CMMC Model

CMMC Model Explained

Omer Aslim selfie
By: Omer Kaan Aslim
June 08, 2020
In this post we explain the new CMMC model.

The cybersecurity maturity model certification (CMMC) is a new U.S. Department of Defense requirement for over 300,000 prime and subcontractors. CMMC comes with a new framework of security controls. The framework or model includes requirements for security practices and processes.

CMMC Domains Explained

There are seventeen domains in the CMMC model. Domains define your strategic security objectives for your required security capabilities. For example, the capabilities under the “access control” domain seek to limit access to your systems to authorized persons.

Each domain has multiple capabilities.
CUI Levels

CMMC Capabilities Explained

A capability defines a specific requirement to support the objective of a domain. For example, the capability of “establishing system access requirements” supports the “Access Control” domain.
Each capability has practices.

CMMC Practices Explained

Practices are the specific security requirements you need to implement. Practices support the implementation of capabilities. Practices are the security controls you are required to implement. Each CMMC level has a specific number of practices that need to be implemented.
CMMC Practices

CMMC Processes Explained

Processes define the maturity level at which a practice has been implemented. For example, your company may have implemented password length and complexity as required by a CMMC practice. If the password requirements have not been documented the practice isn’t mature. There is no way to guarantee that the password requirements will be consistently implemented. However, if you were to implement your password requirements, document them in a policy, and create a plan to implement them on all of your systems the implementation of that practice would be more mature.

Processes are critical to improving the maturity of CMMC practices.
CMMMC Processes

How CMMC Maturity Levels Relate to CMMC Practices & Levels

The cybersecurity maturity model certification has five levels. The lowest level has the least amount of security requirements. The higher the level the more security controls aka “practices” you need to implement. Not only do you have to implement more practices but you have to “institutionalize” them. The way process institutionalization or maturity is achieved is by documenting, planning, reviewing, and optimizing your CMMC practices.
CMMMC Practices and Processes
 

Discover Our NIST SP 800-171 Solutions:

 /assets/images/compliance_accelerator_white.png

Compliance Accelerator

For contractors seeking compliance
 /assets/images/quantum_assessor_white.png

Quantum Assessor

For IT service providers
 /assets/images/supply_chain_logo_white.png

Supply Chain Verifier

For contractors seeking to verify partner compliance