CMMC General Info (Q.16 from Q&A).pdf

Cybersecurity Maturity Model Certification

(CMMC)

GENERAL INFORMATION

Cybersecurity is a top priority for the Department of Defense (DoD). The defense industrial base (D18) faces increasingly frequent and complex cyberattacks. To strengthen DIB cybersecurity and better safeguard DoD information, the DoD developed the Cybersecurity Maturity Model Certification ( CMMC) Program to assess

DoD cybersecurity requirements pertaining to Federal Contract Information (FCI) and

Controlled Unclassified Information ( CUI).

FCI is unclassified information not intended for public release that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government. CUI is unclassified information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls.

Key features of CMMC include:

• Tiered Model: CMMC requires companies - Organizations Seeking Assessment

( OSA) and Organizations Seeking Certification ( OSC) -- entrusted with sensitive unclassified DoD information to implement cybersecurity standards at progressively advanced levels, depending on the type and sensitivity of the

"Tl C'D C'D a.

O" C

• CMMC Status is valid for three years from the CMMC Status Date as defined in§ 170.4

CMMC Scoping

The CMMC Assessment Scope is the set of all assets in the OSA's environment that will be assessed against CMMC security requirements. OSAs must determine the assessment scope prior to the start of an assessment and define the scope in the System Security Plan (SSP).

• Level 1 scope: The OSA information systems that store, process, or transmit FCI. For more detailed information on Level 1 scoping, see 32 CFR § 170.19(b)(1). See also the !Level 1 CMMC Scoping Guide-

• Level 2 scope: The OSA information systems that store, process, or transmit CUI;

Security Protection Assets; Contractor Risk Managed Assets; and Specialized Assets. For more detailed information on Level 2 scoping, see 32 CFR § 170.19(c)(1).

See also the !Level 2 CMMC Scoping Guide-

• Level 3 scope: The OSC information systems that store, process, or transmit CUI;

Security Protection Assets; and Specialized Assets. For more detailed information on Level 3 scoping, see 32 CFR § 170.19(d)(1). See also the !Level 3 CMMC Scoping!

!Guide.

Cl) Cl) a.

O" C

• Begins at 48 CFR

Rule Effective Date

• Where applicable, solicltatlons will require Level 1 or 2 Self-Assessment

• Begins 12 months after Phase 1 start

• Where applicable, solicitations will require Level 2

Certification

• Begins 24 months after Phase 1 start

• Where applicable solicitations will require Level 3 Certification

• Begins 36 months after Phase 1 start

• All solicitations and contracts will include applicable CMMC Level requirements as a condition of contract award

CMMC Level Selection

The CMMC Program provides assessments at three levels, each incorporating security requirements from existing regulations and guidelines. DoD Program Managers determine the type of CMMC assessment based on the type of data (FCI or type of CUI) handled and managed by the contractor and/or subcontractors in the performance of a contract.

New! Memo signed January 15, 2025, Implementing the Cybersecurity Maturity Model Certification ( CMMC) Program: Guidance for Determining Appropriate CMMC Compliance Assessment Levels and Process for Waiving CMMC Assessment Requirements (See link in Other Resources below)