The Anatomy of a CMMC Assessment: What to Expect
CMMC is a highly technical assessment process and differs significantly from traditional ISO that’s designed to ensure that the DIB is secure against sophisticated cyber threats. Learn more from the certification experts at PJR.
CMMC is a highly technical assessment process. It differs significantly from traditional ISO certifications because it requires a rigorous, standardized methodology designed to ensure that the Defense Industrial Base (DIB) is secure against sophisticated cyber threat actors.
The Assessment Team Structure
Every CMMC assessment must be performed by a C3PAO (Certified Third-Party Assessment Organization) using a specific team structure:
- Two Certified Assessors: A minimum of two assessors must be on-site or virtually present to evaluate the organization.
- A Quality Assurance (QA) Assessor: A third, independent certified assessor is required to review the assessment process after completion. This ensures that the documentation follows the CyberAB’s procedures and is ready for upload into the DoD’s eMASS system.
On-Site vs. Virtual Requirements
While much of the documentation review and technical analysis can be performed virtually, a “table-top” review is rarely enough. Assessors will typically spend time on-site to verify physical controls, such as physical security of server rooms and document storage, hardware controls (including the management of removable media/USBs), and the actual use of printing and scanning devices.
The Sub-Control Trap
A common reason for challenges during the assessment is an insufficient System Security Plan (SSP). If a company only lists the 110 high-level NIST 800-171 controls versus the 320 objectives, their chance of success is greatly diminished.
Assessors look for detailed evidence for every sub-component of those controls (e.g., the six sub-components of control 3.1.1). Organizations must be able to prove, with specific evidence, that each sub-control is implemented and consistently followed.
Avoiding this pitfall is much easier when a mock assessment is done prior to the formal assessment.
Contact PJR today at (248) 422-3013 or email pjr@pjr.com to receive a free quote and learn how to properly secure your place in the Defense Industrial Base.