The Cybersecurity Maturity Model Certification (CMMC) is a new framework with the objective of securing federal contract information (FCI) and controlled unclassified information (CUI) that is stored, processed, or transmitted by defense contractors and the entire defense industrial base (DIB). CMMC builds on the existing NIST SP 800-171 requirements and , in many cases, requires assessment by CMMC third-party assessor organizations (C3PAOs).
With the publication of CMMC 2.0 and changes from CMMC 1.0 (see article here for details on the changes), there are now 3 levels within the CMMC Model. The model, along with its supporting documentation like assessment guides and scoping guides, does an excellent job presenting the domains and practices in a variety of digestible ways. There are some details that should be paid specific attention to within the information provided in the CMMC Model, including the different levels and their particulars.
Level 1 is the minimum basic CMMC level, focused on protecting FCI. It includes 17 of the NIST SP 800-171 requirements with no additional practices. Level 1 is not expected to require assessment by C3PAOs, but instead will require self-assessment by DIB organizations.
Level 2 is focused on the protection of CUI. It is the equivalent to NIST SP 800-171 and includes the 110 requirements from NIST 800-171. Level 2 was previously Level 3 in CMMC 1.0 and included additional practices, which have been removed in CMMC 2.0.
Level 3 in CMMC 2.0 replaces Levels 4 and 5 in CMMC 1.0. Level 3 will build on the 110 requirements in Level 3 (and NIST 800-171) and include a subset of requirements from NIST SP 800-172.
It is expected that Level 3 assessments will represent a very small number of contract requirements and contractor certifications.
Whether it is an ISO 27001 certification, SOC 2 examination or a FedRAMP assessment, companies are often challenged by the need to address customer requirements while ensuring a return on compliance investment.
The most important factor in scoping a potential assessment is understanding what deliverable the recipient (i.e. your customer or partner) is expecting.
Once we have scoped your environment and needs, there are several factors that contribute to Schellman’s pricing: