As a contractor within the Defense Industrial Base (DIB), understanding and preparing for a Cybersecurity Maturity Model Certification (CMMC) audit is essential for your organization’s success in securing Department of Defense (DoD) contracts. This comprehensive CMMC audit checklist will walk you through the CMMC certification process, helping you navigate the complexities of CMMC compliance and ensure your organization is well prepared for the CMMC audit process.
Understanding the Cybersecurity Maturity Model Certification
The CMMC assessment process evaluates an organization’s implementation of cybersecurity practices and processes.
The CMMC is a framework first released in 2020 by the DoD in response to increasing cybersecurity threats and the need to protect Controlled Unclassified Information (CUI). The framework aims to strengthen the cybersecurity posture of the entire defense supply chain, addressing the growing concerns of advanced persistent threats and other security risks.
Achieving and maintaining CMMC compliance is an ongoing process that requires dedication and resources from your entire organization.
It originally had five maturity levels, with levels 4 and 5 requiring more advanced and comprehensive practices. Since its introduction, it has undergone further development and updates which streamlined the model and reduced the number of maturity levels from five to three levels of compliance.
The revised version, CMMC 2.0 aims to make compliance more achievable for small and medium-sized businesses. It’s safe to say the CMMC is a work in progress and will continue to evolve and be refined based on feedback, emerging threats, and practical implementation experiences.
The DoD indicated that the program is inching toward full implementation with key regulations in place by the end of 2024. Full mandatory enforcement of CMMC requirements across all DoD contracts is expected to be phased in over several years. Nonetheless, companies contracting with the DoD or prime contractors would be wise to start preparing for CMMC compliance well in advance.
Requirements of the Three CMMC 2.0 Levels
The CMMC 2.0 levels consist of practices, standards, and processes specified by the DoD designed to protect sensitive government data and national security by defining how defense contractors and subcontractors handle CUI and Federal Contract Information (FCI). Compliance requirements become more stringent with Levels 2 and 3.
Level 1: Foundational
The main focus of Level 1 is basic cyber hygiene to ensure that subcontractors have implemented fundamental cybersecurity measures.
It includes 17 basic practices and security controls that generally relate to the protection of FCI. Some examples of practices include:
Access control – limiting who has access to information systems and what action they are permitted to perform
Identification and authentication – identifying and authenticating users, devices, and processes before allowing access to information systems
Media protection – properly handling, sanitizing, and disposing of physical and digital media to protect sensitive information,
A small company that only provides administrative services to the DoD might only need Level 1 certification to show they have basic cybersecurity practices like using passwords and keeping antivirus software up to date.
Level 2: Advanced
Level 2 is a transitional step for contractors handling CUI who must implement more stringent cybersecurity practices. There are 110 practices at this level, which include all practices from Level 1 plus additional ones that aim to establish a more robust security posture as outlined in the National Institute of Standards and Technology (NIST) Special Program 800-171. Some examples are:
Risk Assessment – regularly assess potential risks to your information systems and take steps to mitigate them.
Security awareness training – providing training and awareness programs to help personnel understand and implement security practices
Incident response – preparing for, detecting, and responding to cybersecurity incidents
A company that designs parts for military equipment might need Level 2 certification because they handle more sensitive information.
Level 3: Expert
Level 3 includes the most comprehensive and rigorous requirements of CMMC 2.0. It includes all practices from Levels 1 and 2 plus 58 additional requirements. A company requiring Level 3 compliance, which aligns with NIST 800-172, must demonstrate its mature cybersecurity program with continuous monitoring and improvement. Examples are:
Continuous monitoring – implementing systems and tools that monitor your network 24/7 for threats and unusual activity.
Advanced encryption – using strong encryption methods to protect sensitive data at rest and in transit.
Penetration testing – regularly performing tests to simulate cyberattacks on your systems to identify and fix vulnerabilities.
A defense contractor involved in building weapons systems would need Level 3 certification to protect highly sensitive federal government information.
The Implications of Failing a CMMC Audit
While CMMC requirements have not been completed and rolled out, companies working in the DIB should not wait to begin implementing the practices and processes that will ultimately be required. Failure to do so could result in negative consequences including:
Ineligibility for DoD Contracts
A company that is not CMMC compliant will not be eligible to bid on or receive DoD contracts that require certification. Additionally, if a company is already under contract with the DoD and fails to achieve or maintain the required CMMC level, they could lose their current contracts leading to significant financial losses.
Potential Legal and Financial Penalties
Failing to maintain CMMC compliance as stipulated in their contract, they could be found in breach of contract, leading to possible legal actions, including fines, penalties, and even lawsuits.
