A cybersecurity expert explains where defense contractors most often fall short during CMMC assessments
By Corinne Minard
Being Cybersecurity Maturity Model Certification (CMMC) compliant, a Department of Defense (DoD) security standard that requires defense contractors to protect sensitive government data, takes more than just checking some items off a list.
“Having a policy in place is not the same as having a control in place,” says Carly Devlin, shareholder and chief Information security officer at Clark Schaefer Consulting. “Assessors aren’t evaluating whether your organization has documented its intentions. They’re evaluating whether those intentions are operational, consistent and backed by evidence. That requires more than paperwork.”
As a Registered Practitioner Organization (RPO), Clark Schaefer Consulting helps organizations prepare for their official CMMC assessment, from readiness and gap assessments through mock assessments modeled on the CMMC Assessment Process (CAP), ahead of certification by a C3PAO. “Evidence is what closes the gap. It tells an assessor that a control isn’t just described. It’s implemented, it’s operating, and it’s been functioning consistently enough to leave a traceable record,” says Devlin.
When looking for evidence gaps, Devlin says some areas tend to have more problems than others.
– Access Control: “Organizations frequently have access control policies but lack the logs or configuration records to demonstrate enforcement,” says Devlin. “Assessors expect to see evidence of least privilege implementation, role-based access assignments and reviews of user access rights.”
– Audit and Accountability: Audit logs need to be generated, protected, reviewed and retained, but many organizations can’t demonstrate that logs are reviewed on a defined schedule or that anomalies are acted upon.
– Incident Response: “Assessors want to see evidence that the plan has been tested, that personnel know their roles and that prior incidents or exercises have been documented,” says Devlin.
– Configuration Management: “Baseline configurations are required, but assessors also look for evidence that those baselines are enforced and that changes go through an approval process,” says Devlin.
– Identification and Authentication: “Multi-factor authentication requirements under CUI 3.5.3 are well known, but assessors frequently find gaps in coverage. Systems or access points where MFA isn’t enforced, or where enforcement can’t be demonstrated through system settings or access records, are common findings,” says Devlin.
While most organizations spend their preparation time building policies and completing self-assessments, they don’t know if their evidence will hold up to scrutiny when assessed.
“Evidence collection isn’t a one-time task. Assessors aren’t looking for a snapshot of where you are the week before your assessment. They’re looking for indicators that controls have been operating over time. Logs that only go back 30 days, training records completed in a single afternoon or incident response documentation with no history of use all signal that a control was stood up for the assessment rather than embedded in day-to-day operations,” says Devlin.
To build a CMMC compliance program that satisfies assessors, Devlin says organizations should be deliberate as they design and implement their program.
“Controls need owners who are responsible not just for maintaining documentation but for ensuring that operational activity generates the records an assessor will expect to see. System Security Plans (SSPs) need to reflect how controls are implemented, not how they’re intended to be implemented,” she says. “Regular internal reviews against the CMMC Assessment Process, not just against a checklist, give organizations a realistic picture of where their evidence stands before an assessor does.”
Companies like Clark Schaefer Consulting can assist other companies as they try to determine if they are compliant. Devlin recommends those companies reach out to Clark Schaefer Consulting’s team to learn more.