By Rob Wayt, Structured GRC Director, CISSP-ISSEP (#309964), CMMC-AB RP, QSA, CISA, CISM, CRISC, CEH, HCISPP —

The Cybersecurity Maturity Model Certification (CMMC) Final Rule will take effect on December 16, 2024. For defense contractors – both primes and subs — this represents a major shift in cybersecurity compliance requirements, as the Department of Defense (DOD) seeks to fortify the Defense Industrial Base (DIB) against ever-evolving cyber threats.

This also means the long wait for this rule to take effect is over…kind of. According to the DOD, the CMMC requirements will be implemented in four phases over three years:

Phase 1: Begins in concurrence with a complementary 48 CFR Rule effective date, which is expected in Q1 of 2025. Where applicable, Phase 1 requires contractors to meet Level 1 or 2 self-assessment requirements as a condition of contract.

Phase 2: Begins 1 year after Phase 1 starts. Where applicable, Phase 2 requires contractors to meet Level 2 certification requirements (assessment from a C3PAO) as a condition of contract.

Phase 3: Begins 2 years after Phase 1 starts. Where applicable, Phase 3 requires contractors to meet Level 3 certification requirements (assessment by the DIBCAC) as a condition of contract.

Phase 4: Begins 3 years after Phase 1 starts. Full implementation – all contracts will include applicable CMMC Level requirements as a condition of contract award.

By all expert analysis, CMMC’s impact will be significant. The DOD estimates that nearly 8,400 mid-size to large contractors will be required to meet CMMC Level 2 C3PAO assessment requirements as a condition of contract award. The department may also decide to require compliance in advance of the phased timeline, although this may leave room for bilateral contract modifications.

Further, companies that rely heavily on government contracts with the DOD may want to prepare early to avoid issues with the availability of third-party assessors. The phased approach is meant to provide time for assessor training, but demand is expected to outstrip supply in the near term.

Finally, CMMC certification is not a one-time effort; contractors will be subject to periodic audits and must maintain compliance to remain eligible for DOD contracts. With noncompliance now likely to result in contract penalties or loss, the stakes for cybersecurity have never been higher.

But while compliance will undoubtedly take work, it is not out of reach. To get started, here’s a handy five-section guide to help you navigate this essential compliance landscape.

1. Understanding the Scope and Goals of the Final Rule

The CMMC Final Rule formalizes cybersecurity standards for contractors within the DIB. Its primary goal is to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) through a tiered maturity model that measures a company’s cybersecurity practices and capabilities. This updated model provides clearer, more achievable paths for contractors to meet varying levels of security, depending on the sensitivity of the information they handle.

The Final Rule reinforces the DOD’s commitment to bolstering national security through higher security requirements across the supply chain. It signifies that cybersecurity isn’t just an IT issue anymore but a core component of contractor eligibility and performance.

2. The CMMC Levels: What They Mean for Contractors

The CMMC model is organized into three certification levels, each representing a distinct set of cybersecurity capabilities:

• Level 1: Focuses on basic safeguarding of FCI, covering fundamental cybersecurity hygiene and 15 requirements.
• Level 2: Applies to contractors handling CUI and aligns closely with NIST SP 800-171 requirements, with 110 requirements to provide more robust protection.
• Level 3: Designed for critical national security priorities, Level 3 includes additional security requirements based on a subset of NIST SP 800-172, covering advanced protection measures for the most sensitive information.

Each level builds upon the previous one, and organizations are required to achieve the level corresponding to the type of information they will handle under DOD contracts. Most contractors will likely need to reach Level 1 or 2 compliance, with Level 3 reserved for highly sensitive, mission-critical work.

3. Prepare for Assessment: Key Steps for Compliance

To meet CMMC requirements effectively, contractors should take the following steps:

• Documentation and Policy Development: CMMC certification requires extensive documentation of the System Security Plan, cybersecurity policies, procedures, and workflows. Having these materials ready for assessors is crucial.
• Internal Training: Educate your team on CMMC requirements and cybersecurity best practices. Empowering employees to play an active role in security can be invaluable for compliance.
• Gap Analysis: Conduct a comprehensive review of your current cybersecurity posture. This will help identify areas where existing practices fall short of the required CMMC level.
• Engage with a Trusted RPO: Partnering with a Registered Practitioner Organization™ (RPO) listed on The Cyber AB Marketplace provides you with experienced guidance on aligning your security controls with CMMC standards.

4. Leverage Expertise from a Registered Practitioner Organization (RPO) – like Structured!

As an RPO listed on The Cyber AB’s Marketplace, Structured is positioned to help you assess your organization’s readiness for the certification process. We provide critical support to contractors navigating the CMMC journey.

Here’s how Structured can help:

• CMMC Readiness Assessments: We evaluate your readiness for CMMC certification and identify specific areas for improvement.
• Remediation Planning: We assist in developing and implementing a remediation plan, addressing each gap in your cybersecurity program.
• Ongoing Compliance Support: We offer continuous support to help your organization maintain compliance between certifications, ensuring readiness for future assessments.
• Penetration Testing: We rigorously test the external infrastructure, internal network environment, applications, and end users for susceptibility to exploitation by threats to known and unknown vulnerabilities.

Working with an RPO enables contractors to stay ahead of evolving requirements while ensuring compliance is achieved efficiently and effectively. The process of preparing for CMMC certification can be complex, but partnering with a knowledgeable RPO can simplify and streamline the path to compliance.

5. Next Steps for Contractors in the Defense Industrial Base

Now is the time to develop your CMMC compliance strategy. Here’s what to consider:

• Determine Your Required CMMC Level: Assess the types of information you handle and determine the level of CMMC certification required for your contracts.
• Budget for Certification Costs: The Final Rule will have cost implications, so ensure your budget accommodates CMMC compliance.
• Start Now: CMMC certification can take months to achieve. Starting early provides time to address gaps and refine your practices before deadlines.

Closing Thoughts on the CMMC Final Rule

The CMMC Final Rule is a pivotal development for the DIB, one that will ultimately enhance national security by improving cyber resilience across the DOD supply chain. Contractors who proactively adopt these standards will position themselves as trusted, reliable partners for DOD contracts in the future.

By working with an RPO, defense contractors can gain the expertise, guidance, and strategic insights needed to navigate the path to certification and maintain a strong, compliant cybersecurity posture.

Are you prepared for CMMC compliance? Our team is here to support you. Contact your Structured account manager or email info@structured.com to learn more about how we can help your organization achieve and maintain CMMC certification, ensuring your place in the future of national defense.