Reputational Damage
Failure to achieve or maintain CMMC compliance could lead to mistrust with the DoD and other potential clients and partners. And in the event of a cyber incident due to non-compliance, negative publicity would further damage a company’s standing in the industry.
Operational Disruptions
Needless to say, should a company be forced to pause production to achieve compliance, the sudden and unexpected operational disruption can have detrimental effects on the business.
Step-by-Step CMMC Audit Preparation Checklist
If your business is part of the DIB and your bottom line depends on government contracts, you’ll want to properly prepare for a CMMC audit. Failure to do so could result in the loss of federal contracts. The following is a handy compliance checklist to help you during the certification process.
Pre-audit Phase
The first step is to review the CMMC Model documentation provided by the CMMC Accreditation Body, Cyber-AB, which outlines the CMMC program. Other useful resources to familiarize yourself with and understand the specific security requirements are:
Determine the level of compliance you’ll need based on what type of information your company handles and the specific requirements of the contracts you want to pursue with the DoD. Will you only handle FCI (Level 1), or will you also have access to CUI (Levels 2 and 3)? Also, consider the complexity and scope of your work. If in doubt, consult with the DoD or a certified third-party assessor organization (C3PAO).
Conduct a gap analysis against NIST 800-171 controls. A qualified managed service provider (MSP) proficient in cybersecurity, compliance, and IT infrastructure management can assess your current cybersecurity controls, policies, and procedures against the requirements of the desired CMMC level you are pursuing. The MSP will be able to identify gaps in your existing cybersecurity framework and provide a clear and actionable plan to address them.
Develop a remediation plan to address identified gaps. Your plan should establish timelines and needed resources for remediation efforts.
Implementation Phase
Following your remediation plan, you’re now ready to start implementing any necessary changes to meet CMMC requirements. An MSP can help implement new technical controls such as access controls, encryption, continuous monitoring, and identification and multi-factor authentication. They can also guide you in developing administrative policies and controls that align with CMMC standards.
Conduct an internal audit to ensure you have the right tools, policies, and procedures in place to close all gaps. An MSP can assist in creating and maintaining the necessary documentation, technical configurations, and training records required, making it easier to demonstrate compliance during the official audit.
Audit Readiness Review
Engage a CMMC Registered Provider Organization to guide you through the assessment process. An RPO is an organization that has been trained and certified by Cyber-AB and possesses in-depth knowledge of the CMMC framework and its requirements across all levels. An RPO can help you address any remaining issues identified during the pre-assessment.
Prepare a System Security Plan (SSP). An SSP is a comprehensive document that describes how your organization’s information system is secured. It details the specific security controls, policies, procedures, and configurations in place to protect sensitive data.
Create a Plan of Action & Milestones (POA&M) document outlining the plan for addressing any deficiencies or gaps in your cybersecurity controls that have been identified. The POA&M is useful in tracking progress made toward remediation efforts.
Compile and organize all necessary documentation and evidence required for the audit. This will ensure everything is in order and readily available, reducing the likelihood of delays or complications during the office audit.
The CMMC Audit Process
The CMMC audit is a multi-step process to determine if an organization meets CMMC cybersecurity requirements. A successful CMMC assessment is crucial for obtaining your certification and maintaining eligibility for DoD contracts. The amount of time it takes to conduct an official audit depends on the size and complexity of the organization, the CMMC level being pursued, and how prepared the organization is. Some audits can be completed in six to eight weeks while others might take six months or longer.
The Role of a Certified Third-Party Assessment Organization
CMMC auditors, also known as certified CMMC assessors, play an important role in the certification process. These trained professionals evaluate your organization’s cybersecurity practices against the CMMC 2.0 requirements.
Cyber-AB is the official accreditation body of the CMMC ecosystem and the non-governmental organization responsible for accrediting CMMC third-party assessment organizations (C3PAOs). In short, Cyber-AB ensures that C3PAOs are qualified to conduct CMMC assessments in an impartial and consistent manner.
With so much at stake for companies bidding on DoD contracts, it’s imperative that C3PAOs conduct CMMC assessments without bias, providing a fair evaluation based strictly on the company’s adherence to CMMC requirements.
Documentation Review
C3PAOs conduct thorough reviews of all documentation, including policies, procedures, and controls, the SSP, PAO&M, your incident response plan, risk assessment reports, training reports, audit and monitoring logs, third-party agreements, and network diagrams and asset inventories. These documents collectively demonstrate that an organization exercises good cybersecurity practices, has effective controls, and is prepared to handle sensitive information in compliance with CMMC standards.
