Yes! DoD published an FAQ on the Cybersecurity Maturity Model Certification. You can find it by visiting the DoD CIO’s website (https://dodcio.defense.gov/) and clicking on CMMC –> FAQ in the toolbar, or you can get to it directly by clicking here: CMMC FAQs.  DoD also publishes the DoD Procurement Toolbox and has published a CMMC FAQ there.

The government has published several resources that can help you with your Cybersecurity Maturity Model Certification journey.

Additional resources can be found on DoD’s CMMC Resources & Documentation page.

CMMC is a program created by the United States Department of Defense (“DoD”) to help ensure government contractors and others who receive information from the government will properly safeguard that information.

No. Under the Cybersecurity Maturity Model Certification, prime contractors are required to “flow down” the CMMC requirements to all contractors who store, process, or transmit non-public government information, except those providing commercial off the shelf (“COTS”) items.

The Cybersecurity Maturity Model Certification program involves the review of a contractor’s information security program against established requirements. The nature of the requirements vary depending on the sensitivity information the contractor handles.

After the attacks of September 11, 2001, the federal government sought to encourage the free flow of information to appropriate persons.  As part of this process, the government established four categories of information:

The federal government also recognized that:

1. implementing information security inherently limits the free flow of information;
2. there is an expense associated with implementing information security;
3. it is not in taxpayers’ interest to safeguard all information as though it was Classified Information; and
4. safeguarding all information as though it was Classified Information can be detrimental to national security.

The government therefore created different safeguarding requirements which must be in place in a non-federal information system before the corresponding type of information can be shared with a non-federal organization (e.g., a government contractor) while also not imposing unnecessary safeguarding requirements. This risk-based approach helps the government strike a balance between security and cost.

CMMC Level 1 represents DoD’s approach to ensuring that Federal Contract Information (“FCI”) is properly safeguarded consistent with the government-wide requirements. CMMC Level 2 represents DoD’s approach to ensuring Controlled Unclassified Information (“CUI”) is properly safeguarded consistent with the government-wide requirements. CMMC Level 3 represents DoD’s approach to ensuring that non-federal entities who handle highly sensitive CUI or large quantities of CUI are taking additional steps to safeguard that information consistent with the sensitivity of that information.

Cybersecurity Maturity Model Certification divides the safeguarding requirements into three “levels”. Level 1 is the most basic and applies to all government contractors. Level 2 applies only to government contractors who store, process, or transmit (i.e., “handle”) Controlled Unclassified Information (“CUI”). Level 3 applies only to prime contractors who aggregate large amounts of CUI or who handle especially sensitive CUI.

Federal Contract Information is critical to understanding Cybersecurity Maturity Model Certification compliance.  FCI is defined in the Federal Acquisition Regulations (“FAR”) 52.204-21(a) as “information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments.”

Put more simply, FCI is any non-public information that is created by or for the government.

Protecting Controlled Unclassified Information (CUI) is one of the core goals of the Cybersecurity Maturity Model Certification program. CUI is defined in 32 CFR 2002.4(h) as “information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. However, CUI does not include classified information…or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency.”

Understanding the Cybersecurity Maturity Model Certification means understanding different types of CUI.  One fundamental attribute that makes information CUI is if there is a law, regulation, or government-wide policy (“LRGWP“) that requires or permits the information to be safeguarded or makes it subject to limited dissemination controls.

In some cases, the LRGWP includes specific safeguarding requirements or limited dissemination controls. When that is true, the information is considered “CUI Specified“.

If the LRGWP does not include specific safeguarding requirements (i.e., the LRGWP just says that the information must be safeguarded, but it does not say how), the information is considered “CUI Basic“.

The CMMC Level 2 C3PAO assessment generally plays out over the course of a few weeks. However, it is important to note that it may take longer in some instances.

The process begins when you engage the C3PAO. They will ask you to provide some fundamental information about your organization and its information security program. The C3PAO will perform a basic validation of the information you provide to ensure that you are ready for the assessment. There may be a cost associated with this review.

Once the C3PAO believes you are ready for an assessment, they will ask you to sign an agreement with them and they will put you in line for the assessment. Some C3PAOs are asking for a deposit when your place in line is reserved. The deposit is applied toward the cost of the assessment.

Within about 2 weeks of your assessment date, you will be asked to provide final versions of your assessment documentation. This includes your System Security Plan (“SSP”) and all corresponding evidence. The C3PAO’s assessment team will review the evidence prior to your assessment so they are familiar with the way your organization operates.

