self-assessment and affirmation by company leadership.
• Level 3: This level will replace CMMC Levels 4 and 5 from the original framework. While details are still being worked out, it is expected that this level will include controls from NIST SP 800-172 and assessments will be government-led.

Visualizing the New CMMC 2.0 Levels:

Source: https://www.acq.osd.mil/cmmc/about-us.html

CMMC 2.0 Changes Explained

Beyond the modification of the Levels, here are two key changes that DoD contractors need to be aware of.

Change One: Assessment Requirements

Level 1: Self-Assessments

One of the biggest complaints from DoD contractors was that CMMC 1.0 required them to undergo third-party certification, even at CMMC Level 1. CMMC 2.0 eliminates this requirement. Instead, contractors can perform their own self-assessments and will only be required to affirm annually that they comply with CMMC 2.0 Level 1.

Level 2: Third-Party Assessments & Self Assessments

CMMC Level 2 is divided into two separate assessment requirements. Only DoD Contractors working on “prioritized acquisitions” will need to undergo a third-party assessment every 3 years. All other contractors are permitted to perform a self-assessment and affirm annually that they comply with CMMC 2.0 Level 2.

The DOD has not yet announced how it will prioritize acquisitions.

Level 3: Government-Led Assessments

CMMC Level 3 applies to only the most sensitive and high-risk DoD projects. Therefore DoD contractors who fall into this category will need to undergo a government-led assessment every 3 years.

Change Two: Allows Plan of Action and Milestones (POA&M)

Another big criticism from DoD Contractors was that they were being required to meet every single practice and process for their required Level of certification. CMMC 2.0 allows for the DoD contractors to submit a Plan of Action and Milestones, also known as a POA&M, for those practices and processes not yet met.

Important: DFARS 7012, 7019 & 7020 Are Still Required

A very important fact is that DFARS 7012, 7019 and 7020 are still required for DOD contractors who handle controlled unclassified information, or CUI. To comply with these requires the implementation of NIST 800-171 which equates to CMMC Level 2 – Advanced.

Final Thoughts & Next Steps

The bottom line is that CMMC 2.0 significantly streamlines the requirements and eliminates many of the barriers to compliance, especially for smaller DoD contractors with less resources to dedicate to cybersecurity compliance.

We continue to strongly advise that companies do not sit on the sidelines and continue to explore their options for meeting their required Level of CMMC compliance. We heed this advice because of the following reasons:

• DFARS 7012, 7019 and 7020 are still required for DoD contractors Handling CUI.
• Early adopters of NIST 800-171 are likely to have a market advantage with their DoD customers and partners.
• DoD contractors should consider the risks to their organizations and balance sheets from ransomware and other types of breaches that NIST 800-171 can defend against.

We understand that many DoD contractors lack the resources in-house to complete their own self-assessments. That’s why many contractors choose to outsource the task to a provider like SysArc. We can take the burden of compliance off your team’s plate while at the same time protecting your IT infrastructure against cyber criminals.

If you have questions about implementing any of the cybersecurity controls in CMMC and about how SysArc can help, feel free to give us a call. We’ll be happy to speak with you and help you find a solution that works best for your business.

With the accelerating announcements of the CMMC rollout last year and the subsequent updates that the DoD has released, there has been an industry-wide push to get cybersecurity fully implemented as contractors prepare to become CMMC certified.

For contractors anxious to know how CMMC will affect the process of awarding contracts, one announcement worth paying attention to is the DoD’s recently released guidance for program managers in charge of choosing contractors.

DoD Instruction 5000.90, or “Cybersecurity for Acquisition Decision Authorities and Program Managers,” provides specific instructions for PMs’ responsibilities regarding cybersecurity and what they should expect from vendors. Here are several main takeaways that DoD contractors should take note of from this CMMC guidance for project managers.

The DoD Is Taking CMMC Security Seriously as a Factor in Awarding Contracts

Although many contractors have built up industry relationships, even trusted partners can no longer award contracts solely on reputation or goodwill; project managers (PMs) are instructed specifically to pay attention to cybersecurity when examining vendors for contract eligibility.

In fact, they are given responsibility for ensuring that cybersecurity requirements are considered and included, meaning that PMs can and will likely be held responsible if security isn’t found to be up to par—giving the PMs higher incentive to ensure all cybersecurity requirements are followed.

