CMMC Compliance Framework
(Cybersecurity Maturity Model Certification)
The CMMC or Cybersecurity Maturity Model Certification program is a certification framework launched by the US Department of Defense that classifies cybersecurity maturity into different levels. Each level incorporates increasingly complex and secure functionalities or security objectives. These levels establish a framework for cybersecurity.
Once the program is officially rolled out, all DoD contracts will be labeled with a specific CMMC level. Any Defense Industrial Base (DIB) contractor or subcontractor wishing to bid on that contract must be certified in the requisite level (or higher). By enforcing this program, the DoD will be able to verify that contractors and subcontractors have the capability to protect FCI (Federal Contract Information) or CUI (Controlled Unclassified Information).
CMMC Levels
The DoD has released an updated CMMC compliance framework, referred to as CMMC 2.0. This framework establishes three levels of progressively increasing cybersecurity requirements. Each level is keyed to independent standards: Federal Acquisition Regulation (FAR) 52.204-21 and NIST 800-171 and 800-172 requirements.
- Level 1 – Foundational: involves FCI not for public release and aligns with 15 controls from FAR 52.204-21 “basic” controls; contractors must complete annual certifications and self-assessments.
- Level 2 – Advanced: involves dealing with CUI and aligns with 110 NIST 800-171 controls; contractors must complete annual self-assessments and triennial reviews by a Certified Third-Party Assessor Organization (C3PAO).
- Level 3 – Expert: involves dealing with CUI, and aligns with 110 NIST 800-171 controls, plus 24 NIST 800-172 controls; contractors must complete triennial, government-led assessments.
Creating a CMMC Compliance Framework
The DoD, which oversees the CMMC program, estimates that most DIB contractors will require Level 2 certification. However, many popular file sharing programs do not support CMMC Level 2 requirements for storing and sharing CUI.
FileCloud, on the other hand, is a powerful, hyper-secure solution that can be leveraged by DIB contractors to store, share, and govern public data, FCI, and CUI.
Leading Defense Contractors Choose FileCloud
Organizations processing critical data benefit by storing data in-house to minimize data security threats and meet compliance requirements. However, they often need to be able to collaborate on and share data with project stakeholders and subcontractors.
FileCloud is a robust file sharing solution that can easily integrate with existing IT systems to boost efficiency and security and help meet CMMC requirements. When deployed as an on-premises solution, organizations can use FileCloud Server as a primary file storage and access system or as an overlay for legacy storage and network shares. Within FileCloud, admins and users alike can take advantage of powerful tools and settings to protect data while collaborating remotely.