The actual assessment typically takes a few days to a week. It is a fairly intense and tedious process where the assessment team asks you to walk them through how your organization meets every Assessment Objective in NIST SP 800-171A. If your organization handles physical CUI, including paper CUI, CUI stored or processed on local computer equipment, or CUI stored on removable media, a physical site assessment will also be necessary.

That physical site assessment is often conducted during the assessment week, but may occur at another time based on the availability of your team, the availability of the C3PAO’s assessment team, and travel conditions.

Once the assessment is complete, if you have successfully demonstrated that you meet all of the requirements, the C3PAO’s team will typically issue the certification within 1-2 weeks.

It depends on the maturity level of your organization’s information security program. If your organization is essentially starting from zero, the process can take 12-18 months. Organizations that have more mature information security programs find that it takes at least 3-6 months to implement a program this ready for a CMMC Level 2 assessment.

Using a consultant like Fathom Cyber can streamline the Level 2 assessment preparation process.

There are a variety of factors that impact the cost of a CMMC Level 2 certification assessment.

Assessment Team Composition – Chief among these is that, according to requirements imposed by DoD, the C3PAO must assign an assessment team of at least three (3) people as part of the assessment. This includes a Lead CMMC Certified Assessor (“Lead CCA”), another CCA, and someone to provide Quality Assurance. While the Lead CCA and CCA can work in parallel on some of the preparatory aspects of the assessment, the entire assessment team will likely need to participate in the assessment.

Assessor Qualifications – DoD requires the individuals performing the Lead CCA, CCA, and QA roles to be highly skilled and have made significant time and financial investments to obtain numerous industry certifications. As a result, their billing rates are between $200 and $400 per hour.

C3PAO Accreditation – DoD is also imposing additional requirements on C3PAOs, including that they obtain formal accreditation under the International Standards Organization (“ISO”). This process requires significant investments of both time and money on the part of the C3PAO.

Travel – If the assessment team must visit your organization to perform a site assessment, you expect travel-related costs to increase the assessment cost.

As a result of these and other factors, even a simple CMMC Level 2 certification assessment will likely cost between $50,000 and $100,000. Assessments of more complex environments will likely be $100,000+.

CMMC involves the assessment of an organization’s information security program against a set of requirements. In some cases, at least some of the organization’s assets (i.e., its people, business processes, equipment/technology, and locations) may not handle any government information and therefore are not (or at least may not be) subject to assessment under CMMC. The set of assets that are subject to the CMMC assessment are referred to as being “in scope” for the assessment. Assets that are not assessed are considered “out of scope” of the assessment.

Section 170.3 of the CMMC Program Rule defines four implementation phases for CMMC:

It depends on the CMMC Level that you are required to meet and the current CMMC implementation phase.

CMMC involves the assessment of an organization’s information security program against a set of requirements. In some cases, at least some of the organization’s assets (i.e., its people, business processes, equipment/technology, and locations) may not handle any government information and therefore are not (or at least may not be) subject to assessment under CMMC. The set of assets that are subject to the CMMC assessment are referred to as being “in scope” for the assessment. Assets that are not assessed are considered “out of scope” of the assessment.

At CMMC Level 1, the only assets that are in scope for assessment are those that store, process, or transmit Federal Contract Information (“FCI”). The CMMC Level 1 Scoping Guide has more details.

The CMMC Level 1 requirements are defined in FAR 52.204-21. They are listed below. HOWEVER, it is important to note that, when conducting a CMMC Level 1 self-assessment, you must assess your system not only against the 15 requirements below. You must justify determining that you meet a requirement by also determining that you meet each Assessment Objective associated with that requirement. These Assessment Objectives are defined in the CMMC Level 1 Assessment Guide (and were borrowed from the corresponding requirements in NIST SP 800-171A).

The FAR 52.204-21 requirements are:

(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

(iii) Verify and control/limit connections to and use of external information systems.

(iv) Control information posted or processed on publicly accessible information systems.

(v) Identify information system users, processes acting on behalf of users, or devices.

(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

(xii) Identify, report, and correct information and information system flaws in a timely manner.

(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.

(xiv) Update malicious code protection mechanisms when new releases are available.

(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

It depends on the CMMC Level that you are required to meet and the current CMMC implementation phase.

That is a difficult question to answer. Although self-assessments are acceptable at CMMC Level 1, at CMMC Level 2 during Phase 1, and in limited circumstances for CMMC Level 2 during Phases 2-4, there are advantages to having a third party conduct the assessment. For example, many prime contractors and other clients will feel more confident in the assessment results if they are conducted by a third party. In addition, using a third party to conduct the assessment can reduce the likelihood of False Claims Act or other claims being levied against your organization. Ultimately, this is a risk-based decision that your organization must make.

