Cybersecurity Maturity Model Certification Assessment

The Cybersecurity Maturity Model Certification (CMMC) program is an assessment framework and certification program that was created to standardize compliance set by the National Institute of Standards and Technology. It was designed to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) that is handled, stored and/or processed by Defense Industrial Base (DIB) contractors.This data could be anything from financial, legal, intelligence, infrastructure, export controls or other information.

If you’re a cyber security contractor looking to work with the Department of Defense, you’ll need a CMMC certification. The DoD will require all defense contractors to achieve certification by 2026 if they want to receive future contracts.

To be CMMC certified, your organization must be audited by a third party certification process. Plus, what’s required will depend on the level of certification needed.

There are five levels of CMMC certification. Again, the required level you’ll need to complete depends on your particular contract, but it’s good practice to achieve the highest level of certification that is feasible for your organization.

The following chart from National Defense Magazine estimates the annual CMMC costs for each maturity level. Remember, the prices below are rough estimates for the total cost of CMMC as the final guidelines for this process are still being developed.

The total annual assessment costs for each maturity level are as follows:

Level 1: $1,000
Level 2: $28,050
Level 3: $60,009
Level 4: $371,786
Level 5: $482,874

It’s also important to note that the cost of CMMC compliance is different from the cost of CMMC certification. Compliance is a separate cost that the DoD expects its supply chain to comply with.

Cybersecurity Maturity Model Certification can quickly become expensive and confusing. Arclight can help you keep costs down and achieve certification as quickly as possible. Book a CMMC meeting today.

As a defense contractor, to be CMMC compliant means you have achieved the standardized processes, practices and approaches set by the CMMC framework.

Assessing the gap between current practices and CMMC compliance is a crucial first step for contractors to understand how close they are to certification. CMMC assessment and remediation reviews current systems and processes that may not meet DoD guidelines. A third party or MSP will look at:

• How data is stored
• How is access to information controlled
• What incident response plans are in place
• How staff and other personnel are trained on cyber security
• How are security protocols implemented and maintained

Most importantly, a CMMC assessment and remediation helps contractors pinpoint risk areas, determine certification costs and prioritize tasks.

Below are the basic requirements for the five CMMC certification levels – and what kind of clearance each one gives to defense contractors.

CMMC level 1

CMMC level one requires basic cyber security hygiene protocols that are deployed by most companies. The purpose of this level is to safeguard federal contract information. To reach it, firms need to implement 17 NIST SP 800-171 Rev2 controls.

CMMC level 2

Level two calls for intermediate cyber hygiene practices: including universally accepted and documented best cybersecurity practices. Firms need to implement Level 1 requirements and 55 additional NIST SP 800-171 Rev2 controls to achieve this level. Reaching level two certification allows firms to transition from cybersecurity maturity progression to protecting controlled unclassified information.

CMMC level 3

Level 3 requires cyber hygiene practice. This level includes all NIST SP 800-171 Rev2 controls. This means that all controls from Level 1, Level 2 and 58 additional NIST controls need to be implemented to achieve Level 3 certification. Firms need to complete this level if they have contracts that involve protecting CUI.

CMMC level 4

Level for indicates proactive cyber security practices. Assessed in this level is the cyber security processes implemented in addition to how they are reviewed and updated across an enterprise. Companies need to implement practices and processes from Levels 1, 2 and 3, plus 26 additional controls (11 of which are from NIST SP 800-171 Rev B controls). CMMC certification for level four clears your firm to protect CUI and reduce the risk of advanced persistent threats.

CMMC level 5

The highest level encompasses advanced, optimized cybersecurity practices that include constant incident monitoring, reporting and improvement. Certification to Level 5 requires practices and processes from all levels in addition to 15 controls (four from NIST SP 800-171 Rev B controls).

To prepare for CMMC you’ll first need to assess the level of certification required for your organization. Next, you will have to determine how close your current practices come to the compliance framework. Preparing for CMMC certification can be challenging, time consuming and expensive. Hiring a third party or MSP can help you streamline your path to compliance while keeping unnecessary costs down.

Arclight Group supports CMMC readiness by offering comprehensive assessments and specific recommendations to achieve certification. We specialize in helping businesses prepare for CMMC certification and increase the chances of successful certification: set up a meeting.