Information System CMMC

What is an information system?

Understanding what an information system is and its components is critical to effectively implementing your company’s CMMC requirements.

Join our newsletter:
Official Definition: The term “information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. (44 U.S. Code § 3502)

Examples of an information system:

  • Your company’s computer network and the systems that make it up.
  • Another organization's computer network and computer systems (known as an external information system).

Information System Components

Below are a few components that may make up an information system.
  • Network devices such as routers, switches, and firewalls.
  • Output devices such as printers, scanners, and fax machines.
  • Devices such as laptops, desktops, and servers.
  • Applications/services such as your website.
  • Non-digital media such as paper documents.
  • Digital media such as USB thumb drives, hard drives, CDs, DVDs, floppy disks, and backup drives.
  • Software such as Microsoft Office, web browsers, and antivirus software. Hardware such as monitors, keyboards, and mice.
  • VOIP and PBX telephone systems.
  • Environmental control systems such as the HVAC system in a server room.

How Information Systems Relate to the Cybersecurity Maturity Model Certification (CMMC)

A company’s information system is what will process, store, and transmit federal contract information (FCI) or controlled unclassified information (CUI). As a result, CMMC practices and processes are meant to protect an information system from cyber threats with the strategic objective of protecting FCI and CUI. As shown above, an information system has many components. When implementing CMMC requirements, companies need to make sure that they are being applied to the various components making up their information system. For example, only implementing password requirements for user accounts on a computer that processes, stores, and transmits FCI or CUI isn’t enough. You need to apply these requirements to the entire information system supporting the storage, transmission, and processing of CUI and FCI.
 

Quick & Simple

Discover Our Cybersecurity Compliance Solutions:

Whether you need to meet and maintain your compliance requirements, help your clients meet them, or verify supplier compliance we have the expertise and solution for you

 NIST SP 800-171 & CMMC Compliance App

NIST SP 800-171 & CMMC Compliance

Become compliant, provide compliance services, or verify partner compliance with NIST SP 800-171 and CMMC requirements.
 HIPAA Compliance App

HIPAA Compliance

Become compliant, provide compliance services, or verify partner compliance with HIPAA security rule requirements.
 FAR 52.204-21 Compliance App

FAR 52.204-21 Compliance

Become compliant, provide compliance services, or verify partner compliance with FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems requirements.
 ISO 27001 Compliance App

ISO 27001 Compliance

Become compliant, provide compliance services, or verify partner compliance with ISO 27001 requirements.