Cybersecurity Maturity Model Certification (CMMC)

Cyber-attacks from foreign governments and organized crime groups are at the forefront of US national security concerns. Over $600 billion annually is exfiltrated from the Defense Industrial Base supply chain. The U.S. Department of Defense (DoD) is implementing the CMMC regulations in 2020 for all suppliers. 

Get Ready for CMMC

The future of your business depends on how you prepare for cybersecurity maturity model certification (CMMC). CMMC will require independent audits and certification as a “pre-qualification” requirement prior to contract award. If suppliers are unable or unwilling to make the required changes, they may lose all existing DOD contract rebids and future contracts. CORTAC provides end-to-end CMMC guidance and services and leverages cybersecurity and information assurance as a competitive advantage while reducing the compliance and contracting risks of meeting ITAR, EAR, DFARS, & CMMC requirements.

By The Numbers

Global Defense Supply Chain

%

DOD IP on Non-DOD Supplier Networks

%

Suppliers that could pass certification today

%

Required to achieve CMMC certification

Cybersecurity Maturity Model Certification (CMMC) Framework

The cybersecurity maturity model certification framework is a unifying standard for the implementation of cybersecurity across the Defense Industrial Base (DIB). CMMC is a critical element of the Department of Defense’s overall Information Protection strategy.

The CMMC framework includes a comprehensive and scalable certification element to verify the implementation of processes and practices associated with the achievement of a cybersecurity maturity level.

CMMC is designed to provide increased assurance to the Department that a DIB company can adequately protect sensitive unclassified information, accounting for information flow down to subcontractors in a multi-tier supply chain.

cybersecurity-maturity-model-steps

Our CMMC Approach

We bring a unique blend of experience with a team that is well versed in both supporting companies primarily optimized around commercial contracts, and companies organized to mainly support DoD programs.  You receive a right-sized, end-to-end solution suited to your unique company requirements. Our business model is not built on selling you downstream licenses and services, but on helping you establish the most cost effective and risk balanced implementation to meet your business needs.

 

Readiness Assessment

CORTAC Group vReady

Understand Your Risks and Obligations

  • Identify baseline security & compliance gaps and IT vulnerabilities
  • Receive gap recommendations 
  • Generate executive level solution roadmap

Solution Implementation

CORTAC Group vCompliant

Plan And Implement “Right-Sized” Solutions

  • Define “right-sized” architecture solution, implementation plan, costs, and timeline
  • Implement technical solutions and configurations
  • Migrate FCI/CUI information and develop documentation (Policy, Procedure, SSP, and  POA&M)

Compliance Operations

CORTAC Group vSecure

Maintain Ongoing Compliance

  • Maintain compliant operations
  • Documentation maintenance
  • Support change management and provide reporting and audit support
  • Facilitate incident response

Registered Practitioner Organization

The Cybersecurity Maturity Model Certification Registered Practitioner Organization authorized badge helps you know you are working with an approved company.  CORTAC Group has completed training, a rigorous background check, and practices the highest ethical standards as required by the CMMC Accreditation Board Code of Professional Conduct. As a CMMC RPO company we have the ability and desire to serve the U.S. Department of Defense Industrial Base as a CMMC advisor.

When you work with CORTAC Group you can have the confidence we know and understand the Department of Defense supply chain.  Your company will reduce risk, gain a competitive advantage, and win more business as we help you navigate the complexities and regulations for this federal government program.

cybersecurity-maturity-model-certification-RPO

Resources

The world of CMMC can be complex, which is why we’re here to help. Say goodbye to hours of research – our resources below are designed to keep you up to date on all things CMMC.

CMMC Supplier Resource Center

Watch the recent webinar recordings and learn how (DIB) suppliers can benefit from implementing an end-to-end, right-sized CMMC solution.

Upcoming Events

Register now and join us at an upcoming event

CMMC Industry Day – Government Contractors Only Event

Host: Summit 7 Systems 

Date: August, 3, 2021

Time: 8:00 a.m. – 3:30 p.m. Central

Location: Austin, Texas

Live in-person event

CMMC Industry Day and Modern Information Security Topics

The Cloud Security and Compliance Series (CS2) is strictly for government contractors and those in higher education research institutions looking to meet cybersecurity regulations, address security threats, and glean best practices for their cloud investments.

Frequently Asked Questions

What is Cybersecurity Maturity Model Certification (CMMC)?

CMMC stands for “Cybersecurity Maturity Model Certification” and is a unifying standard for the implementation of cybersecurity across the Defense Industrial Base (DIB). CMMC is a critical element of DoD’s overall Information Protection strategy. The CMMC framework includes a comprehensive and scalable certification element to verify the implementation of processes and practices associated with the achievement of a cybersecurity maturity level. CMMC is designed to provide increased assurance to the Department that a DIB company can adequately protect sensitive unclassified information, accounting for information flow down to subcontractors in a multi-tier supply chain.

Why was CMMC created?

The cybersecurity maturity model certification (CMMC) was created to provide a baseline cybersecurty framework and maturity model based on data governance and driven by organizationally defined documentation, protections, and process institutionalization. DoD is migrating to the new CMMC framework in order to assess and enhance the cybersecurity posture of the Defense Industrial Base (DIB) sector. The CMMC is intended to serve as a verification mechanism to ensure that DIB companies implement appropriate cybersecurity practices and processes to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) within their unclassified networks.

When is the Interim Defense Federal Acquisition Regulation Supplement (DFARS) rule implementing CMMC (DFARS case 2019-D041) effective?

The interim rule became effective on November 30, 2020. The public review and comment period for DFARS Case 2019-D041 ended on November 30, 2020. Due to its designation as a major rule change, the interim rule must also complete a Congressional Review.

Will other Federal (non-DoD) contracts use CMMC?

The initial implementation of the cybersecurity maturity model certification (CMMC) will only be within the DoD and will be implemented through DFARS clause 252.204-7021. Additional Federal agencies and international organizations are considering CMMC.

What is the relationship between National Institute of Standards Technology (NIST) Special Publication (SP) 800-171 and CMMC?

CMMC Level 3 includes the 110 security requirements specified in NIST SP 800-171. The CMMC Model also incorporates additional practices and processes from other standards, references, and/or sources such as NIST SP 800-53, Aerospace Industries Association (AIA) National Aerospace Standard (NAS) 9933 “Critical Security Controls for Effective Capability in Cyber Defense”, and Computer Emergency Response Team (CERT) Resilience Management Model (RMM).

How will CMMC be different from NIST SP 800-171?

Unlike NIST SP 800-171, the CMMC model possesses five levels. The model is cumulative whereby each level consists of practices and processes as well as those specified in the lower levels. The CMMC Model includes additional cybersecurity practices in addition to the security requirements specified in NIST SP 800-171. In addition to assessing a company’s implementation of cybersecurity practices, the CMMC will also assess the company’s maturity processes.

Questions adapted courtesy of official CMMC government siteThe Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S))

Read our full list of answers to questions businesses like yours have about preparing for and implementing processes and practices to achieve the right cybersecurity maturity model for your business.

Let's Get Started

For help with CMMC questions, call us at 1-833-530-2083

Why wait? Empower yourself and your business. We can do this, together.