As the channel prepares for the United States to formally implement the CMMC framework in the near future, Managed Service Providers need to understand where they’re compliant, and how to align with best practices in time. They may be asking questions like:
- If I’m FedRAMP Moderate compliant, is my MSP good to go?
- Where do I stand if I align with NIST SP 800-171?
- What about DFARS-252.204-7012?
- Does anyone else have to copy paste these acronyms and numbers because it’s impossible to sort through them all, or is it just me?
In this post, we’ll walk through the differences between CMMC and FedRAMP, how they’re related to other common compliance requirements, and why this matters to MSPs.
What is CMMC?
The Cybersecurity Maturity Model Certification (CMMC) gives defense contractors for the federal government a five-level compliance framework (with Level 1 representing the lowest maturity level, and Level 5 representing the highest) outlined by the United States Department of Defense.
Under these regulations, certified third-party assessment organizations (which the DoD refers to as C3PAOs in the CMMC framework) would evaluate defense contractors or other organizations looking to become a contractors based on their security posture.
When evaluating candidates for government defense contracts, the US federal government will use the CMMC framework to determine whether an organization is aligning with best practices and prepared to prevent data exfiltration and potential incidents, especially for contracts that involve Controlled Unclassified Information (CUI), or information that isn’t formally classified but should be protected against foreign interests or malicious actors.
What is NIST SP 800-171?
NIST SP 800-171 is a framework that outlines best practices that government contractors must take to secure controlled unclassified information (CUI).
So Why Am I Hearing About DFARS and NIST When We’re Talking About CMMC?
The CMMC framework expands on DFARS 252.204-7012, a previous compliance standard that requires defense contractors handling CUI to comply with the guidelines under NIST 800-171, and offers a way to enforce these requirements, after relying on companies to certify themselves was leading to $600 billion a year in losses due to data breaches, according to a 2019 report.
Why CMMC Matters to MSPs
While the Department of Defense has not formally implemented CMMC, organizations are already concerned about complying with CMMC, and industry experts indicate that questions about how well contractors can comply with CMMC and reach (at least) Maturity Levels 2 or 3 are already appearing in RFI processes. Moreover, external service providers (a CMMC classification that covers MSPs) will be required to provide cybersecurity measures like a SIEM service that also comply with the CMMC’s requirements.
What is FedRAMP? Why Does It Matter to MSPs?
Unlike CMMC, which only applies to defense contractors, the FedRAMP compliance program offers a list of cybersecurity best practices and requirements that applies to cloud-based service providers to ensure their software and services meet the minimum requirements to support and secure federal agencies and government contractors.
However, despite these key differences, CMMC does require defense contractors using or storing CUI in a cloud environment to certify that the cloud provider behind the environment is FedRAMP Moderate certified, which means vendors must help maintain confidentiality, integrity, and availability, or create “significant operational damage to agency assets, financial loss, or individual harm that is not loss of life or serious life threatening injuries,” according to FedRAMP’s baselines.
This creates an overwhelming level of compliance requirements, which may require MSPs to re-evaluate their technology stack and identify new partners to offer tooling that complies with CMMC best practices.
Key Takeaways
- Work with your technology partners and vendors to establish your current security posture, and what security controls you can currently support.
- Determine your strategy for delivering services to organizations that will need to comply with CMMC – are there on-premises alternatives to your MSP tools? Will you end up creating dedicated tenants or instances of different tools for these compliant clients?
- If your MSP has not already implemented security solutions to align with CMMC security controls (such as an incident response partner, a SOC, or log/network monitoring) to provide the security services the framework requires, implement them immediately – even if CMMC doesn’t require them, more and more MSPs are offering cybersecurity services as part of their portfolio.
Notes and Reference Materials:
- Brunsman, Joseph E. “CMMC (Cybersecurity Maturity Certification Model): Explained (so far) – from the book Damage Control: Cyber Insurance and Compliance.” Chesapeake Professional Liability Brokers, Inc. Last modified March 15, 2020. https://old.reddit.com/r/msp/comments/f40kj7/cmmc_cybersecurity_maturity_certification_model/.
- https://www.regulations.gov/docket/DOD-2023-OS-0063/unified-agenda
- https://www.federalregister.gov/documents/2023/12/26/2023-27280/cybersecurity-maturity-model-certification-cmmc-program
- https://old.reddit.com/r/msp/comments/18t24j9/addressing_cmmc_as_an_msp
