CMMC for Engineering Firms: We help you determine where you’re at in CMMC. And bring you all the way to “Assessment Ready” through flexible consulting services and today’s best CMMC technology solutions.
Do You Handle CUI?
Don’t assume CMMC for Engineering Firms applies just because you received one of the many compliance form letters sent out by your prime customers. The DoD created exceptions, and if you don’t handle CUI, you only need a CMMC 2.0 Level 1 compliance program.
However, if you do handle CUI, we provide consulting services to navigate you through the compliance process.
CMMC For Engineering Firms Who Handle CUI
Background
$600 billion dollars or about 1% of global gross domestic product each year is lost through cyber theft. Adversaries know that in today’s great power competition environment, information and technology are both key cornerstones and — and attacking a sub-tier supplier is far more appealing than a prime.
Source: defense.gov
Because there are fewer controls over CUI as compared to classified information, CUI is the path of least resistance for our geopolitical adversaries. Moreover the Loss of aggregated CUI is one of the most significant risks to national security, directly affecting the lethality of our warfighters.
Cybersecurity Regulatory Compliance Phase-In
December 31, 2017
The U.S. DoD requires Defense Industrial Base companies to provide “reasonable security” for Covered Defense Information, including CUI via DFARS 252.204-7012. And many small-medium size engineering companies are slow to implement due to a lack of resources and technical expertise.
November 30, 2020
Compliance enforcement strengthens. Interim rules (DFARS 252.204 -7019 & -7020) requires a submission of NIST 800-171 self-assessment results into the DoD’s Supplier Performance Risk System (SPRS). And the SPRS enables DoD contract officials to consider a company’s self-assessment score (or failure to report it) in their contract award process.
Prime contractors seek confirmation from their engineering firm subs about their compliance progress and status of their SPRS submission due to compliance flow down requirements.
DFARS 252.204-7021 ushers in CMMC (Cybersecurity Maturity Model Certification). And CMMC requires independent certification by an authorized C3PAO company.
November 04, 2021
The DoD releases CMMC 2.0 to simplify the CMMC standard while still safeguarding sensitive information. The previous 5 CMMC maturity levels are reduced to 3 and the number of controls is reduced to align with NIST 800-171.
What’s Next?
Determine if you handle CUI
We look to your DoD contracts to determine if you handle Controlled Unclassified Information (CUI). If you don’t handle CUI, your DoD contract information is Federal Contract Information (FCI). You’ll only need CMMC Level 1.
Ok, you handle CUI
Your goal is to differentiate CUI from all other information you handle, segregate it into a dedicated and secure environment, and minimize its footprint. We ascertain the nature and category of your CUI through a review with the DoD’s CUI Registry. And we scope CUI within your business organization using our proprietary Data Lifecycle approach to reduce compliance effort and cost.
We offer a CUI Scoping service to begin your CMMC 2.0 compliance program.
Your progression from NIST 800-171 to CMMC
DFARS 252.204-7012, -7019, and -7020 require you to perform a NIST 800-171 self-assessment, submit summary-level score with POAM information to the DoD’s SPRS web portal, and remediate POAM deficiencies in pursuit of DFARS 252.204-7021 CMMC 2.0 Level 2 compliance.
SPRS DoD
Have you made your SPRS submission?
If you haven’t made your SPRS submission, we offer an affordable consulting package with a 30-day turnaround time.
CMMC Consulting
Have a low SPRS score? You’re not alone. Let us help you remediate NIST 800-171 POAM deficiencies and develop a CMMC 2.0 Level 2 compliance program just for you.
Gap Assessment
Want to confirm you’re ready for CMMC 2.0 assessment by a C3PAO? KLC Consulting evaluates readiness by simulating an independent C3PAO assessment.
CMMC for Engineering Firms: Challenges We Solve
- Compliance knowledge and ability to remediate POAM deficiencies is low among IT and management staff
- Employee training:
- Uncertainty about CUI
- Acceptable ways of receiving and sharing CUI
- The CUI you create in your design process
- CUI marking and labeling
- CUI is in both electronic and physical forms, so your compliance program must address both
- Your CUI proliferates across more departments and systems than is needed to perform DoD contract work; complicating compliance and needlessly increasing CMMC program cost
- Coordinating remediation and compliance activities with your MSP/MSSP
- Uncertainty about flow down compliance requirements to subcontractors
- Incident response planning & reporting (DFARS 252.204-7012)
- Incident response plan testing (tabletop exercise)
- Penetration testing/vulnerability testing
- Security and compliance requirements for engineering software, file storage of Covered Defense Information (CDI), and Controlled Technical Information (CTI), including:
- Engineering drawings and data
- Specifications
- Technical reports
- Process sheets
- Data sets
- Uncertainty responding to cybersecurity and compliance-related questions from:
- DoD agencies
- Prime contractors
- Subcontractors
- Cybersecurity insurers
Secure Your CMMC
C3PAO Assessment
Don’t Get Left on the Ground. With limited C3PAOs and a growing number of DIB companies requiring CMMC Level 2 certification, securing your assessment spot is crucial. Reserve your assessment with KLC Consulting today and avoid delays.
