top of page
.png){kind=logo}
Cybersecurity Maturity Model Certification (CMMC)
Achieving Cybersecurity Maturity Model Certification (CMMC) compliance challenges even the most seasoned organizations. The requirements are complex, necessitating a significant amount of time, money, and resources to unpack, understand, and implement.
However, to work with the Department of Defense (DoD) in any capacity, all prime contractors and subcontractors must obtain the proper level of certification, which entails the satisfactory implementation of specific NIST Special Publication (SP) 800-171 and 800-172 controls:
CMMC Controls by Maturity Level
Level 3: Expert
110 NIST SP 800-171 Controls + up to 35 NIST SP 800-172 Controls
Level 2: Advanced
110 NIST SP 800-171 Controls
Level 1: Foundational
17 NIST SP 800-171 controls
Which level an organization must comply with is determined by the type of information it handles (i.e., Federal Contract Information [FCI] or Controlled Unclassified Information [CUI]). The DoD will specify in requests for proposal (RFPs), contracts, or statements of work (SOWs) which levels are required to perform work.
Before receiving work, organizations can undergo a CMMC readiness assessment based on the maturity level they anticipate their contracts will require. The readiness assessment will identify effective controls, areas of noncompliance, and opportunities for improvement.
How We Can Help
Securance experts are well-versed in CMMC requirements and provide the following services to clients:
1. Readiness assessment
Securance assesses the degree to which the organization is prepared to pass a CMMC compliance audit.
2. Basic self-assessment
Securance helps clients evaluate their alignment with 17 NIST SP 800-171 controls for basic cyber hygiene, then provides an assessment score to the DoD.
3. Client self-assessment
Securance helps clients at Maturity Levels 1 and 2 with their annual self-assessments of NIST SP 800-171 controls, respectively.
4. Compliance assessment
Securance performs a full CMMC compliance assessment against NIST SP 800-171 and, if applicable, 800-172. The deliverables include a system security plan (SSP) and plan of action and milestones (POA&M) document.
5. Compliance monitoring
Securance evaluates the organization’s state of compliance annually.
THE SECURANCE DIFFERENCE
​Executive-level consultants provide hands-on leadership to ensure every project is a success.
Senior resources with 20 or more years of experience don’t just lead engagements; they execute them from cradle to grave.
.png)
We speak two languages, business and IT, and use our fluency to translate technical findings into business risks.
Our reports and recommendations are in plain English, not IT jargon, that all stakeholders can understand and appreciate.
.png)
Securance is the only IT security firm that uses artificial intelligence to enhance its approach to identifying risks and vulnerabilities.
Our proprietary AI technology predicts security and control failures, compliance gaps, and even data breaches.
.png)
.png)
.png)
bottom of page