Consulting and Assessments

A:  Not automatically. The suspension affects the rollout of mandatory Phase II C3PAO requirements, not the underlying obligation to protect CUI and accurately report your implementation of NIST SP 800-171.

Your required remediation timeline depends on the contract terms, the type of assessment, and whether the POA&M is connected to a formal CMMC conditional status. Organizations should continue addressing known deficiencies and ensure that their SSP, POA&M, and SPRS score accurately reflect the current state of their environment. Phase I self-assessment requirements remain in place.

A:  Stopping automatically may create more cost and disruption later. The Phase II suspension changed how compliance may be independently verified, but it didn’t remove the security requirements already included in applicable defense contracts.

DFARS 252.204-7012 continues to require adequate security and implementation of NIST SP 800-171 for covered contractor information systems. Contracting officers also continue to verify that applicable contractors have a current NIST SP 800-171 assessment score in SPRS before award, option exercise, or contract extension.

Review the purpose of your current engagement before deciding. Remediation, CUI scoping, SSP development, evidence collection, and SPRS validation may still be necessary even when an immediate certification assessment is no longer required.

A:  The Phase II suspension isn’t a suspension of the underlying requirement to protect CUI.

The Department has stated that Phase I self-assessment requirements remain in place and that NIST SP 800-171 Rev. 2 compliance will continue to be evaluated through self-assessments and selected government-led assessments.

Applicable contractors still need to:

• protect covered defense information under DFARS 252.204-7012;
• maintain an accurate and current NIST SP 800-171 assessment in SPRS where required;
• keep their SSP, POA&M, scope, and reported score aligned with their actual environment.

Pausing unnecessary certification spending may be reasonable for some organizations. Pausing security implementation, remediation, documentation, or accurate self-assessment is a different decision and may create contract, operational, and cybersecurity risk.

Use the review period to complete known remediation, verify your CUI scope, update your SSP and POA&M, and ensure your SPRS submission remains defensible.

A:  Determining your readiness for a CMMC assessment involves a comprehensive evaluation of your organization’s cybersecurity posture. Here are some key indicators:

• Understanding of CMMC Requirements: You should have a thorough understanding of the specific CMMC requirements applicable to your organization’s size, industry, and data handling practices.
• Implementation of Security Controls: You should have implemented the necessary security controls to meet the CMMC requirements, including access control, incident response, and data protection measures.
• Documentation and Evidence: You should have the necessary documentation and evidence to demonstrate compliance with CMMC standards. This includes policies, procedures, and system configurations.

A:  Failing a CMMC assessment doesn’t mean your organization is doomed. It’s a common occurrence, and many organizations require multiple attempts to achieve compliance. Here’s what you should do if you don’t pass:

• Analyze the Results: Carefully review the assessment report to identify the specific areas where you fell short.
• Develop a Remediation Plan: Create a detailed plan to address the identified gaps and implement the necessary corrective actions.
• Reschedule the Assessment: Once you’ve implemented the necessary changes, you can schedule a follow-up assessment to demonstrate compliance.

A:  Yes, many C3PAOs offer remote assessment services. Remote assessments can be conducted using virtual tools and technologies, reducing the need for on-site visits. However, some aspects of the assessment, such as physical infrastructure reviews, may require on-site presence.

A:  C3PAOs use a rigorous evaluation process to determine if an organization passes a CMMC assessment. This process typically involves:

• Document Review: Examining relevant documentation, such as policies, procedures, and system configurations.
• Interviews: Conducting interviews with key personnel to gather information about your organization’s cybersecurity practices.
• Testing: Conducting tests and assessments to evaluate the effectiveness of your security controls.

Based on these evaluations, the C3PAO will assess your organization’s compliance with the CMMC requirements and determine whether you pass or fail.

In addition to these methods, C3PAOs often rely on an objective evidence list to support their assessment. This list outlines the specific types of evidence required to demonstrate compliance with the CMMC requirements. This evidence can include:

• System configurations: Documentation of system settings and configurations.
• Security controls: Evidence of implemented security controls, such as access control measures, incident response plans, and data protection policies.
• Risk assessments: Documentation of risk assessments and mitigation strategies.
• Training records: Evidence of employee training on cybersecurity best practices.

By reviewing this objective evidence, C3PAOs can verify your organization’s compliance with the CMMC requirements and make an informed determination about your assessment status. Check out our assessors playbook to guide you.