CMMC Compliance: Your Guide to Securing Federal Contracts and Protecting CUI

As cyberattacks on the U.S. Department of Defense (DoD) supply chain grow more frequent and sophisticated, compliance with the Cybersecurity Maturity Model Certification (CMMC) framework has become a critical requirement for contractors. With the CMMC 2.0 framework, the DoD aims to safeguard sensitive data and Controlled Unclassified Information (CUI) flowing through the Defense Industrial Base (DIB). 

Whether you’re a contractor or an academic institution supporting the DoD, achieving CMMC compliance is essential to retaining contracts and protecting national security. Below, we’ll outline the key steps to achieving CMMC compliance, each broken down into manageable phases.

Glossary of Terms

Before diving into the steps, here’s a quick glossary to help you understand the key acronyms used throughout this guide:

• CMMC: Cybersecurity Maturity Model Certification – A framework developed by the DoD to ensure cybersecurity standards are met across its supply chain.
• DoD: Department of Defense – The federal agency responsible for national security and the armed forces.
• DIB: Defense Industrial Base – The network of private companies and institutions that provide goods and services to the DoD.
• CUI: Controlled Unclassified Information – Sensitive information that requires safeguarding but is not classified.
• FCI: Federal Contract Information – Information provided by or generated for the government under a contract, not intended for public release.
• DFARS: Defense Federal Acquisition Regulation Supplement – Regulations for safeguarding DoD-related information.
• NIST: National Institute of Standards and Technology – The agency that sets standards for cybersecurity, including NIST SP 800-171 for protecting CUI.
• FedRAMP: Federal Risk and Authorization Management Program – A government-wide program that ensures cloud products meet stringent security requirements.
• ITAR/EAR: International Traffic in Arms Regulations / Export Administration Regulations – Regulations for the export of sensitive defense-related data and technology.
• SSP: Systems Security Plan – A document outlining an organization’s security controls and processes.

C3PAO: Certified Third-Party Assessment Organization – An authorized body that conducts CMMC assessments.

Step 1: Define Your Required CMMC Level

CMMC compliance starts with identifying your required certification level. CMMC 2.0 has three levels:

• Level 1 (Foundational): Covers 17 basic cybersecurity practices for contractors handling Federal Contract Information (FCI).
  • Required Tools: Basic antivirus software, firewalls, email filtering tools, and secure access control systems.
  • Hardware Needs: Company laptops or desktops with secure configurations and minimal network complexity.
• Level 2 (Advanced): Includes 110 security controls from NIST 800-171 for organizations handling CUI.
  • Required Tools: Security Information and Event Management (SIEM) systems, endpoint detection and response (EDR) solutions, multi-factor authentication (MFA), data encryption tools, and DLP solutions.
  • Hardware Needs: Devices capable of running advanced security configurations, secure mobile devices, and encrypted USB drives.
• Level 3 (Expert): Incorporates NIST 800-171 and additional controls for critical or high-value DoD programs.
  • Required Tools: Advanced threat detection systems, robust incident response tools, post-quantum cryptography solutions, and specialized DLP tools.
  • Hardware Needs: Dedicated servers for critical operations, secure cloud platforms like Microsoft GCC High, and air-gapped systems for the most sensitive data.

Determine your level based on contract requirements and the sensitivity of the data you handle. If your organization processes, stores, or transmits CUI, you’ll likely need at least Level 2 compliance.

Step 2: Identify Assets for CMMC

Next, inventory your organization’s assets, systems, and personnel to define the CMMC assessment scope. Key questions to ask include:

• Where is FCI or CUI stored, processed, or transmitted in your environment?
• Do you have visibility and control over the systems managing sensitive data?

Categorize assets based on their role in compliance, such as CUI assets, security protection assets (SPA), or out-of-scope assets. A detailed inventory will streamline your assessment preparation and prevent compliance gaps.

Step 3: Identify the Software and Hardware Tools Required for Compliance

Once you’ve defined your CMMC level and inventoried your assets, it’s time to identify the tools you’ll need to secure your environment. This includes both hardware and software solutions tailored to your organization’s compliance needs.

