CMMC background

The Department of Defense’s (DOD) Cybersecurity Maturity Model Certification (CMMC) rule requires organizations to conduct a 3rd party assessment of the systems used to store, process, or transmit DOD Federal Contracting Information (FCI) and Controlled Unclassified Information (CUI) data. 

Handling FCI data requires that systems storing and processing such data meet 17 security requirements defined in FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems. System owners must annually self-attest to meeting these requirements. 

Handling CUI requires the application of 110 security requirements defined in NIST 800-171 rev2 across the systems, devices, and personnel directly handling CUI (known as CUI Assets) and the systems, devices, and personnel securing CUI assets (known as Security Protection Assets). In most cases, system owners must undergo assessment by a Certified Third-Party Assessment Organization (C3PAO) every 3 years, and self-attest to the ongoing validity of the assessment results during the intervening years.