ISO 27001 greatly reduces effort in CMMC 2.0 Level 2 compliance
KLC Consulting‘s guide to Map ISO 27001 to CMMC
If you have an ISO 27001 certification, it doesn’t mean you are compliant with CMMC 2.0 Level 2. But you can map ISO 27001 to CMMC and obtain CMMC compliance in less time and with less effort. This gives you a competitive advantage in the DoD contract award process. Many defense contractors are challenged with CMMC compliance. The 800-pound gorilla in the room is that CMMC requires identifying the CUI that you handle, segregating it from your other information and creating a secure environment for it. Let’s take a deeper dive below and learn six steps to evaluating CMMC compliance using ISO 27001 certification.
CMMC 2.0 doesn’t directly map to ISO 27001: CMMC 2.0 Model Appendix A provides source mapping; however, it does not directly map to ISO 27001. To map ISO 27001 to CMMC practices, look to the NIST SP 800-171 R2 Appendix D, because CMMC 2.0 is based on NIST 800-171.
CMMC 2.0 does map to ISO 27001 through NIST 800-171: NIST 800-171 Appendix D lists the NIST 800-171 to ISO 27001 control mapping. If you already have an ISO 27001 certification for your organization, you can use this 6-Step Guide to CMMC Compliance by using your ISO 27001 Certification. If you’d like some guidance with this, read more here.
A 6-Step Guide to Map ISO 27001 to CMMC:
1. On the ISO side:
Review your ISO 27001 certification’s Statement of Applicability (SoA) to understand your scope and controls that have been certified.
- Systems
- Facilities
- Business units
- People
- Processes
2. On the CMMC side:
Define your CMMC scope: Identify the CUI data that flows through your environment. Inventory the systems, hardware, and software that are in-scope.
- Systems
- Facilities
- Business units
- People
- Processes
3. Identify the difference between your CMMC and ISO 27001 scope. Document them as gaps (POA&M items).
4. Use NIST 800-171 R2 Appendix D as a guide to map your certified ISO 27001 controls to the NIST 800-171 (CMMC) controls.
5. Identify the CMMC controls and control objectives that do not directly map to ISO 27001 controls. List them as gaps (POA&M items).
6. Develop a plan of action to remediate the POA&M items.
ISO 27001 can be used as the primary guidance for meeting an organizations’ CMMC information security requirements. ISO 27001 shares consistency with CMMC 2.0 Level 2 requirements. Your ISO 20071 certification provides assurance to your customers, partners, and suppliers that your information technology processes are secure. IT security is an essential business requirement to ensure stability and success in any organization.
No matter where you are in the process, it is well worth the effort to be compliant with CMMC 2.0 level 2. Are you ready yet? For questions about our strategy to map ISO 27001 to CMMC, or other questions about CMMC and NIST 800-171, please contact us. We look forward to talking with you.
Check out our latest CMMC resource…
“CMMC with Microsoft Azure by Kyle Lai”