The DoD has made it clear that they won’t do business with organizations that are falling behind these new requirements. This is why you can’t just check off the boxes. Cybersecurity is now a foundational requirement that must be met before an organization becomes eligible for new contracts.

What Are Project Managers Looking For in Terms of Security When Awarding DoD Contracts?

CMMC’s requirements are many, and they include completing a 110-step self assessment and POA&M, reporting your score to the SPRS, fully implementing your POA&M, and establishing cybersecurity maturity by maintaining the necessary level of security before being awarded a contract.

Here are just a few of the points that project managers are instructed to pay attention to when judging whether a contractor has met the necessary cybersecurity requirements:

• Protections against known and anticipated threats, as well as potential future vulnerabilities
• Continuous cyber threat analysis
• All aspects of security programs include operational cybersecurity and supply chain resilience
• Periodic threat-representative adversarial assessments to assess the ability of the cyber technologies in the materiel solution to complete missions in a cyber-contested environment.
• Continuously enforced security through the risk management framework (RMF) and supply chain risk management (SCRM) systems

These indicators represent just a part of the extensive instruction and CMMC guidance given for project managers to account for during acquisition. To ensure you fully meet the expectations of the DoD, you’ll need to ensure you meet all CMMC requirements and show established maturity in implementing the required measures, including those given above.

CMMC Cybersecurity Categories and Related DFARS Resources

One section of the DOD Cyber Guidance report that may be especially relevant and useful for contractors is the table summarizing CMMC categories and their correlating instructions from DFARS resources.

In this chart, you can find a summary of essential rules with cybersecurity pillars on the left, and DoD instructional resources relating to each standard on the right:

No Time to Waste in CMMC Preparation

This instruction to DoD project managers reinforces the idea that you not only need to be CMMC certified, but you also need to prove you’re continually meeting the s

tandards, even after your POA&M is implemented. That comes through maturity—the longer you’re established as an accredited CMMC contractor, the more credibility you’ll gain.

That’s why it’s vital to implement your POA&M as soon as possible instead of waiting until the last possible moment, so that you have months or years of having a successfully run cybersecurity program under your belt to prove you will be an asset to work with based on not only your services, but also your security.

Prepare for CMMC Certification with SysArc

Since 2017, we’ve helped over 150 contractors tackle DFARS, CMMC, the Interim Rule, and other updates and requirements in the world of constantly evolving cybersecurity for government contractors. We’re more than ready to help you with your CMMC readiness assessment, remediation, and gaining the maturity needed to be competitive in the industry.

Last year brought major changes to the Department of Defense’s cybersecurity requirements for contractors. From the announcement of the CMMC-AB formation in January to the implementation of the Interim Rule in November, 2020 saw a host of announcements that led to rapid adjustments on the part of contractors to remain compliant and eligible for DoD contracts.

As the CMMC certification and auditing process is continually rolled out, contractors must remain flexible and ready to continue improving their security. But assuming that you’re up to date with the Interim Rule requirements, what comes next in your CMMC journey?

The big push for this year is a focus on maturity—the first “M” in the Cybersecurity Maturity Model Certification—as well as remediation. Taking the steps to self certify and create a POA&M are an essential start, but there’s still more to go before you’re ready for certification. Here’s a recap of what you should have completed over the past year and a look forward at what to focus on next for your CMMC implementation in 2021.

2020 in Review: CMMC Changes

The new CMMC framework was announced in January of last year, with several significant changes announced throughout the following months. Notably, the CMMC-AB was created to oversee the accreditation process, and the DFARS Interim Rule was announced and enacted.

Here are some of the main DFARS clauses and standards that give the big picture of last year’s transitions:

DFARS 7012

DFARS 7012 is the original rule requiring contractors to complete a self-assessment of NIST 800-171 to safeguard Covered Defense Information (CDI) and Controlled Unclassified Information (CUI). However, this rule was not widely effective due to limited enforcement. Last year’s Interim Rule built on this original standard to update the assessment process and the enforcement of the new requirements.

DFARS Interim Rule

DFARS 7019

This clause, introduced as part of the DFARS Interim Rule, stipulates that before a new award of a contract or subcontract that contains the DFARS 7012/7019 clause, a contractor must submit a NIST 800-171 Assessment score to the Supplier Performance Risk System (SPRS) using the latest DoD Assessment Methodology—the new scoring method building on the 110 security requirements specified in NIST SP 800-171.

