Common Misconceptions of CMMC: Implementing at the Assessment Level vs the Requirement Level
Are you trying to navigate the complexities of CMMC assessments for your organization? Whether you're part of the Defense Industrial Base or a commercial entity, understanding how to implement CMMC at both the assessment and requirement levels is crucial. Yet, many misconceptions surround these levels, often leading to confusion.
This guide will help clear up those misunderstandings and provide you with a more solid grasp of CMMC assessment and implementation.
What is CMMC 2.0?
The Cybersecurity Maturity Model Certification (CMMC) 2.0 is the latest version of the Department of Defense's (DoD) cybersecurity framework. Put simply, it is a set of standards and guidelines for protecting sensitive government information across the Defense Industrial Base (DIB).
By implementing CMMC 2.0, organizations can demonstrate their ability to safeguard this information and bid on DoD contracts. The framework consists of three maturity levels, each with a set of processes and practices that organizations must follow (as verified by regular CMMC assessments) to protect Controlled Unclassified Information (CUI):
Level 1 (Foundational): Includes requirements focusing on basic cyber hygiene and protecting Federal Contract Information (FCI). Requires an annual self-assessment.
Level 2 (Advanced): Protects Controlled Unclassified Information (CUI) and requires a higher level of cyber hygiene. Includes a mix of self-assessments and third-party assessments.
Level 3 (Expert): Aimed at reducing the risk from Advanced Persistent Threats (APTs) and includes government-led CMMC assessments. Organizations at this level must meet all controls as well as possible additional requirements.
What Is the CMMC Assessment Level vs Requirement Level?
We've established the three levels of CMMC compliance, so what do we mean by assessment level and requirement level? Put simply, each of the controls has a core goal, which constitutes the requirement of that control. However, there are also subtasks that must be accomplished in order to successfully comply with that control. These subtasks are referred to as assessment objectives.
Focusing your compliance efforts on only the requirement level of a control is not enough—if you overlook even one of the objectives at the assessment level, you will fail the entire control. Most controls have two or three associated assessment objectives, though this can vary, and each must be met in order to fully comply with the requirement. If you include both requirements and objectives, there are not 110 tasks to complete, but 320.
Example
Let's look at an example. Here's one of the 110 controls:
SI.L2-3.14.7 — IDENTIFY UNAUTHORIZED USE
Requirement
Identify unauthorized use of organizational systems.
Assessment objectives
Determine if:
authorized use of the system is defined; and
unauthorized use of the system is identified.
In this case, the requirement is simply to identify unauthorized use—this is what most people focus on. However, during annual assessments, you will be required to demonstrate that you have also accomplished both assessment objectives. If you forgot to clearly define what unauthorized use looks like, you would fail the entire control.
Misconceptions Surrounding CMMC Implementation
Now that we understand the basics of CMMC assessments, levels, and requirements, let's look at some common misconceptions surrounding CMMC implementation.
Myth 1: Implementing Requirements Guarantees Passing the Assessment
As we mentioned earlier, neglecting any of the assessment objectives for a control can result in non-compliance. This means that simply implementing the requirements is not enough—you must also implement all associated objectives. People make the mistake of focusing on the 110 things without paying attention to the subtasks, causing them to fail the control.
Myth 2: The Assessment Objectives Are Only There for the Assessor
Another common misconception is that the assessment objectives are only for the assessor to check off and have no real impact on compliance. However, these objectives are like the rubric by which your compliance will be graded, a cheat sheet for what your assessor is looking for. Take advantage of this roadmap and use it to guide your compliance efforts during implementation.
Myth 3: Assessment Objectives Can Be Ignored Until the Last Minute
Don't make the mistake of thinking that the assessment objectives don't matter until your CMMC assessment actually rolls around. Many of these objectives require significant changes to your processes and practices, and they are included because they genuinely contribute to a more secure environment. Neglecting to implement them until the last minute can lead to failed compliance checks.
Your Next Steps with TechAxia
Understanding the distinctions and common misconceptions surrounding CMMC's assessment and requirement levels is vital for successful implementation. Partnering with experts like TechAxia can simplify this complex process, ensuring that your organization has everything it needs to pass CMMC assessments.
Ready to take the next step in securing your business? Reach out to TechAxia today and discover how we can help you achieve seamless CMMC compliance.