To show compliance with NIST 800-171 and prepare for CMMC, contractors develop and maintain formal documents for submission to DoD prime contractors or subcontractors upon contract initiation or renewal.
These documents include a System Security Plan (SSP) and Plan of Action with Milestones (POA&M).
You can meet compliance with NIST 800-171 using any of the following methods:
The Cybersecurity Maturity Model Certification (CMMC) is a unified cybersecurity standard created to increase the security posture of companies operating in government supply chains. Version 1.0 was released in January 2020 and the creation of CMMC 2.0 was announced in November 2021.
When CMMC 2.0 was announced, the original CMMC document and its appendices were removed from the government website (Acquisition & Sustainment, Office of the Under Secretary of Defense).
The CMMC 2.0 document will not be available until the CMMC 2.0 rulemaking process is complete, which is expected to take 9-24 months from the time Version 2.0 was announced, sometime between August 2022 and November 2023.
The Department of Defense has been in the process of gradually migrating from NIST 800-171 to the CMMC framework since January 31, 2020 when Version 1.0 of CMMC was published.
By October 1, 2025, all new DoD contracts will include CMMC requirements instead of NIST 800-171.
CMMC has evolved from FAR clause 52.204-21.
The CMMC framework contains 3 maturity levels.
Although there were 5 levels in Version 1.0 of CMMC, that has changed to 3 levels with the announcement of CMMC 2.0.
from Acquisition & Sustainment, Office of the Under Secretary of Defense, https://www.acq.osd.mil/cmmc/model.html
DoD contracts will stipulate to which level (1, 2, or 3) a supplier must meet.
A subcontractor working for a prime or another subcontractor may not necessarily need to meet the same level as the contractor for which they are working. For example, to win a contract, a contractor may need to be at Level 2, but a supplier to that contractor may only need to be at Level 1.
The method to become certified varies based on the level of CMMC you need to meet. The big distinction is whether you are protecting Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).
FCI is information not intended for public release that the US government provides under a contract to develop or deliver a product or service to the government, but not publicly available information, such as on websites.
CUI is information the US government creates or possesses that a law, regulation, or government-side policy requires or permits an agency to handle using safeguarding or dissemination controls.
CUI is defined as information created by the government, or an entity on behalf of the government, that is unclassified, but needs safeguarding. CUI is information that is sensitive and relevant to the interests of the US and potentially its national security, but not strictly regulated by the federal government. This is information that resides on your company’s internal systems.
If you are a prime contractor (or a subcontractor), you may be logging into a portal and downloading information (such as a mechanical drawing) that is then stored on your internal systems. You may also see CUI referred to as “Covered Defense Information” — not to be confused with “Controlled Technical Information.”
CUI is Unclassified Information that is stored on “Covered Contractor Information Systems,” which indicates an unclassified information system that is owned (or operated by or for) a contractor and that processes, stores, or transmits covered defense information.
Refer to “covered contractor information system” as that term is defined in DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting, paragraph (a) and DFARS 252.204‑7012(b)(2)(ii)(B).
NIST 800-171 and CMMC provide a set of guidelines that outline the processes and procedures that companies need to implement in order to achieve compliance in regard to controls around CUI. In working with several DoD contractors, Corserva has also seen this information referred to as Covered Defense Information (CDI), formerly described as “unclassified Information which is collected, developed, received, transmitted, used, or stored by or on behalf of the contractor.”
Examples of CUI include email, electronic files, blueprints, drawings, proprietary company or contractor information (such as sales orders and contracts), and physical records (such as printouts). It is important to understand that CUI security requirements are not restricted to digital files; CUI can include paper copies, which are specifically referred to as “printed from an information system which processes or stores electronic files transmitted or stored on servers, desktops, laptops, mobile devices, etc.”
Let’s say that during fulfillment of a federal contract, you receive an email with attached files from the agency with which you are doing business. That information (which is CUI) now resides on your company’s email system (potentially on that workstation’s hard drive) and must be protected. Likewise, if you develop proprietary information for the DoD or for a prime contractor, that information must be protected. If you receive printouts through the mail or by courier service, that information must be protected.
When evaluating compliance with CMMC (or NIST 800-171), typical systems to include are end user workstations and laptops, servers, storage devices, and network devices such as routers, firewalls, switches, wireless access points (WAP), and printers. Physical security may also need to be addressed.
CMMC levels are based on the security criticality of the information you receive when performing under a contract. Level 2 compliance is harder to meet than Level 1 compliance, and Level 3 compliance is harder to meet than Level 2.
from Acquisition & Sustainment, Office of the Under Secretary of Defense, https://www.acq.osd.mil/cmmc/about-us.html
Level 1 compliance of CMMC requires an annual self-assessment.
To meet CMMC Level 1, you comply with 17 cybersecurity best practices.
Level 1 companies are protecting FCI, not CUI, and can self-certify. Many small businesses in the Defense Industrial Base (DIB) will only need to meet Level 1 of CMMC.
To meet CMMC Level 1, you upload your assessment into the DoD Supplier Performance Risk System (SPRS) annually. Only senior company officials (CEO, CFO, etc.) can make the CMMC Level 1 attestation to SPRS.
