CMMC audits are evidence-based and take place on-site. The result of a successful CMMC audit is a CMMC certification, which represents that the contractor has demonstratively achieved a certain level of cybersecurity maturity. CMMC audits are performed by CMMC Third- Party Assessment Organizations, which are third-party organizations that have received accreditation by the CMMC Accreditation Body (CMMC-AB).
HERE’S WHAT A CMMC AUDIT MAY INVOLVE IN PRACTICE:
- Review of the current security program: First, the C3PAO will get in touch with the person who is responsible for the organization’s cybersecurity. This can be a dedicated CISO, but it can also be the network administrator, or other designated personnel. The C3PAO will go over the current security program to better understand the environment that it’s dealing with. Specifically, the C3PAO will want to know what FCI/CUI data is stored and transmitted by the organization and how.
- Review of currently used controls: After familiarizing itself with the organization’s security program, the C3PAO will review the currently used controls that the organization has implemented to detect, prevent, reduce, or counteract security risks. At this point, the goal is to find out whether all controls that are supposed to be in place are actually in place.
- Verification of the implementation of controls: Next, the C3PAO will perform an in-depth analysis of individual controls to verify their implementation. An auditor may ask the person who is responsible for the organization’s cybersecurity to explain a certain process or demonstrate how a specific control works. Depending on the maturity level, the assessor may need to see an informal walkthrough of the process for level 1, but two pieces of objective evidence for Level 3, which could include policy documentation, audit logs etc.
- Issuing of an official audit report: Finally, the C3PAO will submit an official audit report to the CMMC Accreditation Body (CMMC-AB), after doing its own internal QA, detailing how well the audited organization performed and whether or not it meets the requirements of the target CMMC Level. The C3PAO will keep details about specific findings confidential, so the organization doesn’t have to worry about suffering damage to its reputation. The CMMC-AB will then conduct its own QA to validate the C3PAO’s assessment and then determine whether certification can be issued directly to the contractor.
It’s important to keep in mind that passing one CMMC audit doesn’t mean that the audited contractor can stop worrying about CMMC and its requirements. According to the DoD, CMMC is intended to be an evolving certification and compliance process that will very likely introduce new controls to the various levels in response to emerging threats.
Because CMMC certificates will be valid for three years, contractors must prepare for regular reassessments by working toward ensuring ongoing compliance.
GET STARTED ON YOUR CCMC AUDIT
Simple Plan IT is nationally recognized and accredited as a registered provider organization by the Cybersecurity Maturity Model Certification Accreditation Cody (CMMC-AB). We’re happy to answer any questions about the CMMC process or help you plan the steps you need to take in order to qualify. Our team is happy to talk through the steps your particular company should take in the CMMC process, or get started on your certification.
