CMMC Compliance Services: Protect Your DoD Contracts

Companies requiring CMMC compliance work closely with the DoD and the United States government. Entities arranging contracts with the DoD or bidding on them commonly require CMMC compliance. Whether CMMC compliance is mandatory should be clearly stated in a contract negotiation.

CBIZ Pivot Point Security helps you stay current with the latest standards for ongoing compliance management, including requirements for Level One, Level Two, and Level Three.

Whether you need support for recertification every few years or annual self-assessments, we develop a CMMC compliance plan that fits your needs.

Level One and Level Two entities must complete annual self-assessments between traditional audits. The Level Two tier is subject to an ongoing certification audit every three years. The Level Three tier is subject to continual auditing by the DIBCAC.

Yes. CBIZ Pivot Point Security stays informed about the latest updates to CMMC requirements. Count on our representatives to update you about applicable changes throughout your partnership with us.

CBIZ Pivot Point Security offers full-service CMMC compliance support and will introduce you to an in-house expert with experience navigating standards for your current tier. We can also prepare you for what is ahead should you anticipate securing more sensitive contracts.

A C3PAO is a service provider organization that the CMMC Accreditation Body (CMMC-AB) has accredited and authorized to conduct CMMC assessments and submits findings and certify that Organizations Seeking Certification (OSCs) comply with the CMMC 2.0 maturity level (1 through 3) to perform in a given Aerospace & Defense (A&D) contract.

The Certified CMMC Assessors (CCAs), that will lead the assessment teams, and Certified CMMC Professionals (CCPs) that will be authorized to participate in assessment teams tasked to conduct CMMC assessment services must each be aligned (as a 1099 contractor or employee) with a C3PAO.

If your organization needs to achieve CMMC 2.0 certification via a third-party assessment, you will contract with a C3PAO to manage your assessment process. The CMMC Marketplace will be “the authorized training, credentialing and accreditation ecosystem” for researching potential C3PAOs, as only the CMMC-AB can license C3PAOs.

Back in June 2020, the CMMC-AB opened registration for organizations wishing to become C3PAOs. However, as of November 2021, there are only five officially accredited C3PAOs, per the CMMC-AB Marketplace. Additionally, as part of CMMC 2.0 the CMMC-AB itself, along with all C3PAOs and the to-be-created CMMC Assessors and Instructors Certification Organization (CAICO), must all achieve compliance with the ISO 17011 “conformity assessment” standard before any more C3PAOs can be accredited.

According to the Office of the Under Secretary of Defense for Acquisition and Sustainment’s CMMC FAQ page, “The CMMC assessment costs will depend upon several factors to include the CMMC level, the complexity of the DIB company’s network, and other market forces.” As a baseline, former CMMC point person Katie Arrington originally estimated that the cost for a CMMC Level 1 certification audit would be in the $3,000 to $5,000 range. In initial proposals from some of the first C3PAOs to be accredited regarding CMMC v1, we saw $50,000 to $90,000 proposals dependent upon the size of the organization, number of locations, and number of System Security Plans. CMMC 2.0 Level 2 certification audit costs will hopefully be lower than those estimates due to: 1) fewer controls to certify; 2) elimination of the confusing “maturity processes”; and 3) reduced emphasis on procedural documentation.

Another cost factor could be “supply and demand” for available auditors. Thus, getting ready for CMMC 2.0 certification sooner rather than later could help you save money.

Keep in mind also that C3PAOs will need to recoup their costs, which per CMMC-AB guidelines will include expenses to certify their own security postures to at least CMMC 2.0 Level 2, plus achieving ISO 17021 certification, plus paying various CMMC-AB fees and also paying their Certified Assessors, who can be hourly contractors or employees with benefits. In short, before conducting a single audit, each C3PAO will likely have invested $20,000 to $150,000 or more.

Becoming a C3PAO means your business is certified to employ Certified CMMC Assessors (CCAs) to perform CMMC assessments and Certified CMMC Practitioners (CCPs) to be part of an assessment team, led by a CCA. The first hurdle is your business must be 100% US Citizen owned. Some other requirements include purchasing appropriate insurances (including Cyber Liability Insurance), undergoing an organizational background check, having an active DUNS, CAGE, and SAM.gov account, passing individual background checks leading to the issuance of a U.S. Secret security clearance, “maintaining an association” with at least one RP, CCP, PA or CCA, signing the C3PAO license agreement and paying the activation fees ($3,000 for the first year).