Corserva can assess your compliance to the 17 controls and guide you in submitting your assessment results to the government.
Level 2 compliance of CMMC requires either an annual self-assessment or an outside assessment performed every three years.
The CMMC Accreditation Body (CMMC-AB) has stipulated that companies requiring an outside assessment will need to work with an accredited and independent third-party organization to perform a CMMC assessment. An assessment organization is called a “CMMC Third Party Assessment Organization” or C3PAO. A C3PAO is trained and accredited to perform CMMC assessments and can be found on the website of the CMMC-AB.
To meet CMMC Level 2, you follow the 110 best practices identified in NIST SP 800-171.
Under certain limited circumstances, the DoD will allow POA&Ms to achieve certification.
Companies that can self-certify will be able to use POA&Ms as an acceptable form of remediation for certain CMMC practices. POA&Ms will not be allowed for the highest-weighted requirements of CMMC.
You write POA&Ms (Plans of Actions with Milestones) to document controls to which you don't currently comply and how you plan to make changes to meet those gaps in the future.
Assuming you take the correct approach when developing a POA&M, it can be a valuable tool to improve the company's security posture. Just don't fall into the trap of using a POA&M as a checkmark to compliance. Instead of a procrastination step, your POA&M should be a roadmap to compliance, clearly outlining what steps you plan to take in the future to fully meet compliance.
In addition to POA&Ms, System Security Plans (SSP) can also be helpful on the path to a stronger security posture.
Corserva can create POA&Ms and SSPs for you, as well as perform NIST 800-171 assessments.
A Certified 3rd Party Assessor Organization (C3PAO) is licensed by the CMMC Accreditation Body (CMMC-AB) to perform CMMC assessments. Only those companies listed as C3PAOs on the CMMC-AB Marketplace are authorized to perform C3PAO assessments.
Within the CMMC-AB Marketplace, note the distinction between an "Authorized C3PAO" and a "C3PAO Candidate." Only companies that are Authorized C3PAOs can perform CMMC assessments. A C3PAO Candidate has begun the process of applying to become a C3PAO but has not yet completed the process.
Level 2 companies requiring a C3PAO assessment can comply with CMMC as follows:
Level 3 compliance of CMMC requires a government-led assessment every three years.
To meet CMMC Level 3, the company must meet more than 110 best practices based on NIST SP 800-172.
Entities that deal with government controlled unclassified information must comply with NIST 800-171 or CMMC, depending on the contract. If you are in the federal supply chain, there is a high probability that you need to be compliant.
Typical entities with this kind of information include universities, research institutions, consulting companies, service providers, and manufacturers, especially manufacturing companies that are prime contractors (or that sub for prime contractors) for various government contracts. These entities will almost always have CUI on premise or in cloud based or provider based systems and applications.
Companies that solely produce Commercial-Off-The-Shelf (COTS) products are not subject to CMMC requirements.
Compliance is not confined to prime contractors. The set of standards for compliance that are outlined must be met by anyone who processes, stores, or transmits this type of potentially sensitive information (CUI) for the DoD, GSA, NASA, and other federal or state agencies. This includes contractual agency relationships and flows down to subcontractors. There are negative ramifications for not being compliant that can include the loss of customers.
NIST 800-171 and CMMC not only apply to defense contractors directly selling to the government, but to any subcontractor selling to a government supplier. And even if today you do not currently provide parts for any supplier serving the government, do you really want to count yourself out of any future opportunities to sell to a supplier who does serve the government?
Typically, prime contractors are notified by the DoD directly that they need to be in compliance with NIST 800-171 or CMMC. Flow down clauses within the contract will stipulate that any subcontractors of the prime also need to comply. For many subcontractors, this is their first experience with NIST 800-171/CMMC and they are unsure how to proceed.
You should ask any of your own service providers or subcontractors if they have security controls put in place and how close they are to achieving NIST compliance or CMMC. Through the flow down clause within a contract, you have a responsibility to determine what security deficiencies are in the supply chain through any partners you deal with (such as manufacturers and IT providers).
The good news for companies that embark on the effort to meet NIST 800-171 or CMMC is that it provides a competitive advantage over companies that have not. Also, a side benefit of becoming compliant with NIST 800-171/CMMC is that once you do, you have also made significant progress on the path to comply with NIST 800-53, another competitive advantage. Once you meet NIST 800-171/CMMC, you can contact your customers to let them know, and ask them if they know if all their suppliers are compliant.
(Even for companies not in federal supply chains, there can be advantages to companies who comply with a cybersecurity framework.)
No, although a majority of companies that must comply with NIST 800-171 or CMMC are manufacturers.
Meeting government regulations is a challenge in every industry, and manufacturing is no exception. But remember, anyone who deals with CUI must comply. This can include engineering organizations, procurement services companies, fleet management companies, and staffing firms, in addition to manufacturing companies. Any company doing business with a prime contractor, subcontractor, or another company further down the stream in the federal supply chain is impacted by NIST 800-171 and CMMC.