The CMMC Level 2 C3PAO assessment generally plays out over the course of a few weeks. However, it is important to note that it may take longer in some instances.

The process begins when you engage the C3PAO. They will ask you to provide some fundamental information about your organization and its information security program. The C3PAO will perform a basic validation of the information you provide to ensure that you are ready for the assessment. There may be a cost associated with this review.

Once the C3PAO believes you are ready for an assessment, they will ask you to sign an agreement with them and they will put you in line for the assessment. Some C3PAOs are asking for a deposit when your place in line is reserved. The deposit is applied toward the cost of the assessment.

Within about 2 weeks of your assessment date, you will be asked to provide final versions of your assessment documentation. This includes your System Security Plan (“SSP”) and all corresponding evidence. The C3PAO’s assessment team will review the evidence prior to your assessment so they are familiar with the way your organization operates.

The actual assessment typically takes a few days to a week. It is a fairly intense and tedious process where the assessment team asks you to walk them through how your organization meets every Assessment Objective in NIST SP 800-171A. If your organization handles physical CUI, including paper CUI, CUI stored or processed on local computer equipment, or CUI stored on removable media, a physical site assessment will also be necessary.

That physical site assessment is often conducted during the assessment week, but may occur at another time based on the availability of your team, the availability of the C3PAO’s assessment team, and travel conditions.

Once the assessment is complete, if you have successfully demonstrated that you meet all of the requirements, the C3PAO’s team will typically issue the certification within 1-2 weeks.

It depends on the maturity level of your organization’s information security program. If your organization is essentially starting from zero, the process can take 12-18 months. Organizations that have more mature information security programs find that it takes at least 3-6 months to implement a program this ready for a CMMC Level 2 assessment.

Using a consultant like Fathom Cyber can streamline the Level 2 assessment preparation process.

There are a variety of factors that impact the cost of a CMMC Level 2 certification assessment.

Assessment Team Composition – Chief among these is that, according to requirements imposed by DoD, the C3PAO must assign an assessment team of at least three (3) people as part of the assessment. This includes a Lead CMMC Certified Assessor (“Lead CCA”), another CCA, and someone to provide Quality Assurance. While the Lead CCA and CCA can work in parallel on some of the preparatory aspects of the assessment, the entire assessment team will likely need to participate in the assessment.

Assessor Qualifications – DoD requires the individuals performing the Lead CCA, CCA, and QA roles to be highly skilled and have made significant time and financial investments to obtain numerous industry certifications. As a result, their billing rates are between $200 and $400 per hour.

C3PAO Accreditation – DoD is also imposing additional requirements on C3PAOs, including that they obtain formal accreditation under the International Standards Organization (“ISO”). This process requires significant investments of both time and money on the part of the C3PAO.

Travel – If the assessment team must visit your organization to perform a site assessment, you expect travel-related costs to increase the assessment cost.

As a result of these and other factors, even a simple CMMC Level 2 certification assessment will likely cost between $50,000 and $100,000. Assessments of more complex environments will likely be $100,000+.

CMMC involves the assessment of an organization’s information security program against a set of requirements. In some cases, at least some of the organization’s assets (i.e., its people, business processes, equipment/technology, and locations) may not handle any government information and therefore are not (or at least may not be) subject to assessment under CMMC. The set of assets that are subject to the CMMC assessment are referred to as being “in scope” for the assessment. Assets that are not assessed are considered “out of scope” of the assessment.

At Cybersecurity Maturity Model Certification (CMMC) Level 2, DoD breaks the organization’s assets into five different categories:

The CMMC Level 2 Scoping Guide has additional information about scoping a CMMC Level 2 assessment.

It depends on the CMMC Level that you are required to meet and the current CMMC implementation phase.

That is a difficult question to answer. Although self-assessments are acceptable at CMMC Level 1, at CMMC Level 2 during Phase 1, and in limited circumstances for CMMC Level 2 during Phases 2-4, there are advantages to having a third party conduct the assessment. For example, many prime contractors and other clients will feel more confident in the assessment results if they are conducted by a third party. In addition, using a third party to conduct the assessment can reduce the likelihood of False Claims Act or other claims being levied against your organization. Ultimately, this is a risk-based decision that your organization must make.

It depends on the Cybersecurity Maturity Model Certification (CMMC) Level that you are required to meet and the current CMMC implementation phase.