Guarding the Gate: CMMC 2.0 and CUI

CMMC
September 2, 2024

CMMC 2.0: Protecting Controlled Unclassified Information (CUI) 

The Controlled Unclassified Information (CUI) program standardizes how the U.S. Federal Government manages sensitive information that does not meet the criteria for classification but still requires protection. Sensitive but unclassified data may include personal information, proprietary business information, certain types of law enforcement data, protected health information, and critical infrastructure and cybersecurity information. Even though this data isn’t classified, it is still protected and must go through a specific process to ensure it is handled and accessed securely.

The security practices (NIST SP 800-171) upon which CMMC 2.0 Level 2 is based have been mandatory for DoD contractors handling sensitive information since December 2017, when the DFARS clause 252.204-7012 was included in DoD contracts.

In response to inconsistent self-monitoring and assessment, the DoD launched the CMMC program, where compliance is verified by independent third-party assessors through DoD-certified CMMC Third Party Assessment Organizations (C3PAOs). The assessment findings are submitted by the C3PAO to the Cyber-AB, which then issues the certification.

If your business processes, handles, or manages information critical to national security, you must demonstrate CMMC 2.0 Level 2 compliance with the 110 controls from NIST SP 800-171.

CMMC 2.0: Where the Rubber Meets the Road

NIST 800-171 consists of 14 domain families that form a comprehensive framework for protecting CUI in non-federal information systems and environments. Adherence is crucial to securing CUI. The domain families are the foundation on which the various levels of CMMC compliance certification are built. CMMC 2.0 Level 2 covers all 110 controls that map to each of the 14 NIST SP 800-171 domains, inclusive of all Level 1 requirements.

1. Access Control (AC) – Restrict Access to CUI 
2. Audit and Accountability (AA) – Track and Report Who Accesses CUI 
3. Awareness and Training (AT) – Develop and Reinforce Proper CUI Handling
4. Configuration Management (CM) – Maintain Information System Integrity 
5. Identification and Authentication (IA) – Verify Only Authorized Personnel Can Access CUI
6. Incident Response (IR) – Detect and Respond to Security Incidents
7. Maintenance (MA) – Keep Information Systems Running Optimally
8. Media Protection (MP) – Safeguard CUI Stored on Removable Media
9. Personnel Security (PS) – Vet and Protect Employees Who Handle CUI 
10. Physical Protection (PE) – Maintain Proper Physical Security of Equipment and Facilities 
11. Risk Assessment (RA) – Identify and Evaluate Risks to Information Systems
12. Security Assessment (CA) – Evaluate Security Requirements and Make a Plan to Meet Them 
13. System and Communication Protection (SC) – Implement Controls to Identify and Repel Potential Threats 
14. System and Information Integrity (SI) – Protect Information and Information Systems from Threats 

Click here for more about the NIST SP 800-171 domain families and controls.

CMMC 2.0: It is Time to Press Go

Well-trained and knowledgeable personnel who support the core security domains of CMMC 2.0 Level 2 are essential assets to any organization. Safeguarding CUI is a continuous, active, and unwavering commitment to protect data from unauthorized access. 

Achieving CMMC 2.0 Level 2 compliance is a rigorous process that demands meticulous planning, a thorough understanding of cybersecurity requirements, and a commitment to continuous improvement. It also demands active engagement and support by executive leadership to foster an organization-wide culture of cybersecurity resilience. While it presents challenges, it also offers opportunities to fortify your cybersecurity posture, enhance your reputation, and secure your place in the DoD supply chain.