For contracts that require subcontractors to meet NIST 800-171 compliance, you may or may not receive direct notification about your need to comply.
Some manufacturers that Corserva has worked with were first notified as far back as May 2016. If you are a manufacturer, you may have been notified by a prime contractor or subcontractor stating that you need to comply with NIST 800-171 as of December 31, 2017. Notification can come directly via mail or email. Alternately, you might be notified via messages you see when logging into a portal that you use for procurement or order management.
Several of Corserva’s clients do not recall seeing any notification but have taken a proactive step to achieve compliance, knowing it is likely they will be asked about this eventually.
Keep in mind that if you receive no notification, this does not mean you do not need to comply with NIST 800-171. It’s possible the notification was sent but the correct person to receive it never saw it. Corserva has worked with many companies who never received formal notification to comply.
For contracts that require subcontractors to meet CMMC, you must be certified to CMMC at the time of contract award. Even before that, it is possible that a contractor would expect you to be certified at the time of proposal. Certification must be maintained throughout the duration of the contract.
If a contract requires CMMC, it will be included in the RFP in section C ("Description/specifications/statement of work") and section L ("Instructions, conditions, and notices to offerors or respondents").
NIST Special Publication 800-171 is broken out into 14 different security families of IT security requirements.
Who is authorized to view this data? How do you control access to the CUI that resides in your organization (within your systems and within your operations)?
Are people properly instructed in how to treat this info? When it comes to CUI, are your employees aware of the security risks?
Are records kept of authorized and unauthorized access? Can violators be identified?
How are your networks and safety protocols built and documented?
What users are approved to access CUI and how are they verified prior to granting them access?
What’s the process if a data breach or security threat occurs, including proper notification? If there is an incident that puts data at risk, the DFARS 252.204-7012 clause stipulates that your partner must be notified.
What timeline exists for routine maintenance, and who is responsible?
How are electronic and hard copy records and backups safely stored? Who has access?
How are employees screened prior to granting them access to CUI?
Who has access to systems, equipment, and storage environments? For example, if you have one office with a front door and back door, what kind of security do you have? This could include locks, access control systems, and video monitoring systems. What is the physical environment like within your facility where the data is housed?
Are defenses tested in simulations? Are operations or individuals verified regularly?
Are processes and procedures still effective? Are improvements needed? Penetration testing and vulnerability assessments performed on an ongoing, regular basis are methods for measuring your security.
Is information regularly monitored and controlled at key internal and external transmission points?
How quickly are possible threats detected, identified, and corrected?
For NIST 800-171, within each of the 14 families are a set of basic security requirements and derived security requirements that must be assessed and verified. Across the 14 families, there are a total of 110 individual line items that must be verified. (For comparison, there can be up to 212 line items for NIST 800-53.)
The requirements for NIST 800-171 can be summarized into four main groups.
If you have a firewall solution in place, you may already have a lot of these areas covered.
Chances are good that you already have some mechanisms in place for 'control,' but you may not know what they are, and you may not have implemented best practices in this area. If you have audit records such as system or network device logs specifically focused on access to CUI, you might already be halfway there to meeting the controls requirements. To meet the NIST 800-171 mandate, the controls requirement dictates that you:
To meet the NIST 800-171 mandate, the monitoring and management requirement dictates that you:
A technical design that segregates systems used for CUI can be a cost effective method to achieve compliance. A defined IT system can limit the scope of work to be done.
To meet the NIST 800-171 mandate, the end user practices requirement dictates that you:
There should be comprehensive documentation that describes how CUI is controlled by every department within the company. Computer usage policies and internet usage policies are also helpful.
To meet the NIST 800-171 mandate, the security measures requirement dictates that you:
A lot of cloud based backup solutions do not meet the NIST 800-171 requirements. There are native capabilities within many software systems that, when configured properly, can address these security requirements.
The key points to remember for how to meet the NIST 800-171 requirements are: controls, monitoring/management, end user practices, and security measures. Becoming NIST compliant is not a one-time activity, it’s an ongoing process where you continuously:
Think of it as working towards a goal. Becoming NIST compliant involves documenting a plan, and then working to that plan.
The best way to implement CMMC is to take a security lifecycle approach.
For those companies requiring an outside assessment by a C3PAO, these are the steps you should take to meet the CMMC requirements.
Corserva can remediate issues identified during an assessment.
We also offer CMMC readiness services to help you with steps #2 and #3 when preparing for a CMMC assessment.
Corserva can help you comply with NIST 800-171 or CMMC. We offer:
Corserva can prepare you for a CMMC assessment by a C3PAO.
Corserva is a CMMC-AB Registered Provider Organization™ (RPO) and we are listed on the CMMC-AB Marketplace.
As an RPO, Corserva is authorized by the CMMC-AB to provide pre-assessment consulting services to government contractors and other Organizations Seeking Certification (OSC).
Corserva has created an easy process to enable you to get ready for CMMC and protect your government contracts.
To prepare you for your CMMC assessment, these are the steps we follow:
The end deliverable to you is a clear set of corrective actions to take before your CMMC assessment.
Get started today by requesting a quote for CMMC consulting services.
