For higher education and research institutions working with the Department of Defense (DoD), achieving Cybersecurity Maturity Model Certification (CMMC) compliance can raise a range of practical and technical questions. From training requirements and documentation management to readiness assessments and certification preparation, organizations often face many of the same challenges as they navigate the process. This FAQ addresses some of the most common questions higher education institutions ask about CMMC and provides guidance to help support their compliance and certification efforts.  

Does the CMMC Phase II suspension mean higher education institutions can pause their compliance efforts? 

No. While the DoD (also known as Department of War [DoW]) has suspended Phase II third-party certification requirements during its review, institutions supporting DoD-funded research remain responsible for protecting Controlled Unclassified Information (CUI), Federal Contract Information (FCI), and meeting applicable contract requirements. Existing cybersecurity obligations under DFARS and related federal requirements remain in effect. 

What are the main components of CMMC training?  

There are two components of CMMC training, and an organization seeking certification (OSC) needs to be aware of both.  First is DoD-provided controlled unclassified information (CUI) training (Opens a new window) and Insider Threat Training (Opens a new window). As an OSC, you must require those with access (employees, vendors, contractors, etc.) to take both annually and track that they have. 

The second component is your organization’s own unique training, comprising rules and guidance around CMMC.  While each org is unique, common examples include: where you store CUI, who you contact for questions about CMMC, organizational CMMC requirements, and what to do if you encounter CUI where it isn’t allowed. Again, everyone with access must take the training, at least annually, and the organization must keep a record of who completes it.

Where can I find CMMC training courses online?  

There are many online options for CMMC training, but it's important to choose training that aligns with your role and objectives.

For general CMMC awareness and compliance education, organizations can find a variety of reputable training providers and educational resources. However, individuals pursuing professional CMMC credentials, such as Registered Practitioner (RP), Certified CMMC Professional (CCP), or Certified CMMC Assessor (CCA), should follow the official training and certification pathway administered through the CMMC Assessor and Instructor Certification Organization (CAICO). ISACA serves as the CAICO and oversees the training, examinations, and credentialing process for the CMMC ecosystem.

Approved training providers deliver the authorized curriculum used for these certifications. Before enrolling, organizations and individuals should confirm that any certification-focused training comes from an approved source and aligns with their intended role within the CMMC program.

What tools help manage CMMC documentation and evidence?  

The first thing to keep in mind is that under CMMC, there is no specific tool required to manage CMMC documents; using a tool is optional.  However, many OSCs find tools to be invaluable in helping them organize their documents and evidence.  CohnReznick is tool-agnostic, but we have helped many organizations successfully prepare for, and pass, CMMC certification using a variety of tools. 

The common trait of useful tools is organization, which can be achieved through a well-structured system, such as a carefully managed network drive. Consider whether the approach allows you to quickly locate required policies, procedures, and supporting evidence, while also maintaining visibility into document review cycles and the ongoing collection of required evidence.

At its core, CMMC is about having both situational awareness and operational awareness.  Beneficial tools help you achieve both. Lastly, keep in mind that if your tool will interact, process, or store CUI (very likely), it needs to meet CMMC requirements.

How can I find a CMMC readiness assessment provider? 

There are many companies you can choose from, and CMMC itself does not require organizations to engage a formal “CMMC Readiness Provider.”  The Cyber AB Marketplace lists Registered Provider Organizations (RPO), which means they have passed the Cyber AB’s requirements and agreed to meet its ethical standards.  CohnReznick recommends you use an RPO that is also a C3PAO provider (as we are) for a key reason: bringing real-world expertise to your readiness prep.  For example, when CohnReznick conducts a pre-certification CMMC assessment as part of readiness preparation, we use our Lead Certified CMMC Assessors (LCCAs), the same professionals who perform C3PAO assessments.

Working with a provider that offers this level of hands-on expertise, rather than purely theoretical knowledge, positions organizations for a more successful first-time certification outcome. As a C3PAO ourselves, we have also undergone the assessment process, giving us firsthand insight into both sides of the evaluation. We leverage that experience to guide our clients effectively.

Which companies provide CMMC compliance consulting services?

Please see above.

How do I prepare my small business for CMMC audits? 

The simple answer is to meet all 110 controls and the 320 objectives found in the DoD CMMC L2 Assessment Guide (Opens a new window). In practice, this means that the OSC knows where CUI flows within all its business processes.  From there, you must protect the CUI by implementing the requirements.  This includes having policies and procedures, evidence, and a System Security Plan (SSP).  While some OSCs can move their business processes to an enclave (e.g., Microsoft GCCH, AWS GovCloud, etc.), others can’t. CMMC itself doesn’t require a particular environment, just that it meets all the requirements.  Defining your scope (i.e., the CMMC Boundary) is critical to your certification.  If you aren’t familiar with how this is done, an RPO is a great place to get help.  It’s important to note that you are not required to use an RPO; you may prepare on your own.

What is the purpose of CMMC certification?

The purpose is to provide third-party (independent) assurance to the DoD that CUI is being properly protected.  It is the DoD’s data, and the department requires that the protections are in place to use it.

What are the key requirements for achieving CMMC Level 3 (L3) certification?

First, it is important to note that the majority of OSCs will not need L3, and those that do will have contracts that clearly spell this out.  If you deal with Navy nuclear information, for example, you may be required to get a CMMC L3 certification. 

To obtain your CMMC L3, you must first follow the process and be granted a CMMC L2.  Once you have the L2, you can be assessed for an L3 certification.  Just as for L2, the DoD has published a CMMC L3 Assessment Guide (PDF) (Opens a new window).  This will walk you through all the requirements in detail.  To receive your CMMC L3, you will be assessed by Defense Industrial Base Cybersecurity Assessment Center (Opens a new window) (DIBCAC), which is part of DCMA.

How do I prepare a college for CMMC certification?

While preparing a college or other Higher Ed institution follows the same process, they tend to have unique challenges.  Grants, research, and other work may occur in a decentralized model.  This means the institution may be unaware it has CUI and needs to meet CMMC. Or, even if it is aware, it may not understand where CUI is, who has access, and why.  Gathering this information is critical to these institutions’ CMMC success.

Which consulting firms specialize in CMMC readiness for higher education?

CohnReznick has helped several Higher Ed and Research institutions with CMMC readiness and C3PAO certifications.  When evaluating a firm for CMMC advisory assistance, Higher Ed institutions should ask if the firms have experience in the education industry.

If you're interested in learning more about CMMC, compliance readiness, and certification requirements, CohnReznick offers a variety of webinars and educational resources designed to help organizations navigate the evolving cybersecurity landscape. Explore our on-demand CMMC-focused webinars to gain practical insights from our advisors and assessors.

Any advice contained in this communication, including attachments and enclosures, is not intended as a thorough, in-depth analysis of specific issues. Nor is it sufficient to avoid tax-related penalties. This has been prepared for information purposes and general guidance only and does not constitute legal or professional advice. You should not act upon the information contained in this publication without obtaining specific professional advice specific to, among other things, your individual facts, circumstances and jurisdiction. No representation or warranty (express or implied) is made as to the accuracy or completeness of the information contained in this publication, and CohnReznick, its partners, employees and agents accept no liability, and disclaim all responsibility, for the consequences of you or anyone else acting, or refraining to act, in reliance on the information contained in this publication or for any decision based on it.