Technical Testing
Technical testing is performed during the CMMC audit process to ensure that cybersecurity controls are implemented correctly and working as intended. The type of technical testing performed will vary depending on the CMMC level being sought. Some examples are:
- Vulnerability scanning to identify weaknesses
- Penetration testing to gauge effectiveness in warding off attacks
- Configuration audits to ensure key systems are securely configured
- Access control to verify protection against unauthorized users
- Data encryption verification to ensure data is encrypted in transit and at rest
- Patch management verification to protect against known vulnerabilities
Observing and Verifying Processes
The C3PAO might conduct part of the assessment onsite to verify that the whole organization is adhering to processes, procedures, and controls. These onsite visits could include interviews with key personnel and inspection of physical and digital security measures to assess the effectiveness of these controls. The hands-on assessment ensures that an organization is actually doing what it says it is to protect sensitive data.
Final Certification
Assessment Report
Once the assessment is completed, the 3CPAO compiles the findings into a detailed report that includes an evaluation of the organization’s compliance with required CMMC practices and controls, as well as any shortcomings or other issues.
Remediation
If remediation is necessary to address non-compliance issues, such as updating policies or implementing additional controls, the organization is usually given an opportunity to correct them. For more significant non-compliance matters, a follow-up assessment might be needed to verify corrective measures were taken.
Report Submission
After remediation, the C3PAO prepares a final report that is then submitted to the CMMC Accreditation Body, Cyber-AB, along with the C3PAO’s recommendation for the organization’s certification level.
Certification Decision
The Cyber-AB reviews the C3PAO’s report and recommendation, and once satisfied that the assessment was conducted according to CMMC standards, it issues the appropriate CMMC certification.
Best Practices for CMMC Compliance and Audit Success
Obtaining CMMC certification is a lengthy and arduous process that doesn’t end once the certificate is in hand. It’s important to make your team aware of the CMMC auditor’s role and expectations. Understanding what CMMC auditors look for can help you better prepare for the triennial assessment.
Maintaining CMMC compliance is an ongoing process to ensure your company will be re-certified when the time comes. Conduct regular internal CMMC assessments to maintain ongoing compliance and readiness for official evaluations. Here are the top 10 best practices to aid you during the certification process.
- Understand the CMMC requirements and keep abreast of updates to the rules
- Conduct annual self-assessments, including a gap assessment and mock audits
- Develop and maintain airtight documentation
- Implement strong technical, physical and administrative controls
- Invest in continuous monitoring to detect real-time threats
- Provide ongoing cybersecurity training for all staff
- Consult with a Registered Provider Organization
- Create and maintain a comprehensive Incident Response Plan
- Invest an appropriate amount of time to prepare for the audit
- Develop a culture of cybersecurity awareness within your organization
By following these best practices, your organization can strengthen its cybersecurity posture, effectively prepare for the CMMC 2.0 audit, and increase the likelihood of achieving and maintaining certification.
Frequently Asked Questions
How long does it take for organizations to achieve CMMC compliance?
The time it takes to go through the CMMC certification process varies depending on several factors, including the size and complexity of your organization, the level you are pursuing, and your current cybersecurity posture.
- Self-assessment and gap analysis could take two to eight weeks.
- Remediation will take several weeks to months, depending on the gaps identified.
- The CMMC audit phase lasts one to four weeks.
- The C3PAO’s reporting takes two to four weeks.
- Review by Cyber-AB will take an additional one to two weeks.
The total timeframe for small to midsized businesses is typically three to six months, while larger organizations can expect the process to take six to 12 months or longer.
How much does CMMC cost?
The cost of going through the CMMC auditing process varies depending on several factors, including the size and complexity of your organization, the CMMC level you are pursuing, and the specific services you require through the process.
For example, there are self-assessments, gap analysis, remediation, RPO services, legal consulting, C3PAO certification, technology and tools, and ongoing maintenance costs.
Small organizations could spend $30,000 to $100,000 to achieve Levels 1 and 2. For midsized companies, costs could range from $100,000 to $250,000 or more if shooting for Level 3 compliance. Large organizations with highly complex environments might fork over $250,000 to millions.
What do CMMC auditors check?
During the official CMMC 2.0 audit, the C3PAOs check for a number of elements to ensure that an organization’s cybersecurity practices meet the requirements for the CMMC level being pursued. Typically, they check for:
- System Security Plan
- Plan of Action & Milestones
- Policies and Procedures
- Access Control Measures
- Incident Response Capabilities
- Monitoring and Logging
- Threat Vulnerability Management
- Data Protection and Encryption
- Physical Security Controls
- Employee Awareness Training
- Network Security Controls
- Third-party Risk Management
- Compliance with Specific CMMC Practices
- Continuous Improvement