In an attempt to improve cybersecurity within the Defense Supply Chain (DSC), the Department of Defense (DoD) developed the Cybersecurity Maturity Model Certification (CMMC) program to establish rigorous security requirements for vendors. Once upon a time, these companies could self-attest their security posture. Those days are over now thanks to CMMC compliance.
Companies must take 5 key steps to prepare for CMMC:
One of the most important components of the CMMC preparation process is the development of a System Security Plan (SSP). When done properly, an SSP will not only get you one step closer to certification but also improve the posture of your organization as a whole.
A System Security Plan (SSP), as the word “plan” implies, covers the goals and objectives of the security program, staffing and workforce development, technology investment, and implementation schedules.
In the event of a CMMC audit, the SSP is likely the first thing you will be asked for. Requirement CA.2.157 3.12.4 mandates that all contractors must develop, document, and periodically update their SSP.
The overall SSP references more specific plans, such as an Incident Response Plan, Configuration Management Plan, Business Continuity/Disaster Recovery Plan, etc. All plans taken together, whether they exist as separate documents or not, can be considered part of the overall SSP.
Taking a cue from the maturity model aspect of CMMC, the first thing to do in the CMMC SSP development process is to examine and document your current security practices. Most contractors find it helpful to have a third party perform a compliance gap analysis at this phase.
Once you have inventoried the practices you have in place, you need to start planning how to close the gap between the current state and where you need to be for certification.
Next, develop an implementation and remediation plan around each of the gaps on your list. It’s important to document all implementation decisions because these decisions will form the basis of the completed SSP.
As far as the timeline goes, it is fair to say that an organization that is just getting started should expect to devote at least a year to the effort, along with the dedication of internal resource time and investment in required remediation.
That being said, SSPs aren’t a one-and-done. They should be an ongoing effort and need to be continuously updated as controls and compliance requirements change.
CMMC certification can be a major undertaking but is the price to pay for the privilege of serving the nation by properly handling and protecting sensitive information. A more secure DSC means fewer vulnerabilities and, in turn, fewer opportunities for threat actors to leverage them.
If you’re looking for guidance on how to meet CMMC Level 2 requirements, download our checklist or reach out to our team of Registered Practitioners for help.