DFARS 7020

DFARS 7020 outlines the ability of the DoD to request an ad hoc Medium- or High-level audit to verify the score submitted by the contractor to the SPRS. The contractor needs to provide an SSP and POA&M for the DoD to review and be able to show evidence of how they are satisfying the requirements.

DFARS 7021

This clause provides official notice and details around the rollout of CMMC. It requires contractors to maintain a current certification, not older than 3 years old, and commit to maintaining security throughout that period. It also requires contractors to include a CMMC clause in subcontracts and verify that subcontractors also hold the appropriate CMMC certifications.

Many organizations have gotten this far already and taken the steps of completing a self-assessment and creating a POA&M. But that’s still far from the “finish line” of being certified as cyber secure and CMMC compliant. So now, what’s next?

CMMC in 2021: Focus on Maturity and Remediation

This year is quickly becoming the year of remediation. Once you’ve identified the gaps in your security and reported your plan to fill them, you should be working on completing your POA&M by implementing cybersecurity protections, writing the necessary policies to enable and enforce security, and establishing maturity.

CMMC Maturity

A core aspect of CMMC maturity is having your security program in place for a length of time before you apply for certification. Maturity is gained the longer you have your comprehensive cybersecurity program successfully in place. The more time that has passed since you fully implemented your cybersecurity plan, the more credibility and maturity you’ll have as a secure provider.

Some involved in the rollout of CMMC have stated that it will likely take six to nine months to fully implement a POA&M and achieve full compliance; however, the project managers awarding contracts will want to see time spent with that plan in place and cybersecurity still being upheld, potentially stretching your total timeline closer to 9-12 months.

What that means for contractors is that there’s no time to waste; the sooner you can fully implement your POA&M, the more maturity you’ll have, and the better position you’ll be in.

Steps & Timeline for CMMC in 2021 Moving Forward

CMMC Readiness Assessment

This is the low-cost first step to comply with Interim Rule. You’ve likely already completed this step—but if not, now is the time to get it done. Deliverables include your accurate assessment score for SPRS, SSP/POA&M, and recommendations for remediation to implement your POA&M.

Remediation & Maturity in 2021

Use 2021 to complete your POA&M and gain maturity by having your cybersecurity program in place and running well before you’re audited. It’s important to get your program fully deployed as soon as possible to gain maturity. Your organization may even have been asked to give a date by which you’ll fully implement your POA&M and achieve a perfect score; but even in cases without specific deadlines, you should be acting with urgency to put protections in place.

CMMC Audits: Late 2021 Through 2025

CMMC audits will increase as the DoD rolls out new programs and contracts with CMMC requirements. You may be required to undergo an audit as your current contract comes up for recompete if it includes CMMC requirements.

CMMC Audit Preparation & Assessment Services

SysArc helps DoD contractors throughout the US navigate CMMC, from initial readiness assessments to ongoing cybersecurity guidance. We offer a full CMMC solution, customized to your needs, and work closely with our clients to help them understand CMMC to remain competitive in the industry.

We’ve also been awarded the status of a Registered Provider Organization (RPO) and C3PAO from the CMMC Accreditation Board, meaning we’re committed to having trained experts to assist with all aspects of the CMMC process.

For more information on how to prepare for CMMC, see our CMMC Complete Preparation Guide. If you need a consultant to walk you through the process, see our CMMC compliance services. If you’d like to speak with someone about preparing for a CMMC audit now, feel free to give us a call at (240) 453-4146 or schedule a CMMC consultation. There’s never a better day than today to start taking the next step toward security and maturity.

On September 29, the Defense Acquisitions Regulation System released a new Interim Rule to supplement current DFARS regulations.

While the Department of Defense is working to get the CMMC program completed in record time, the process is taking longer than anticipated, and CMMC is now slated to be rolled out over a five-year period. But over the past few years, the current method of self-assessment used in DFARS standards has proved insufficient as the DoD supply chain continues to be subjected to cyber attacks, leading to the necessity of more immediate improvements to security.

The purpose of this Interim Rule is to increase DoD contractor security in existing DFARS 7012 requirements while the process of CMMC implementation is still in development. It will ensure that DFARS requirements are being followed by creating a DoD Assessment Methodology and Cybersecurity Maturity Model Certification framework.

This rule enacts new requirements, such as a self-scoring methodology and reporting, as well as the announcement of increased audits at Basic, Medium, and High levels of scrutiny.

