Can You Self-Certify CMMC? 

Understanding the Path to Compliance

As organizations within the Defense Industrial Base (DIB) strive to meet the cybersecurity standards set by the Cybersecurity Maturity Model Certification (CMMC), a common question arises: Can you self-certify CMMC? This post explores the certification process, the possibility of self-certification, and the steps necessary to achieve CMMC compliance.

The CMMC Proposed Rule has specific certification requirements for the three different CMMC Levels

CMMC Level 1: Self-Assessment 

For CMMC Level 1, which focuses on basic cyber hygiene and protecting Federal Contract Information (FCI), the DoD allows self-assessment. Organizations at this level can perform self-assessments and enter results in the DoD’s Supplier Performance Risk System (SPRS). Here’s why and how this works:

  • Basic Cyber Hygiene: CMMC Level 1 includes 17 basic practices aimed at safeguarding FCI. These practices are relatively straightforward and fundamental, such as implementing access controls and ensuring secure data handling.
  • Self-Assessment Process: Organizations seeking Level 1 compliance can conduct a self-assessment and submit their results through the SPRS. This involves evaluating their own cybersecurity practices against the 17 required practices and certifying their compliance.
  • No POA&M Allowed:  No Plan Of Action & Milestones is allowed for CMMC Level 1. Full implementation of CMMC Level 1’s 17 practices is required.
  • Annual Self-Affirmation: Companies must annually self-attest their compliance with Level 1 requirements. This helps ensure ongoing adherence to basic cybersecurity practices.

CMMC Level 2:  Self-Assessment Only During 1st 6 Months

  • Phase 1  – CMMC Commences: Effective on the date of CMMC Commencement, CMMC Level 2 will require Self-Assessment for the 1st 6 months.
  • Phase 2 – (after Month 6):  Requires independent Assessment and Certification from a C3PAO on new contracts.
  • Phase 3 – (after Month 18):  Requires independent Assessment and Certification from a C3PAO on contracts and options in effect before CMMC commences.
  • Phase 4 – (after Month 30):  Full Implementation, CMMC is mandatory for all DoD contracts.

CMMC Level 3 

  • Phase 1  – CMMC Commences: Not Applicable.
  • Phase 2 – (after Month 6):  Not applicable
  • Phase 3 – (after Month 18):  Requires independent Assessment and Certification from a C3PAO plus an additional certification by DIBCAC for additional security practices of NIST 800-172
  • Phase 4 – (after Month 30):  Full Implementation, CMMC is mandatory for all DoD contracts.

Why Higher Levels Require Formal Assessments:

  • Failure of Self-Assessment Model:  to protect sensitive information.  Most of the 221,286 DIB companies are in the Small-Medium-Business size category and lack the expertise to properly implement CMMC security practices.
  • Continued Theft of Sensitive Information: Our geopolitical adversaries steal our FCI and CUI to aggregate it and reverse-engineer our classified systems. Higher levels of CMMC involve more complex and stringent requirements that necessitate a thorough and independent evaluation to ensure all controls are effectively implemented and maintained.
  • Enhanced Security Needs: As the levels increase, so does the need for robust cybersecurity measures to protect Controlled Unclassified Information (CUI) and other sensitive data. Independent assessments by C3PAOs ensure these critical security requirements are met.
  • Objective Verification: Formal assessments by C3PAOs provide an objective and unbiased evaluation of an organization’s cybersecurity posture, ensuring consistency and reliability across the defense industrial base.

The Role of C3PAOs for Higher Levels:

For organizations seeking CMMC Levels 2 and above, engaging with a C3PAO is required. These organizations are responsible for:

  • Conducting Thorough Evaluations: C3PAOs perform detailed assessments of an organization’s cybersecurity practices, ensuring compliance with the specific CMMC level.
  • Providing Expert Guidance: They offer advice and recommendations to help organizations address any identified gaps and achieve compliance.
  • Ensuring Robust Compliance: C3PAOs verify that all necessary controls and documentation are in place and functioning effectively, providing confidence in the organization’s cybersecurity posture.

By requiring formal assessments for higher levels, the DoD aims to maintain the integrity and robustness of the CMMC framework, ensuring all organizations handling sensitive information are adequately protected against cybersecurity threats.

In conclusion, while CMMC Level 1 allows for self-certification, higher levels require formal assessments by C3PAOs to ensure rigorous and consistent cybersecurity standards are met. This approach helps safeguard sensitive information and maintain trust within the defense industrial base.

The Compliance – Certification Process

CUI Scoping: Identifying the CUI you handle and where it touches your people, processes, technology, and facilities and Segregate it from your other information, and minimizing its footprint to reduce your cost of compliance

NIST 800-171 Self Assessment: Evaluate your compliance with the 320 Assessment Objectives that inform the 110 Security Practices of NIST 800-171, the cybersecurity standard of CMMC.

Submit Self Assessment Results to the SPRS: Submit your summary level information including your score to the DoD’s SPRS website.

Remediate POA&M: Develop your System Security Plan with Policies, Procedures, & Supporting Artifacts

Verify Readiness with an authorized C3PAO: Ensure readiness with a practice run Mock Assessment and Stay informed about the latest cybersecurity threats and best practices.

Key Benefits of Formal Certification

Competitive Advantage

Organizations that achieve early CMMC certification can market themselves as secure and compliant partners within the defense industry. This competitive edge can lead to increased business opportunities and stronger relationships with the DoD and Prime Customers..

Improved Trust and Credibility

Certification demonstrates your commitment to cybersecurity and compliance, building trust with clients, partners, and regulators. A certified status indicates that your organization adheres to the highest security standards, enhancing your reputation as a reliable and secure partner.

For more information on achieving CMMC certification and ensuring compliance, contact us today.

Scroll to Top