The Cybersecurity Maturity Model Certification (CMMC) process can be confusing and challenging for organizations that need to comply with this standard. CMMC is the evolution of the Department of Defense’s (DoD) attempt to protect valuable information shared with organizations in the Defense Industrial Base (DIB) while performing work on projects for them. There are many controls and objectives in the standard and as such understanding how you are setup to meet those controls is crucial to prepare for your CMMC audit. The results of this audit will determine if you are eligible to receive contracts from the DoD to perform work. If you fail the audit, no new contracts will be awarded to your organization. This is why to start the process, you must undertake a Gap Assessment project which will match up your current state to the desired future state for these controls and objectives.
The Gap Assessment Process
A gap assessment can be conducted internally if you have the resources familiar enough with the CMMC standards to ensure that the results set you up for success. However, many organizations do not have this expertise in house and will turn to an outside firm to perform the assessment. This may even be a good idea for organizations who believe they have the proper understanding as outside organizations can be objective in their analysis. Reputable firms will be trained and certified to do this by the CyberAB, the governing body for CMMC, as Registered Practitioners.
To begin the process, you must go through an interview of sorts that will ask a series of about 300 questions matched up to the 110 controls. There are more questions than controls because you must make sure that you are meeting all the objectives of each control. This process usually takes 4-6 hours in 1 hour sessions grouping the controls properly to interview the appropriate people in your organization.
Once the interview is complete, most outside organizations will then perform an onsite or remote verification of the answers you provided. It is crucial to understand exactly how you have implemented each of the controls to ensure that it meets the standard. Evidence should be gathered at this step to attach to the Gap Assessment in preparation for your audit.
Combining the interview information and the verification evidence, the Registered Practitioner will complete the Gap Analysis. This will show where you meet, partially meet, and do not meet controls and objectives. In areas where you have not fully met the control, remediation recommendations will be provided for how you could reasonably meet those controls and objectives. These recommendations will then be prioritized for you ensuring that actions which are critical or that will take more time are completed first.
This process usually takes 60-90 days depending on scheduling and availability of resources. Once this is complete, you must then undertake the remediation efforts so getting started to figure out where you are is crucial.
If you are looking for assistance with your CMMC Gap Assessment, feel free to reach out and one of our Registered Practitioners can help.
CMMC Compliance Support for Fairfield County Contractors
Kyber Security is a CyberAB-certified Registered Practitioner Organization based in Trumbull, CT, helping defense contractors and subcontractors throughout Bridgeport, Stamford, Norwalk, and the rest of Fairfield County prepare for CMMC assessment. See our CMMC Compliance Services for the full breakdown.