Have you been putting off preparing for the updated CMMC cybersecurity regulations? If so, you may be uncertain about how to even get started in the process.
The Cybersecurity Maturity Model Certification (CMMC) Rule, approved in October and slated to go into effect Dec. 16, applies to all Department of Defense contractors and subcontractors handling certain sensitive, unclassified government data.
There are an estimated 250,000 or more contractors and subcontractors within the Defense Industrial Base (DIB) within the U.S. and abroad, representing a potentially massive security threat.
The goal of the CMMC regulation is to strengthen protections around the federal supply chain.
Related Article: CMMC Rule Approved: Next Steps For Compliance
It requires that DoD businesses satisfy certain security requirements to protect certain unclassified federal data, and that they remain compliant after obtaining certification.
After reading this article, you will understand exactly what’s involved in completing a CMMC gap analysis. You will also learn why this is an essential first step to ensure that your business is CMMC ready.
Understanding A Gap Analysis for CMMC Compliance
A gap analysis is the review and assessment of an organization’s existing IT environment. Businesses can weigh those results against the relevant cybersecurity standards they’re trying to meet to identify any security shortcomings.
The gap analysis gives businesses a baseline to develop a roadmap to comply with specific cybersecurity laws or regulations.
It can also be useful for companies that recently adopted new security policies or procedures to determine their effectiveness.
To be clear, a gap analysis can be used to compare against a range of security regulations across many industries. It is not industry specific.
For defense contractors and subcontractors, however, a CMMC gap analysis is the first step in their CMMC compliance journey.
A CMMC gap analysis evaluates the security measures and protocols you are currently using to safeguard your IT infrastructure and weighs it against the CMMC standards.
Step-by-Step Guide to Completing a CMMC Gap Analysis
While you may be fortunate enough not to have experienced a major cyber incident, not having the right cybersecurity tools and protocols in place could open the door for bad actors to infiltrate your network.
But you can’t implement those security measures without first knowing what’s missing.
A CMMC gap analysis helps defense contractors that handle federally controlled information (FCI) and controlled unclassified information (CUI) identify potential security risks within their organizations.
It’s important to note that the time needed to perform a gap analysis can vary widely depending on the size of your organization, the complexity of your IT infrastructure, the security requirements, who is conducting the analysis, and other factors.
With that in mind, a gap analysis can take just a few months to well over a year.
CMMC gap analysis steps:
1. Establish a dedicated team
Designate a team of qualified staff, either within your organization or through an external managed IT services provider, to perform the gap analysis.
2. Determine the scope of the assessment
Establishing the parameters of your IT infrastructure assessment will enable you to prioritize any vulnerabilities found involving your users, desktops, laptops, servers, software, apps, or any other part of your IT systems.
This assessment will detail the company’s physical boundaries and virtual environment and include a physical diagram of the buildings and the network itself.
3. Identify the business functions of the environments being assessed
This analysis can help businesses understand the key factors necessary for them to run efficiently and securely, following industry best practices and regulatory requirements.
4. Establish a security baseline
If your business needs to obtain CMMC certification, it's critical that you know your CMMC level and all of the compliance requirements you need to meet.
You can then measure your risk assessment results against the CMMC standards for your level to give you a good starting point for remediation steps.
5. Run security assessments and scans
Conducting vulnerability scans and penetration testing on the identified environment will help you evaluate your risk management. You will understand how well protected your business is from security risks such as cyber threats and data breaches.
6. Develop a robust plan of action and milestones (POAM)
A POAM will show exactly how your business is protecting CUI in the course of doing business with the DoD.
It will also spell out the specific security tools, protocols, and resources you intend to implement to correct any security gaps found within your IT environment.
Which CMMC Security Controls Should I Use To Assess My Infrastructure?
Level 1 DoD contractors store, transmit, and process FCI. These businesses will need to meet the 15 security controls spelled out in the Federal Acquisition Regulation (FAR 52.204-21).
The FAR security controls deal with the federal government’s purchasing process. It governs basic cybersecurity practices such as:- Authenticate users and devices
- Limit network access to authorized users according to their role and responsibilities
- Properly dispose of data containing FCI
- Identify and correct any security issues within your system
- Create subchannels to separate public information from FCI
Level 2 and Level 3 companies that handle CUI must satisfy stronger security measures.
Level 2 companies are required to satisfy the 110 controls outlined in NIST SP 800-171, which is tied to the Defense Federal Acquisition Regulation System (DFARS 7012) requirements spelled out in their defense contracts.
Some NIST SP 800-171 security requirements include:
- Audit your entire IT infrastructure
- Conduct a risk assessment to identify security gaps
- Develop an incident response plan to outline the steps your business will take in the event of a cyber incident or data breach
- Identify your existing security tools, protocols, and resources
- Create data management and backup measures
Level 3 companies handling the most critical CUI must comply with all of the requirements of the first two CMMC levels and satisfy 24 enhanced security controls outlined in NIST SP 800-172.
Related Article: What Will The CMMC Certification Process Cost My Business?
What’s The Bottom Line With Performing A CMMC Gap Analysis?
After reading this article, you now understand what a gap analysis is, the steps involved to perform one, and how long it could take to complete it.
You also now know why a CMMC gap analysis is critical to help identify and address vulnerabilities within their businesses to meet the regulatory requirements.
To avoid mistakes that can lead to costly delays later in the process, it's important to use expert IT professionals with broad cybersecurity and compliance knowledge.
At Kelser, we realize that managed IT services is not right for every business.
If you already have the internal staff with the technical and regulatory knowledge, as well as the necessary time and resources to undertake the infrastructure evaluation, then you likely don’t need to look for outside managed IT support.
If not, then your company may benefit from the services of an MSP, which includes a team of IT professionals with broad IT knowledge and cybersecurity expertise, along with a suite of advanced security tools to guide you through the compliance process.
If you need help getting started, you can reach out to an MSP to set up an introductory meeting to discuss your security needs and get an estimated timeline to complete a gap analysis for your business.
