CMMC Readiness – Newark (NJ)

All DoD contractors and subcontractors, and adjacent industries (e.g., cloud service providers (CSP) and External Service Providers (ESP) like MSPs, MSSPs) handling FCI, CUI, or SPD.

• FCI. Federal Contract Information – Information not intended for public release that is provided by or generated for the Government. Excludes simple transactional information and information provided by the Government to the public.
• CUI. Controlled Unclassified Information – Unclassified information created or possessed by, for, or on behalf of Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls.
• SPD. Security Protection Data – Data stored or processed by Security Protection Assets (SPA) that are used to protect a contractor’s assessed environment.

The only exemption to CMMC requirements is if the company exclusively provides commercial off-the-shelf (COTS) products. For example, a subcontractor provides software licensing to a prime contractor who provides IT services to the Government.

Companies cannot receive a CMMC waiver; however, the Service Acquisition Executive (SAE) or Component Acquisition Executive (CAE) can approve waivers of the CMMC assessment requirements for specific RFPs. Expect these waivers to be exceptionally rare.

Identify the Type of Data You Handle – The required CMMC level depends on whether your organization processes Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) responsive to a DoD contract.

Review Your DoD Contracts & RFPs – Your contracts and request for proposals (RFP) may specify the required CMMC level. Pre-CMMC contracts may include requirements to implement the security requirements in NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, by including DFARS clause 252.204-7012, which indicates at least Level 2 requirements.

Review documents received – Do the documents you receive documents have CUI Markings in the Header or Footer? Do the documents received or produced fall into the National Archives CUI Registry Defense Organization Index Groupings. Contracts with DoD CUI will require at least a Level 2 Certification assessment performed by a C3PAO. Contracts with only non-DoD CUI will require Level 2 Self-Assessment.

Consult your prime contractor (if applicable) or DoD contact – check with the prime contractor or DoD contact on what CMMC level is required under the contract.

1. Identify Scope – Determine if you handle FCI and/or CUI, where it resides on your network, and who has access (including third-party providers such as MSPs and Cloud Service Providers).
2. Conduct a Gap Assessment – Compare your current security posture against your CMMC Level requirements.
3. Remediate Gaps – Implement missing controls, update policies, and implement the necessary technologies.
4. Assessment Preparation – Prep employees for the assessment and validate compliance with CMMC security requirements. Assemble documentation and validate the finality of all policies and procedures.
5. Engage a C3PAO (if required) – Interview and engage a C3PAO.

MSPs and MSSPs that support many DoD contractors may find it more economical to obtain a CMMC assessment as a way to reduce the time spent supporting multiple customer assessments.

CMMC Level 1 and Level 2 Self-Assessment requirements will appear in new solicitations on the “effective date.” The CMMC requires two Federal rules to be final and effective for the rule to take effect. They are referred to as the Title 32 Rule and the Title 48 Rule. The Title 32 Rule, which sets out requirements for the CMMC program, is final and effective. The Title 48 Rule, which instructs DoD to include CMMC requirements in its contracting process, is not yet final. 60 days after it is published, it too will become effective. That date will be the “effective date.” One year after the effective date, Level 2 Certification requirements will appear, as required, in new solicitations. Two years after the effective date, Level 3 Certification requirements will appear, as required, in new solicitations.

All DoD contractors and subcontractors, and adjacent industries (e.g., cloud service providers (CSP) and External Service Providers (ESP) like MSPs, MSSPs) handling FCI, CUI, or SPD.

• FCI. Federal Contract Information – Information not intended for public release that is provided by or generated for the Government. Excludes simple transactional information and information provided by the Government to the public.
• CUI. Controlled Unclassified Information – Unclassified information created or possessed by, for, or on behalf of Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls.
• SPD. Security Protection Data – Data stored or processed by Security Protection Assets (SPA) that are used to protect a contractor’s assessed environment.

The only exemption to CMMC requirements is if the company exclusively provides commercial off-the-shelf (COTS) products. For example, a subcontractor provides software licensing to a prime contractor who provides IT services to the Government.

Companies cannot receive a CMMC waiver; however, the Service Acquisition Executive (SAE) or Component Acquisition Executive (CAE) can approve waivers of the CMMC assessment requirements for specific RFPs. Expect these waivers to be exceptionally rare.

Identify the Type of Data You Handle – The required CMMC level depends on whether your organization processes Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) responsive to a DoD contract.

Review Your DoD Contracts & RFPs – Your contracts and request for proposals (RFP) may specify the required CMMC level. Pre-CMMC contracts may include requirements to implement the security requirements in NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, by including DFARS clause 252.204-7012, which indicates at least Level 2 requirements.

Review documents received – Do the documents you receive documents have CUI Markings in the Header or Footer? Do the documents received or produced fall into the National Archives CUI Registry Defense Organization Index Groupings. Contracts with DoD CUI will require at least a Level 2 Certification assessment performed by a C3PAO. Contracts with only non-DoD CUI will require Level 2 Self-Assessment.

Consult your prime contractor (if applicable) or DoD contact – check with the prime contractor or DoD contact on what CMMC level is required under the contract.

1. Identify Scope – Determine if you handle FCI and/or CUI, where it resides on your network, and who has access (including third-party providers such as MSPs and Cloud Service Providers).
2. Conduct a Gap Assessment – Compare your current security posture against your CMMC Level requirements.
3. Remediate Gaps – Implement missing controls, update policies, and implement the necessary technologies.
4. Assessment Preparation – Prep employees for the assessment and validate compliance with CMMC security requirements. Assemble documentation and validate the finality of all policies and procedures.
5. Engage a C3PAO (if required) – Interview and engage a C3PAO.

MSPs and MSSPs that support many DoD contractors may find it more economical to obtain a CMMC assessment as a way to reduce the time spent supporting multiple customer assessments.

CMMC Level 1 and Level 2 Self-Assessment requirements will appear in new solicitations on the “effective date.” The CMMC requires two Federal rules to be final and effective for the rule to take effect. They are referred to as the Title 32 Rule and the Title 48 Rule. The Title 32 Rule, which sets out requirements for the CMMC program, is final and effective. The Title 48 Rule, which instructs DoD to include CMMC requirements in its contracting process, is not yet final. 60 days after it is published, it too will become effective. That date will be the “effective date.” One year after the effective date, Level 2 Certification requirements will appear, as required, in new solicitations. Two years after the effective date, Level 3 Certification requirements will appear, as required, in new solicitations.