CMMC
Can You Meet CMMC Requirements?
Fast track your business with RCS Secure.
The Cyber Security Maturity Model Certification (CMMC)
As businesses everywhere look to protect their customers and themselves from cyber crime, the United States government is applying the same urgency to its dealings through the Department of Defense (DoD). DoD prime contractors—and businesses that aspire to be contractors—are required to show measurable readiness and sophistication in the area of cyber security. This makes sense because the government has to entrust businesses with sensitive information in order to work with them. Further, contractors represent a level of risk as many are small- and medium-sized businesses that may lack resources, rendering them unable to compete with large businesses.
While these regulations and requirements are intended to disqualify businesses with poor cyber security, RCS Secure is here with solutions for any business looking to secure a government contract. We devise a strategy that will improve your processes and technology to bolster your security and allow you to meet and exceed CMMC requirements.
We believe that any business can confidently use the latest technologies, safely and securely, especially with a trusted IT partner that can guide them when they are in pursuit of a DoD contract. Learn more about us, meet our leadership team, or check out our blog to discover how RCS makes security a priority.
We believe that any business can confidently use the latest technologies, safely and securely, especially with a trusted IT partner that can guide them. Learn more about us, meet our leadership team, or check out our blog to discover how RCS makes security a priority.
What Is CMMC?
While a mature, agile cyber security strategy is something businesses should already have in place, the DoD cyber security requirements are more specific to protecting government systems. This means a typical contractor must protect two types of defined information:
Controlled Unclassified Information (CUI) – This is data that resides in federal systems and organizations. They require certain levels of safekeeping. At a tactical level, the primary goal of certification is to improve the security of this kind of information.
Federal Contract Information (FCI) – This is sensitive, valuable information that is not intended for public release. This is either provided by or generated for the government under a contract to develop or deliver a product or service to the government.
The Five Levels of CMMC
CMMC is based on an ascending level of cyber security preparedness ranging from Level 1 (basic) to Level 5 (advanced). These levels classify contractors by assessments of domains, processes, capabilities, and practices as they pertain to cyber security, commonly referred to as “a level of hygiene.”
CMMC Level 1 – Basic Cyber Hygiene
- Goal: Safeguard FCI
- Least number of practices to perform
- This represents the bare minimum of cyber security
CMMC Level 2 – Intermediate Cyber Hygiene
- Goal: Transition step to securing CUI
- Establish and document practices and policies
- Perform practices in a repeatable manner
CMMC Level 3 – Good Cyber Hygiene
- Goal: Protect CUI
- Establish and maintain a plan that builds on Level 2
- This may include information on missions, goals, project plans, resourcing, training, dfars compliance, and involvement of stakeholders.
CMMC Level 4 – Proactive Cyber Hygiene
- Goal: Protect CUI and reduce risk of advanced persistent threats
- Cyber security strategy must demonstrate the ability to protect against sophisticated, targeted cyber attacks
- Framework must be established that actively protects data and allows an organization to take corrective action when necessary
- This includes a documented security plan that demonstrates continuous improvement of attack detection and response capabilities.
CMMC Level 5 – Advanced/Progressive Cyber Hygiene
- Goal: Protect CUI and reduce risk of advanced persistent threats
- High levels of cyber security are standardized and optimized across an entire organization.
- Additional practices increase the depth and sophistication of cyber security capabilities
