In 2019 the Inspector General of the U.S. The Department of Defense released a report titled “Audit of Protection of DoD Controlled Unclassified Information on Contractor-Owned Networks and Systems”. The report was the result of an audit of DoD subcontractors and their implementation of the NIST SP 800-171 framework of security controls. CMMC draws many of its security requirements from NIST SP 800-171.

Here are the top deficiencies identified in the report:

• Using multi-factor authentication;
• Enforcing the use of strong passwords;
• Identifying network and system vulnerabilities;
• Mitigating network and system vulnerabilities;
• Protecting CUI stored on removable media;
• Overseeing network and boundary protection services provided by a third-party company;
• Documenting and tracking cybersecurity incidents;
• Configuring user accounts to lock automatically after extended periods and unsuccessful logon attempts;
• Implementing physical security controls;
• Creating and reviewing system activity reports;
• Granting system access based on the user’s assigned duties.

We developed an application to help contractors meet their new CMMC requirements. Through the application, our cybersecurity team conducts a gap analysis for you. Using the results of the gap analysis we create a project plan specifying how to implement your absent CMMC practices. The entire process is self-paced. If you would like to learn more, reach out to us for a demo.

As of yet, non-DoD contracts do not require CMMC. There has been talk that the rest of the federal government may adopt it in the coming years.