Cyber Defense eMagazine May Edition for 2022

The evolution of CMMC
The CMMC is part of the DoD’s effort to secure its supply chain and protect its DIB contractors from
cybersecurity threats who have increasingly been the target of frequent and complex cyberattacks. The
program was designed to provide assurance to the DoD that DIB contractors could adequately protect
CUI, and the requirement includes any information that may flow down to subcontractors in a multi-tier
supply chain.
When the interim CMMC 1.0 rule went into effect, it was met with mixed reviews. Some applauded it,
while others felt it was far too stringent because of its assessment requirements for very small contractors
that manage CUI––and that continues to be a major barrier.
Initially, all DIB contractors were required to undergo an audit by a third party, referred to as C3PAO
(CMMC 3rd Party Assessor Organization). Now, under CMMC 2.0, only organizations that manage
Federal Contract Information (FCI), that they’ve classified as Level 1, may self-attest. All other DIB
contractors that handle CUI––Level 2 and 3––must pass an audit by a C3PAO. Self-attestation is not an
option for those businesses.
The problem with this requirement is that there simply aren’t enough auditors to meet the demand.
Backlogs of audit requests have grown, and will continue to, as there is no assessor ecosystem in place
today to accommodate requests. The DoD and the CMMC Accreditation Board (AB) are working to
correct the backlog, however.
What CMMC 2.0 means for small businesses
While the number of security tiers to be achieved was reduced from five to three tiers in the transition
from CMMC 1.0 to CMMC 2.0, it also put a heightened priority and urgency on contractors and
subcontractors to become certified to continue their work with the DoD. Though contractors who process
CUI will require C3PAO certification, at least 140,000 additional subcontractors who process only FCI
have the ability to perform self-assessments.
The ability to self-assess, however, can be a double-edged sword as it places the onus on those
companies to confirm that they are audit-ready and compliant. For smaller companies that typically don’t
have security or privacy experts on their teams, self-assessment will represent a significant undertaking,
and most don’t know where to start.
How small businesses can prepare
The first step is to determine the scope of the business’s CMMC auditable environment. It is imperative
to understand where FCI and CUI data is processed within the contractor’s environment, then to build a
security strategy around it.
For the Level 1 contractor, controls that are required to be compliant consist of 17 practices that fall under
six domains:
• Access Control
• Identification and Authentication
• Media Protection
Cyber Defense eMagazine – May 2022 Edition 100
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.