Software Tools

• Endpoint Security Tools: These tools protect individual devices, such as desktops, laptops, and mobile devices, by detecting and mitigating malware, ransomware, and other malicious software. They also ensure that unauthorized access to devices is blocked.
• Security Information and Event Management (SIEM) Systems: These systems collect and analyze security event data from across your network, providing real-time visibility into potential threats, logging activity, and enabling rapid responses to security incidents.
• Data Encryption Tools: These solutions encrypt sensitive data at rest and in transit, ensuring that unauthorized access to stored files, emails, and communications does not compromise your organization’s security.
• Access Control Systems: These systems implement multi-factor authentication (MFA) and role-based access control to restrict access to sensitive data and systems to only authorized personnel.
• Data Loss Prevention (DLP) Solutions: These tools monitor and control the flow of sensitive data to prevent accidental or intentional data breaches. They can detect and block attempts to send sensitive information outside of the organization through email, web uploads, or removable media.
• USB Encryption Solutions: These solutions ensure that any data transferred via external drives or other removable storage devices is encrypted and cannot be accessed by unauthorized users.  Be conscious of where the encryption and decryption keys are accessed.   
• Backup and Recovery Software: These systems securely store copies of your critical data and provide the ability to restore it quickly in case of ransomware attacks, data corruption, or system failures.

Hardware Tools

• Encrypted Devices: These include laptops, desktops, and external drives with built-in encryption capabilities to safeguard stored data from unauthorized access.
• Firewalls and Routers: Hardware firewalls and secure routers create a barrier between your internal network and external threats, filtering and inspecting traffic to ensure that malicious activity is blocked.
• Mobile Device Management (MDM): MDM hardware or software ensures that mobile devices used for business purposes are secure, regularly updated, and compliant with your organization’s cybersecurity policies.
• Secure Servers and Storage: Whether on-premises or cloud-based, these secure storage solutions are designed to handle and protect sensitive data, particularly Controlled Unclassified Information (CUI).

Additional Considerations

• Ensure all hardware tools meet FIPS 140-2 standards for cryptographic modules to comply with government regulations.
• Verify that any cloud-based solutions adhere to FedRAMP standards to ensure they meet the necessary security benchmarks for DoD contracts.
• Choose tools that are compatible with your technical environment and the approach (All-In or Enclave) you select in the next step.

Step 4: Choose Between an All-In Policy or an Enclave Approach

Once you’ve identified your assets and their data flows, determine whether your organization will benefit most from an “All-In” or “Enclave” strategy:

• All-In Approach: This strategy migrates your entire IT infrastructure to a compliant platform, such as Microsoft GCC or GCC High. It’s ideal for organizations where a significant portion of assets and systems fall within the CMMC assessment scope.
• Enclave Approach: In this scenario, you create a standalone, secure environment for handling CUI, isolating it from other parts of your network. This method works well when only a small portion of your systems deal with CUI.

Questions to guide your decision:

• Do 15-20% or more of your employees need access to CUI?
• Can your data flow be easily isolated?
• What’s more cost-effective for your organization over time?

Step 5: Choose a Technical Design for CMMC

Once you’ve decided on an All-In or Enclave approach, determine the specific technical design that aligns with your needs. Many organizations are transitioning from on-premises systems to cloud solutions like Microsoft’s Government Community Cloud (GCC) or GCC High. These platforms provide secure, scalable options that meet DFARS 252.204-7012 and CMMC requirements.

Key considerations when selecting a technical design include:

• Does the solution align with your contractual requirements?
• Can it meet export control data protections (e.g., ITAR/EAR)?
• Is your cloud provider FedRAMP Moderate or equivalent?

Step 6: Prepare and Document for CMMC

Documentation is critical to passing a CMMC assessment. Prepare detailed records, including:

• A Systems Security Plan (SSP) with infrastructure maps and data flow diagrams.
• Asset inventory lists organized by CMMC level.
• Proof of compliance for each control, such as FIPS 140-2 validated URLs and screenshots.

Thorough documentation ensures assessors can verify your compliance without delays.

Step 7: Complete a CMMC Assessment

The final step is the formal CMMC assessment conducted by a C3PAO (Certified Third-Party Assessment Organization). Key steps include:

• Defining the scope and scheduling the assessment.
• Preparing required documents, such as the SSP, inventory lists, and previous assessment results.
• Ensuring all controls have been implemented and validated.

Your readiness will determine whether you pass the assessment or need additional remediation time.

The Path to CMMC Compliance

Completing all seven steps will take companies an average of 52 weeks, however this can be much longer if it is a large organization. It’s generally a long process but the rewards are worth the effort. Achieving CMMC compliance protects sensitive data, secures contracts, and strengthens national defense.