Defense Contractors Navigating CMMC

General Questions

Q1. What is CMMC trying to address?
The Cybersecurity Maturity Model Certification (CMMC) addresses increasing and sophisticated cyber threats targeting the Defense Industrial Base (DIB). It ensures that contractors comply with existing requirements to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). CMMC also establishes a scalable framework to safeguard sensitive information, aligning with the risk posed by advanced threats like nation-state actors.

Q2. Where can I find the 32 CFR CMMC Program Rule?
The 32 CFR CMMC Program Rule is accessible through the Federal Register. Read the full rule here.

Q3. Where can I find the 48 CFR CMMC Acquisition Rule?
The 48 CFR CMMC Acquisition Rule, governing how CMMC requirements will be incorporated into DoD contracts, can be found here in the Federal Register.

Q4. Will companies need to comply with CMMC 1.0 after the revised program is implemented?
No. The revised CMMC framework has replaced the initial version, often referred to as “CMMC 1.0.” All compliance efforts moving forward will align with the updated framework.

Q5. Why did the DoD initiate rulemaking for CMMC?
Rulemaking was necessary to formalize the CMMC program within federal regulations. It ensures clarity, accountability, and enforceability for contractors. Title 32 CFR establishes the framework, and Title 48 CFR updates the Defense Federal Acquisition Regulation Supplement (DFARS), embedding CMMC requirements in contracts.

Q6. When will CMMC be required for Department of Defense contracts?
CMMC requirements will take effect 60 days after the final rule for 48 CFR is published in the Federal Register. Contractors should monitor updates closely to ensure readiness before these requirements become mandatory.

Q7. Why did the Department revise CMMC?
The revisions aim to address concerns from stakeholders by:

• Reducing costs, especially for small businesses.
• Improving trust in the assessment ecosystem.
• Aligning cybersecurity requirements with existing federal standards like NIST SP 800-171.

Costs and Resources

Q8. How much will it cost to implement CMMC?
Costs vary depending on factors like the CMMC level, the complexity of your network, and market conditions. For instance, Level 1 self-assessments are minimal, while Levels 2 and 3 may involve third-party assessments. Note that pre-existing requirements under DFARS 252.204-7012 are not considered additional CMMC costs.

Q9. What resources are available to assist companies in complying with DoD cybersecurity requirements?
The DoD provides several no-cost Cybersecurity-as-a-Service (CSaaS) resources, accessible through the DIBNet portal. These resources include toolkits, training, and advisory services to help contractors meet compliance obligations efficiently.

The CMMC Model

Q10. How will my organization know what CMMC level is required for a contract?
The required CMMC level will be explicitly stated in the contract solicitation and documents. It’s crucial to assess your current practices and align them with the stated level before bidding.

Q11. What is the relationship between NIST SP 800-171 and CMMC?
NIST SP 800-171 forms the foundation for CMMC Level 2. Compliance with this standard is required for safeguarding CUI. The CMMC framework introduces formal assessments to verify compliance.

Q12. What is the relationship between NIST SP 800-172 and CMMC?
NIST SP 800-172 addresses advanced persistent threats and underpins CMMC Level 3 requirements. Organizations required to meet Level 3 must implement 24 additional security controls outlined in NIST SP 800-172.

Q13. Will the Department update CMMC to align with NIST SP 800-171 Revision 3?
Yes, future rulemaking will integrate Revision 3 into CMMC requirements. However, until this update is formalized, assessments will continue using NIST SP 800-171 Revision 2 and its associated methodologies.

Assessments and Certification

Q14. How does my company become a C3PAO?
Organizations can begin the process by visiting the Cyber AB (formerly CMMC AB) website, which outlines requirements, training, and application steps to become a Candidate Third-Party Assessment Organization (C3PAO).

Q15. How often are assessments required?

• Level 1: Annual self-assessments.
• Level 2: Triennial third-party assessments, with annual affirmations.
• Level 3: Triennial assessments by the DoD Defense Industrial Base Cybersecurity Assessment Center (DIBCAC).

Q16. What is the role of Managed Service Providers (MSPs) in CMMC compliance?
If MSPs process, store, or transmit CUI on their systems, they fall under the scope of the contractor’s CMMC assessment. MSPs do not require independent certification but must demonstrate compliance through the primary contractor’s assessment.

Vendors with Foreign Support

Q17. Are vendors with foreign support eligible for CMMC certification?
Yes, vendors with foreign support can achieve CMMC certification. However, they must ensure that all systems, processes, and personnel involved in handling FCI or CUI comply with the requirements. Foreign entities may need to undergo additional vetting to address concerns about foreign ownership, control, or influence (FOCI).

