Back to Cyber Security Services

Cybersecurity Maturity Model Certification (CMMC)

RubinBrown’s team of experienced professionals can help your organization by assessing readiness, supporting and preparing you for certification, and providing on-going CMMC management.

The CMMC framework consists of the security requirements from NIST SP 800-171 Rev 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, and a subset of the requirements from NIST SP 800-172 Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171. There are three levels within CMMC - Level 1, Level 2, and Level 3.

Level 1: Encompasses the basic safeguarding requirements for Federal Contract Information (FCI) specified in FAR Clause 52.204-21.
Level 2: Encompasses the security requirements for CUI specified in NIST SP 800-171 Rev 2 per DFARS Clause 252.204-7012.
Level 3: Information on Level 3 will be released at a later date and will contain a subset of the security requirements specified in NIST SP 800-172.

The first step in the process is to go through a CMMC Readiness Assessment to determine how your organization is meeting the requirements and what needs to be done before a certifier arrives to audit the environment. Following the readiness review, the organization can focus on remediation efforts, improving the environment, and making sure they are prepared for a certification audit. Prime contractors are already working through the process and are pressuring their subcontractors to take the necessary steps to meet or exceed requirements in preparation for the certification. Smaller subcontractors will be included in the process over the next 12 to 18-months. If your organization is in the supply chain for the DoD, it is time to prepare for CMMC.

RubinBrown’s team of experienced professionals can help your organization by:

Readiness Scoping
- Identifying and documenting the scope of the standards to your environment
- Augmenting your IT department with specialists who convert your knowledge of your environment into the requirements to meet the standards
Readiness Assessment
- Working with your team to assess your readiness over a 3 to 4-week period addressing approximately 110 controls and planning the remediation effort
Remediation
- Assisting with planning, tracking, and performing remediation, as needed, working directly with your team
Certification Preparation & Support
- Preparing your team for the C3PAO (Third-Party Certifier) audit of your environment and interfacing with the certifier if any clarifications are needed during their audit
Post-Certification Support & Consulting
- Reviewing internal and external changes to your environment along with consulting on updated DoD requirements
CMMC Managed Compliance Services
- Monitoring and managing the ongoing efforts to stay complaint with CMMC policy and implementation changes

The deliverables from the effort include:

Management Reporting
- IT Risk Assessment Report
- Gap Analysis and Recommendations for Technology, Human Capital and Policies
CMMC Remediation Roadmap
- NIST SP 800-171 & CMMC Remediation Roadmap, including the following Government Requirements and Certification Guidelines:
  - NIST 800-171 Reports (Existing Requirement)
  - NIST 800-171 System Security Plan (SSP)
  - NIST 800-171 Plan of Actions and Milestones (POA&M)
  - NIST Cybersecurity Framework (CSF) for Critical Infrastructure (As Required)
- Cross-Over Audit for Additional Frameworks
  - Reports will highlight controls that cross-over to additional frameworks beyond the DoD CMMC, NIST 800-171, NIST CSF including ISO, PCI-DSS among others

Drawing from our experience developing SSPs and POA&Ms, assisting our clients with compliance remediation plans, and years of experience in the industry, we help our clients through the preparation phase, so they are ready when it is time for the formal certification audit.

Contact Us