5 Key Takeaways to Be Aware of Now

Although there are many takeaways in the new interim rule, we identified the following five items that we think will affect many contractors right away:

1. This new requirement takes effect on December 1, 2020 for all contractors that are subject to the DFARS 252.204-7012 clause based on their handling of Controlled Unclassified Information (CUI)
2. Contractors that handle CUI will need to complete a new NIST 800-171 Self-Assessment based on a new scoring methodology and then post their score in the Supplier Performance Risk System (SPRS) before a contract will be awarded
3. The Self-Assessment must also include the completion of a System Security Plan (SSP) with a Plan of Action and Milestones (POAM) describing the current state of their network and their plan to achieve 100% compliance with the NIST 800-171 requirements
4. Prime Contractors must flow this requirement down to their subcontractors/suppliers that handle CUI as well.
5. DCMA will be conducting random audits to ensure companies have not only completed the self-assessment, but have scored themselves accurately, have an SSP and are working towards completing a realistic POAM.

New Interim Rule Self-Assessment Scoring and Reporting

DoD contractors who handle controlled unclassified information (CUI) are very familiar with the NIST SP 800-171 security requirements, which require contractors to self-assess their cybersecurity preparedness.

The NIST SP 800-171 DoD Assessment Scoring Methodology detailed in the Interim Rule will help contractors grade themselves with a standardized score that reflects the NIST SP 800-171 security requirements they do not yet have in place.

How NIST SP 800-171 DoD Assessment Methodology Scoring Works

In order to strategically assess a Contractor’s Implementation of NIST SP 800-171

• The NIST SP 800-171 DoD Assessment Methodology enables DoD to strategically assess a contractor’s implementation of NIST SP 800-171 on existing contracts which include DFARS clause 252.204-7012, and to provide DoD Components with visibility to the summary level scores of strategic assessments completed by DoD, thus providing an alternative to the contract-by-contract approach.
• The NIST SP 800-171 DoD Assessment consists of three levels of assessments (see Section 4 of this document). These three types of assessments reflect the depth of the assessment, and the associated level of confidence in the assessment results.
• Assessment of contractors with contracts containing DFARS clause 252.204-7012 is anticipated to be once every three years unless other factors, such as program criticality/risk or a security-relevant change, drive the need for a different assessment frequency.

SPRS Reporting

To submit your basic assessment to SPRS, you must fill out:

• Your system security plan name
• The CAGE code associated with the plan
• A brief description of the plan architecture
• The date the assessment was completed
• Your total score
• The date that a score of 110 will be achieved

Increased Audits

To ensure the legitimacy of reported results, increased, random audits will be conducted. These check-ups will evaluate companies’ compliance with NIST and the accuracy of their self-assessment score posted on SPRS.

Contractors will receive one of three assessment levels—Basic, Medium, or High—depending on the depth of the assessment and the level to which the contractor has implemented the security measures outlined.

What the Interim Rule Means for DoD Contractors

Get an Assessment Immediately

Even if you’ve had an assessment recently, you probably need to update that assessment to incorporate the new scoring methodology. And this needs to happen quickly, as starting December 1, this will be required for all contractors with a 252.204-7012 clause in their agreement.

In the long term, contractors handling CUI will need to achieve CMMC Level 3 compliance and fulfilling the requirements around  this Interim Rule will put you in a great position to be CMMC Level 3 ready.

DFARS 252.204-7012 Isn’t Going Away

DFARS 7012 was created three years ago in order to better protect the DoD supply chain. CMMC has become the new focus as companies prepare to meet the new standards, but the announcement of the Interim Rule emphasizes that CMMC is building on the foundation of DFARS 7012 and acting as the enforcement mechanism for the cybersecurity standards already in place.

Think of CMMC as a continuation of DFARS, and the Interim Rule as a procedure that helps bridge the gap between the two while CMMC is still being enacted.

Receive a Scored Assessment Now

SysArc has helped over 1,000 DoD contractors understand the requirements of DFARS 7012 and NIST SP 800-171 and take necessary steps toward compliance. We help DoD contractors properly protect the confidentiality of CUI in order to remain in compliance with regulations and eligible for DoD contracts.

We can help you navigate the requirements of the Interim Rule and other updates as CMMC is rolled out and worked into existing DFARS requirements.

Immediate action is required to get prepared for the December 1 deadline and remain eligible for contracts. Contact us today to receive a scored assessment and guidance through the process of complying with DFARS, the Interim Rule, and future developments in CMMC and DFARS.