Q18. How does Foreign Ownership, Control, or Influence (FOCI) affect CMMC compliance?
Vendors subject to FOCI must mitigate potential risks through measures like:

• Establishing a Technology Control Plan (TCP): Clearly define how access to sensitive information is limited to cleared U.S. personnel.
• Implementing Separation of Duties: Ensure that individuals with foreign affiliations have no access to CUI or critical systems.
• Engaging with the Defense Counterintelligence and Security Agency (DCSA): For contractors involved with classified contracts, the DCSA evaluates and approves FOCI mitigation plans.

Q19. Can foreign personnel work on contracts requiring CMMC compliance?
Foreign personnel can work on contracts involving FCI if explicitly authorized in the contract but cannot access CUI unless they meet stringent vetting requirements and comply with applicable export control laws (e.g., ITAR and EAR). Contractors must carefully control and document access to prevent unauthorized disclosures.

Q20. Are there specific cybersecurity challenges for vendors with foreign-based IT infrastructure?
Yes, foreign-based IT infrastructure adds complexity to compliance due to:

1. Data Jurisdiction Risks: Sensitive data stored or transmitted outside the U.S. may be subject to foreign laws, potentially conflicting with U.S. DoD regulations.
2. Access Control Issues: Vendors must ensure that foreign-based administrators or IT personnel cannot access U.S. DoD data.
3. Supply Chain Risks: Equipment or software procured from foreign sources may have vulnerabilities or backdoors.

To mitigate these risks, contractors should:

• Host all CUI and critical systems within U.S.-controlled environments.
• Ensure that foreign-based IT systems are not used for contract-related operations.
• Conduct rigorous supply chain assessments to verify trusted vendors.

Q21. How do export control regulations (e.g., ITAR and EAR) intersect with CMMC requirements?
Export control laws regulate the sharing of sensitive technologies and data with foreign entities or individuals. While CMMC focuses on cybersecurity, these laws govern who can access protected data. To comply:

• Verify if the contract data falls under ITAR or EAR.
• Implement strict controls to ensure that only authorized personnel can access protected data.
• Avoid storing or transferring controlled data on foreign-based systems unless explicitly allowed.

Q22. Do foreign-based Managed Service Providers (MSPs) pose a compliance risk?
Yes, using foreign-based MSPs can pose significant risks. If an MSP has access to systems or data containing CUI, they are subject to the same compliance requirements. Contractors should:

• Verify that the MSP operates under U.S. jurisdiction.
• Conduct due diligence on MSP ownership and data handling practices.
• Include clear contractual obligations requiring compliance with CMMC and export control laws.

Q23. Are there additional assessments for foreign-controlled subcontractors?
Yes. Prime contractors must evaluate their subcontractors’ ability to meet compliance requirements, including those affected by FOCI. The DoD may require additional assurances, such as:

• Security Agreements.
• Enhanced control plans.
• Onsite inspections or audits of the subcontractor’s systems.

Q24. How can contractors ensure secure communication with foreign team members or partners?
Secure communication is critical, especially when collaborating with foreign partners. Contractors should:

• Use encrypted communication tools approved by the DoD or federal agencies.
• Segregate sensitive project-related discussions from non-project-specific channels.
• Restrict access to project data based on the principle of least privilege.

Q25. Are there penalties for non-compliance due to foreign support issues?
Yes, penalties can include contract termination, monetary fines, and disqualification from future DoD contracts. Contractors found negligent may also face legal action under export control laws if unauthorized access to CUI or restricted data occurs.

Q26. What best practices should vendors with foreign support adopt to maintain compliance?

1. Establish Clear Policies: Develop comprehensive policies for managing foreign personnel, ownership, and support.
2. Perform Regular Risk Assessments: Identify vulnerabilities related to foreign access and mitigate them proactively.
3. Monitor Supply Chains: Ensure that all vendors and suppliers meet DoD cybersecurity requirements.
4. Engage Legal and Compliance Experts: Consult with professionals to navigate export control laws and FOCI requirements effectively.

Key Takeaways for Defense Contractors

• Start Early: Understanding your current cybersecurity posture is critical for compliance. Conduct a gap analysis aligned with your expected CMMC level.
• Leverage Resources: Utilize the free resources and training provided by the DoD to reduce the compliance burden.
• Engage Experts: Partner with readiness advisors, like our team, to streamline compliance efforts, minimize costs, and avoid contract disruptions.