In the United States, national defense is a huge industrial sector, and it is a point of pride for small businesses in Madison and Huntsville to be doing business with the Department of Defense (DoD). Virtually any company can aspire to become a DoD vendor or service provider, as the national defense program deals with a wide variety of businesses in different sectors.
But because any professional relationship with the DoD involves managing highly sensitive information, all companies working with them need to meet stringent information security requirements. Enter the Cybersecurity Maturity Model Certification (CMMC) and Defense Federal Acquisition Regulation Supplement (DFARS) frameworks mandated by the DoD.
What is CMMC?
The CMMC is a unifying cybersecurity certification standard for companies within the Defense Industrial Base (DIB) sector. The DIB is a worldwide vendor and provider base that enables the research, design, production, delivery, and maintenance of sensitive military weapons systems and components. DIB companies are required to comply with stricter cybersecurity standards than most other organizations.
Related article: Frequently asked questions about the CMMC
The CMMC was created based on a long-established cybersecurity strategy by the DoD, which recognized a need to enhance and assess the cybersecurity posture of DIB organizations due to the ongoing risk of cyberthreats. The CMMC serves as a verification mechanism to ensure that DIB companies shore up their cybersecurity efforts to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) within their networks.
What is DFARS?
DFARS is a set of rules that the DoD and similar US agencies follow to oversee the purchase of goods, services, and technologies for both their classified and unclassified use. It is an older framework yet still an integral part of CMMC compliance. Simply put, one of the requirements to qualify for the higher levels of CMMC compliance is to fully comply with DFARS standards.
Related article: What is DFARS?
What’s the difference between CMMC and DFARS?
DFARS requires DIB companies to address the 14 security requirement families in the NIST Special Publication 800-171. These are as follows:
- Access control – Access must be limited to only authorized users.
- Awareness and training – All staff must be knowledgeable in handling CUI.
- Audit and accountability – Tools for preventing, mitigating, and investigating malicious activities that involve CUI must be implemented.
- Configuration management – All hardware and software related to the IT system must have usage documentations.
- Identification and authentication – Any user attempting to access the IT system must be positively identified and authenticated.
- Incident response – There should be a plan in place for responding to various types of cyberthreats.
- Maintenance – Regular maintenance and updating should be performed on the IT system.
- Media protection – All storage devices — especially portable media like flash drives — should have protocols for safe use.
- Personnel security – All employees will be required to pass extensive background checks before they are allowed to access the IT system. Certain criteria will also be set for excluding people with specific histories from accessing CUI.
- Physical protection – There should be ample physical infrastructure to protect data storage devices from tampering, theft, natural disasters, and normal wear and tear.
- Risk assessment – There needs to be regular system audits to detect potential vulnerabilities.
- Security assessment – There should be regular audits of the IT controls that manage access to CUI.
- System and communications protection – There should be multiple layers of security for all lines of communication.
- System and information integrity – The IT staff should be well trained in assessing and responding to the essential security alerts they receive.
The DFARS framework makes up the core requirement for CMMC Levels 3 and higher, and is what IT departments and IT providers should refer to when building a CMMC-compliant cybersecurity system.
To achieve a higher level of CMMC certification, a company will need to demonstrate their ability to deploy stronger data security measures per the standards of both DFARS and CMMC. Refer to these five CMMC levels to help you identify the appropriate CMMC maturity level your business should achieve:
| Level | Requirements | Description |
|---|---|---|
| Level 1: Basic cyber hygiene | Basic security information and event management (SIEM), managed detection and response (MDR) and phishing defense certifications | Level 1 requires companies to protect FCI. |
| Level 2: Intermediate cyber hygiene | Level 1 requirements, retained virtual Chief Information Security Officer (vCISO) and programmatic and/or security gateways | Level 2 requires companies to comply with Level 1 requirements and have a strategy to protect any CUI across all business activities and transactions. |
| Level 3: Good cyber hygiene | Level 2 requirements, first level of Azure, phishing defense, and endpoint skills and tools | Level 3 requires companies to comply with Level 1 and Level 2 requirements and implement all the security requirements under the NIST SP 800-171 guidelines, including 20 additional practices to mitigate threats. |
| Level 4: Proactive cyber hygiene | Level 3 requirements, threat hunting, routine testing, incident response skills and tools | Level 4 requires companies to comply with the requirements from Levels 1–3 and establish proactive strategies to enhance detection and response to advanced persistent threats (APTs) for the long term. |
| Level 5: Advanced/Progressive cyber hygiene | Level 4 requirements, all DoD-standard cloud-delivered operations | Level 5 requires companies to comply with requirements from Levels 1–4 and deploy sophisticated techniques, tools, and strategies to detect and respond to APTs. |
Ensure that your company meets CMMC and/or DFARS standards so you can continue to work with the Department of Defense. F1 Solutions is a proud veteran-owned DFARS compliance partner, and we can provide you with a clear strategy for meeting the most stringent of data management standards. Contact us today to learn more.