In addition, potential C3PAOs will need to prove compliance with CMMC 2.0 Level 2 or above, to validate their ability to safeguard Controlled Unclassified Information (CUI) and perform audits at the appropriate CMMC Level. C3PAOs must also achieve ISO 17011 certification before they can be accredited.

Prior to scheduling a formal assessment with a C3PAO, OSCs need to prepare for their assessments. The major steps include documentation and institutionalization of the CMMC 2.0 practices. For those handling CUI, policies must be up to date, processes must enforce the policy, procedures must be performed at the frequency stated within the policy and/or processes, and objective evidence must be collected in advance for an adequate period to validate that your organization meets the required CMMC 2.0 level.

Are you looking to get a head start on CMMC 2.0 compliance by performing a “gap analysis” to identify where you stand today and prioritize next steps? As one of the first Registered Provider Organizations (RPOs), CBIZ Pivot Point Security offers a full range of CMMC compliance services, led by appropriately trained and certified experts. Contact us here to find out how we can help.

A CMMC gap analysis helps you measure your current state of NIST 800-171 conformance, assesses the effectiveness of your existing controls, and then pinpoints where your business is not yet fully compliant with CMMC Level 3 and DFARS requirements. For example, you could come up short in areas like:

• Weak access controls (e.g., no multifactor authentication)
• Improper data storage and/or backup controls
• Lack of an incident response plan
• Insecure storage for data records
• Insufficient network segmentation
• Inadequate cybersecurity awareness training for admins or business users
• Lack of meaningful and objective evidence for some or all of the practices and required controls

The gap analysis results will drive your compliance roadmap or remediation plan. If you don’t do a thorough gap analysis, you won’t know for sure what changes you need to make before scheduling a CMMC assessment with a C3PAO. The CMMC assessment is not a checklist; it is designed to validate OSCs are protecting their CUI in accordance with the U.S. Government’s expectations and your contractual obligations.  And the outcome of the assessment is not something you want to leave in doubt! (or up to chance).

A CMMC gap analysis will tell you exactly what controls you need to implement, extend or modify to comply with CMMC at your required level, along with recommendations for how best to approach mitigating the issues in your environment.

Some of the benefits of having this information include:

• You will be aware of how close you are to full compliance with NIST 800-171, which is very similar to CMMC Level 3. If you have a DFARS 7012 clause in your current contract, the DoD may ask you to demonstrate NIST 800-171 compliance at any time.
• You will have greater assurance that you can achieve CMMC compliance in your required timeline.
• Your team will gain familiarity with an assessment process and the artifacts involved.
• You will have more “proof” to assure stakeholders that you can keep their sensitive data safe.
• You will get a jump on CMMC budget planning, which among other things could help you position your compliance efforts as an “allowable cost” that the DoD will reimburse.
• You will get a head start on CMMC compliance, which could better position you to get new contracts.

If you are providing products and services within the DIB, you want to be CMMC ready as soon as possible.

Here are some of the steps you can take now to get ready for CMMC:

• Understand the technical requirements for the CMMC level you will need to comply with. For example, if you will handle CUI you need to attain at least CMMC Level 3, which has about 20 more controls than NIST 800-171.
• Begin due diligence and start making connections with security vendors and service providers, if you will need third-party expertise/support to achieve CMMC certification.
• Check out the NIST 800-171 and/or CMMC compliance status of critical services like email/file sharing or cloud services that you are currently using or might use soon.
• Draft, build, mature your SSP. Begin documenting your cybersecurity policies, procedures, etc. if you know you will be handling CUI. (CMMC Level 3 requires documentation of controls; CMMC Level 1 does not.)
• Start scheduling your CMMC planning, resourcing the required tools and talents to maintain these, budget and documenting costs that hopefully the DoD will reimburse.
• Stay current with news and updates on the CMMC rollout.