Receive CohnReznick insights and event invitations on topics relevant to your business and role.
11/02/2023
Cybersecurity Maturity Model Certification (CMMC): A road map to compliance
With the Department of Defense finalizing its plans to start incorporating CMMC requirements into its RFIs and RFPs (requests for information/proposals), many contractors may still be uncertain where to begin. We’ve got you covered.
Use our high-level road map to help get you started on your journey toward compliance.
1. Confirm your scope includes Controlled Unclassified Information (CUI) and thus seeking CMMC level 2 status.
2. Review the CMMC framework to understand the practices and processes your organization will need to meet Level 2 maturity requirements.
3. Conduct a preparedness assessment – work with a third party or with your team to identify technical gaps in existing vs. required practices.
4. Develop and implement practices that are found to be non-existent (or fixes for those determined to be partially implemented) based on the results of the assessment.
5. Deploy technical solutions where needed.
6. Remediate other process gaps as identified in the preparedness assessment.
7. If the organization’s SPRS score is greater than 85, identify/select a CMMC Third-Party Assessor Organization (C3PAO) firm for your CMMC audit.
8. Obtain your desired CMMC level maturity certification based on the audit.
Subject matter expertise
Bhavesh Vadhani
CISA, CRISC, CGEIT, PMP, CDPSE, Principal, Global Leader, Cybersecurity, Technology Risk, and Privacy
Kristen Soles
CPA, Partner - Managing Partner, Advisory - Global Consulting Solutions and Government Contracting Industry Leader
Close
Contact
Let’s start a conversation about your company’s strategic goals and vision for the future.
Please fill all required fields*
Please verify your information and check to see if all require fields have been filled in.
Access Our Resources for Cybersecurity Maturity Model Certification (CMMC)
Related services
This has been prepared for information purposes and general guidance only and does not constitute legal or professional advice. You should not act upon the information contained in this publication without obtaining specific professional advice. No representation or warranty (express or implied) is made as to the accuracy or completeness of the information contained in this publication, and CohnReznick LLP, its partners, employees and agents accept no liability, and disclaim all responsibility, for the consequences of you or anyone else acting, or refraining to act, in reliance on the information contained in this publication or for any decision based on it.