<img height="1" width="1" style="display:none" src="https://www.facebook.com/tr?id=1977396509252409&amp;ev=PageView&amp;noscript=1">
Contact a Specialist
Industry Solutions
Industry Solutions
Cloud Computing & Data Centers
Cloud Computing & Data Centers
Financial Services & Fintech
Financial Services & Fintech
Healthcare
Healthcare
Payment Card Processing
Payment Card Processing
US Government
US Government
Learning Center
Learning Center
Articles
Articles
Whitepapers
Whitepapers
Case Studies
Case Studies
Events & Live Webinars
Events & Live Webinars
On-Demand Webinars
On-Demand Webinars
Compliance Reliance
Compliance Reliance
About Us
About Us
Leadership Team
Leadership Team
Careers
Careers
Corporate Social Responsibility
Corporate Social Responsibility

CMMC Assessment

We are excited to be one for the first authorized C3PAOs and the first authorized firm of our type that performs SOC, ISO, FedRAMP, PCI, and HITRUST services to be authorized to perform CMMC assessments as many of our clients also participate as defense contractors and subcontractors that are subject to DFARS and the associated requirements.

Contact a Specialist Build Your Compliance Roadmap

CMMC Middle

What is CMMC?

The Cybersecurity Maturity Model Certification (CMMC) is a new framework with the objective of securing federal contract information (FCI) and controlled unclassified information (CUI) that is stored, processed, or transmitted by defense contractors and the entire defense industrial base (DIB). CMMC builds on the existing NIST SP 800-171 requirements and additionally requires assessment by certified third-party assessment organizations (C3PAOs).

CMMC Middle

The 5 Levels of CMMC

In general, the published CMMC v1.0 does an excellent job presenting the domains, capabilities, practices, and processes in a variety of digestible ways. There are some details that should be paid specific attention to within the information provided in the CMMC Model and its appendices, including the different levels and their particulars.

  • Level 1

  • Level 2

  • Level 3

  • Levels 4 and 5

Image

Level 1

Level 1 is the minimum basic CMMC level, focused on protected FCI. It includes 17 of the NIST SP 800-171 requirements with no additional practices or processes.

Image

Level 2

Level 2 is a steppingstone to meeting Level 3 requirements of protecting CUI. It includes 65 of the NIST SP 800-171 requirements with an additional seven practices and two processes.

Image

Level 3

Level 3 is the closest equivalent to NIST SP 800-171. CMMC Level 3 includes all the NIST SP 800-171 requirements with an additional 20 practices and three processes.

Level 3 certification may be a concern for many contractors. If so, determine whether or not there is an actual need to meet Level 3 requirements, as it’s possible that Level 3 will not be required for the contracts in contractors’ pipelines. Consider discussing such with contracting agencies, but do understand that they may not have an answer at this point in time.

Image

Levels 4 & 5

Levels 4 and 5 are focused on protection of CUI from Advanced Persistent Threats (APTs), and will represent a very small number of contract requirements and contractor certifications. Specifically, the DoD estimates that 130,000 contractors will have CMMC requirements during the phased roll-out. Of these 130,000 contractors, only approximately 80 will see requirements for Level 4 and an additional 80 for Level 5, which equates to approximately 1% of contractors at Levels 4 and 5 combined for the phased roll-out.

Case Studies

 

Your FedRAMP Specialist,
Marci Womack

Marci Womack is a Manager and leader in Schellman’s FedRAMP practice. Marci has eight years of information security experience across various industries – cloud services, government, and financial services.
  • Fixed-Fee Using an outcome-based, fixed-fee pricing model based on our extensive experience
  • Scope Creep We see less than 5% of our clients that see amendments and are often the result of a scope expansion
  • Low Overhead Low overhead means a flexible financial structure

How much will your audit cost?

Whether it is an ISO 27001 certification, SOC 2 examination or a FedRAMP assessment, companies are often challenged by the need to address customer requirements while ensuring a return on compliance investment.

The most important factor in scoping a potential assessment is understanding what deliverable the recipient (i.e. your customer or partner) is expecting.

Once we have scoped your environment and needs, there are several factors that contribute to Schellman’s pricing:

  • Fixed-Fee Using an outcome-based, fixed-fee pricing model based on our extensive experience
  • Scope Creep We see less than 5% of our clients that see amendments and are often the result of a scope expansion
  • Low Overhead Low overhead means a flexible financial structure

Featured Learning Center Content

 

Contact Us

Fill out this form to talk with one of our specialists. We'll be in touch soon to continue the conversation and help you find what you're looking for.

Contact Us

Fill out this form to talk with one of our specialists. We'll be in touch soon to continue the conversation and help you find what you're looking for.