As the Cybersecurity Maturity Model Certification (CMMC) continues to evolve, small and medium-sized businesses (SMBs) face significant challenges in achieving compliance. A recent CISO Forum brought together security leaders to discuss strategies for reducing the burden of CMMC compliance. Here’s an in-depth look at their insights and recommendations:
The Current State of CMMC Compliance
The landscape of CMMC compliance is complex and ever-changing. A CMMC assessor highlighted:
“The standards or the actual security is fairly understandable. It’s the documentation that hits people by surprise because government runs on paperwork. As an assessor, my perspective is, I have to collect these things. I have to retell your story through a couple layers of quality control to the Cyber AB, and then it goes to the DoD to get that certification.”
This emphasis on documentation underscores the need for SMBs to focus not just on implementing security measures, but also on thoroughly documenting their processes and controls.
Key Strategies for Easing CMMC Compliance
1. Focus on Documentation and Evidence Collection
Proper documentation is crucial for CMMC compliance. A cybersecurity compliance manager shared a valuable tip:
“We came up with a very interesting concept called Evidence Collection Guides, which helps their tips for the Admins. Where to get the screenshots. The screenshots are valuable, but the assessors want to see it. You know they say, ‘Show me, don’t tell me’ because anybody can Photoshop or Google them.”
Actionable recommendations:
- Develop detailed Evidence Collection Guides for your team.
- Use existing tools to generate inventories and user lists.
- Point to existing policies in your System Security Plan.
- Document the responsible parties for each control.
2. Leverage Automation and AI
While no single tool can fully automate CMMC compliance, leveraging technology can significantly reduce manual effort. A security consultant predicted:
“I think we’re probably about 6 months to a year out before we really have the technology to do this right. Because I think it’s gonna take some type of AI integration to handle all these processes coming out of the controls.”
Recommended actions:
- Explore AI-powered tools for policy analysis and gap identification.
- Implement solutions that automatically gather evidence from systems.
- Keep an eye on emerging AI technologies for process automation.
3. Consider a Secure Enclave Approach
Implementing a VDI secure enclave such as Fortified Desk can help limit the scope of your CMMC compliance efforts. An experienced security leader explained:
“The final rule actually has a carve-out for VDI. Endpoint & Vendors don’t need to be compliant if you’re just logging in with a web browser or an email client, but be prepared to defend your stance that the CUI data does not reside on that remote device even in memory.”
This VDI carve-out may actually remove the requirement for subvendors to be CMMC compliant. If they are not interacting with CUI data, then they may not need to be CMMC compliant. For example, a concrete subcontractor may be isolated if they are not privy to confidential structural plans and if they are only logging into a portal and not saving anything from the general contractor on their local devices.
Steps to implement:
- Create a dedicated environment or secure enclave for handling Controlled Unclassified Information (CUI).
- Use ephemeral VDI or similar technologies to keep data off of the endpoints.
- Implement strict controls to prevent data exfiltration, which could even include screen watermarking to prevent screen capture.
4. Prioritize Process Maturity
CMMC is fundamentally about process maturity. A former CISO emphasized:
“CMMC is much more than processes. It’s a framework to determine your maturity.”
Key focus areas:
- Develop and document mature processes across your organization.
- Ensure policies are implemented and followed.
- Build a culture of security awareness and compliance.
5. Start Early and Build Incrementally
Don’t wait until CMMC is mandated in your contracts. A director of information security shared their experience:
“We’re about halfway through. We’ve built an Enclave. We’re getting ready to do a milestone checkpoint with the C3PAO this summer, just to validate that all of the things we’ve done with our Enclave works, and is operating as intended.”
Recommended approach:
- Begin assessing your current posture against CMMC requirements now.
- Develop a roadmap for addressing gaps and improving maturity.
- Consider working with experienced consultants to accelerate your journey.
Recommended Technologies
While no single tool solves CMMC compliance, these solutions may help streamline the process:
- GovReady: A cloud-based GRC platform for managing compliance documentation.
- Vanta: An automated security monitoring and compliance platform.
- Comply Up: A compliance management tool designed for SMBs.
- Microsoft Purview: A comprehensive data governance and compliance solution.
- Fortified Desk: A secure enclave solution for handling sensitive data.
A simplified approach was offered up:
“People are being given quotes of $60K to $90,000 for readiness and then the cost of the auditor and certification so firms could easily spend over $150K. But when you break it down. The 4 main tasks that are needed for CMMC compliance:
- A Readiness Assessment – usually performed by a CMMC coach/readiness consultant
- Policy Development and Evidence Collection
- Secure Enclave – hosted or cloud-based technology
- Certified Auditor – C3PAOs.
Ask Fortify Experts how their CMMC Acceleration Program can help you become CMMC Certified within 6 months WITHOUT increasing your Annual IT spend. Schedule time here.
The Broader Impact of CMMC
It’s important to note that CMMC compliance can have far-reaching effects beyond just Department of Defense contracts. A security leader in the FinTech sector pointed out:
“I don’t know why we need another framework, but this one can be applied anywhere.
This underscores the potential for CMMC principles to improve overall cybersecurity posture across various industries.
Conclusion
CMMC compliance presents significant challenges for SMBs, but with the right strategies and tools, it’s possible to streamline the process while improving overall security. By focusing on documentation, leveraging technology, and building mature processes, SMBs can prepare themselves for CMMC certification and enhance their cybersecurity resilience.
As a cybersecurity consultant aptly put it:
“None of those CEOs care about that until they have a breach or a ransom demand, and then that’s all they care about. So the paradigm changes overnight.”
Don’t wait for a security incident to prioritize your CMMC compliance efforts. Start your journey today to be prepared for upcoming requirements and protect your business from evolving cyber threats.
About Tim Howard
Tim Howard is the founder of 5 technology firms, including Fortify Experts, AI Cyber Advisors & Fortified Desk. Fortify Experts helps companies simplify cybersecurity through:
- People (Executive Search and vCISO/Advisory consulting),
- Process (NIST-based security assessments and Leadership Coaching),
- Technology (Simplifying Security Solutions), check out Fortified Desk.
How I can help you:
- Join over 30,000 People Getting Free Security Leadership Improvement Advice – Follow me on LinkedIn. www.linkedin.com/in/timhoward
- If you want to hire a great security leader, download our free ebook on How to Hire a Great CISO.
- If you want to quickly assess your Cybersecurity Maturity Level or need a Strategic Improvement Roadmap, contact me.
- If you are looking to simplify cybersecurity, check out Fortified Desk. The streaming desktop that air gaps the endpoint to reduce exposure and risks.
- Come be a part of the discussion in our Monthly CISO Forums.