CMMC Compliance: No Apologies, Just Action

So, the CMMC rule is here. What now?

No Apologies Necessary

First things first: no need to apologize for the challenges you're facing. Running a business in the Defense Industrial Base (DIB) is tough, especially in recent years. If your business has been around for five years or more, you've survived…

• A global pandemic
• Remote work disruptions
• Supply chain bottlenecks
• The Great Resignation
• Inflation surges
• Government shutdowns

You're still standing, which proves you can get through hard times! The DIB is the backbone of our country's defense, and your team's expertise helps keep it strong. Don't apologize for spending limited resources on keeping your business afloat in turbulent times.

Evaluate What You've Already Done

Before you take on new tasks, take stock of what's already in place; you're likely closer to compliance than you think. Document everything, including:

1. Your Continuity of Operations Plan (COOP) or Business Disaster Recovery Plan (DRP). These plans overlap with CMMC requirements and help keep your business running during disruptions.
2. Your policies & procedures. You've likely developed solid security habits. Make sure the policies and procedures behind them are written down and signed by the responsible party in your company. If you haven't mapped them to the CMMC controls yet, take a little time to do it.
3. Your Employee Roles List (ERL). Responsibilities should be clear, and every core business system and process should have an owner.
4. Your existing IT infrastructure. Many businesses already run Virtual Private Networks (VPNs), firewalls, and encryption tools that can be adapted to meet CMMC controls. If you already use a cloud system, you may be farther along than you expect, especially if your chosen cloud is FedRAMP authorized or your vendor has a FedRAMP authorized cloud you can migrate to.
5. Access control systems. If your company uses role-based access control (RBAC), you're already on the path toward securing CUI by controlling who accesses sensitive data.
6. Your Incident Response Plan (IRP) or Business Continuity Plan (BCP). If you have either one, you're halfway there, and it can be refined to meet the specific CMMC requirements.
7. Security awareness training. If you've been training your employees in cybersecurity, you can expand that training to cover CMMC-specific content, such as insider threat detection and handling Controlled Unclassified Information (CUI).
8. Antivirus and anti-malware tools. Already using them? Great! They meet one of the basic CMMC requirements for threat detection.
9. User authentication. Tools you already have, like Multi-Factor Authentication (MFA) or login monitoring, can be expanded to cover all systems, which satisfies a core CMMC requirement.
10. Backups and disaster recovery. If you run regular data backups, document them as part of your compliance strategy. (Make certain your data backup solution is in your DRP.)
11. Physical security. Badge access to offices, locked server rooms, and CCTV monitoring may already meet CMMC physical security requirements for sensitive areas. (Note: pay special attention to the vendor of your CCTV/IP cameras per NDAA Section 889.)
12. Vendor and subcontractor management. If you're already vetting third-party vendors, build on that work to meet CMMC's requirements for external service providers that handle CUI.
13. IT service management (ITSM) tools. If you use a ticketing system anywhere in your business to log and track incidents, you have the basic tool you need for CMMC's incident response. If you have more advanced tools for remote monitoring and management (RMM) or endpoint management, you may only need a configuration change management and testing process to meet CMMC's configuration management requirements.
14. Audit logs. Logging systems that already track user activity, access events, or changes can be used to meet CMMC's requirements for auditing and accountability.
15. Existing security certifications. If you have a certification like ISO 27001 or have gone through a NIST SP 800-171r2 or NIST CSF self-assessment, much of the groundwork for CMMC compliance is already in place.
16. Insider threat programs. A program that monitors insider threats for NISPOM or similar regulations can be expanded to meet CMMC insider threat requirements.
17. Data labeling. If your organization has a basic system for labeling sensitive data, it can be adjusted to meet CMMC's guidelines for CUI and FCI protection.

Assemble the Right Team

You can't do everything alone, and that's okay. Successful CMMC compliance depends on having the right people in place. This is the team structure we recommend:

CMMC Lead (by Size)

This person is usually a senior leader or project manager responsible for the entire CMMC project. The CMMC Lead keeps milestones on track, coordinates work across departments, and reports to executives.

Responsibilities:

• Own the CMMC certification process.
• Track project metrics and communicate with the executive team.
• Act as the central point of contact for CMMC auditors.

IT & Security Subject Matter Experts (SMEs)

These professionals, whether internal or external, review your systems and processes to check that they meet CMMC technical controls.

Responsibilities:

• Assess your IT infrastructure for CMMC compliance.
• Identify and fix gaps in technical controls like NIST 800-171.
• Collaborate with the CMMC Lead to implement solutions.

External CMMC Consultants

These experts specialize in CMMC frameworks and can guide you through the assessment process.

Responsibilities:

• Offer advice on CMMC strategies and create necessary documentation like System Security Plans (SSP).
• Conduct mock assessments and readiness reviews.
• Guide remediation efforts.

Legal Advisors

These are legal professionals who understand both regulatory and contractual obligations. They make sure your compliance efforts meet regulations like CMMC, ITAR, EAR, and DFARS.

Responsibilities:

• Translate regulatory language into actionable practices.
• Make sure contracts reflect CMMC compliance.
• Provide risk management and liability mitigation advice.

Managed IT & Security Services

These third-party providers handle ongoing IT infrastructure, security monitoring, and incident response.

Responsibilities:

• Provide continuous monitoring and compliance assessments.
• Implement security technologies such as SIEM and firewalls.
• Support incident detection and response efforts.

Ignore the Noise, Focus on the Basics

With the new CMMC rule in place, it's easy to get caught up in the flood of information and panic-driven posts. You don't need to read every regulation or standard. Focus on what matters to your business. These core steps move you toward CMMC compliance and improve your operations along the way:

1. Evaluate what you've already done. We said it before, and we'll say it again: you've kept a DIB business running in difficult times. Review the information above, and document what you already do to keep your business running.
2. Assemble the right Team. See the recommended team roles and responsibilities above. Make sure you have some team members who have experience with your company's goals, contracts, business systems, processes, and procedures, and you have some team members who have experience working in and for companies that have addressed CMMC challenges like yours.
3. Assess your gaps and start a plan. Work with your Team to map what you already do to CMMC requirements. Make a list of what's missing or needs more investigation. This list is the start of your plan. You don't have to have every solution mapped out right away. Your plan is a living document. At first the number of unfinished tasks in your plan will grow, but you have a Team working through it with you and moving you toward CMMC compliance.
4. Address quick wins. Some actions pay off quickly. If you haven't already, consider these "quick wins":
   • Move business systems that need to handle CUI to the correct FedRAMP authorized cloud. (The "correct" cloud is both FedRAMP authorized and meets the minimum requirements to handle CUI. Also consider other data your business handles that needs special integrity and security protection, such as data covered by the International Traffic in Arms Regulations, or ITAR.)
   • Secure access to your business systems with Multi-Factor Authentication (MFA).
   • Implement a Security Information and Event Management (SIEM) solution to monitor systems and respond to potential threats in real time.
   • Run background checks on your team and subcontractors to meet the CMMC requirements for personnel security and insider threat prevention.
   • Train employees regularly on cybersecurity and insider threats, and keep the records.

Each of these steps counts toward compliance, and each one also lowers your risk and helps keep you competitive.

Conclusion

Use the CMMC mandate as a chance to strengthen your business. Stick to the basics, focus on progress, and draw on the expertise around you. No apologies, just action.