Prepare Your Organization for CMMC

The Department of Defense (DoD) has been working to implement changes designed to increase the protection of controlled unclassified information (CUI) throughout the Defense Industrial Base (DIB) supply chain. Effective November 30, the interim Defense Federal Acquisition Regulation Supplement (DFARS) rule will officially implement the¬ Cybersecurity Maturity Model Certification (CMMC) requirement over the next five years.

* The DFARS interim rule also requires the DIB to submit evidence of compliance with DFARS clause 252.204-7012. DIB contractors with contracts having the DFARS requirement have long been required to implement the controls in National Institute of Standards and Technology Special Publication (NIST SP) 800-171, but now contractors must submit evidence of their self-assessments to the Supplier Performance Risk System (SPRS).

Whether you are preparing for your CMMC certification or are working to improve implementation of your SP 800-171 controls, organizations often face the same core challenges when addressing control deficiencies or making process improvements.

• Data Inventory and CUI: Having a complete data inventory, understanding where your CUI resides and scoping out your CMMC boundary
• The move from self-assessment to third-party assessment: “If it isn’t written it doesn’t exist.” documentation and process to prove control implementation
• Frequently underinvested domains: Asset Management and Configuration Management often overlooked as security areas and consequently underinvested in
• Governance: How to track requirements, implement plans of action and generate artifacts to ensure compliance

Hear from Darren Van Booven, Lead Principal Security Consultant at Trustwave and former CISO for the United States House of Representatives, as he addresses these common challenges and preparing your organization for CMMC verification requirements.

*The Cybersecurity Maturity Model Certification (CMMC) is a Department of Defense's (DoD) framework designed to ensure that cybersecurity controls and processes adequately protect Controlled Unclassified Information (CUI) that resides on Defense Industrial Base (DIB) systems and networks. Certifications will be issued at levels (ranging from 1-5), based on an organization’s ability to achieve cybersecurity for each domain and demonstrate processes and maturity at each level.