CMMC Level 3 Readiness Assessment

Review the Cybersecurity Maturity Model Certification (CMMC), assess current state, identify gaps, develop and manage improvement roadmap.

What is CMMC?

The Cybersecurity Maturity Model Certification (CMMC) is an assessment framework and assessor certification program designed to increase the trust in measures of compliance to a variety of standards published by the National Insititute of Standards and Technology (NTIST).

The purpose of the CMMC is to verify that the information systems used by the contractors of the United States Department of Defense to process, transmit or store sensitive data are compliant with the mandatory information security requirements. The goal is to ensure appropriate protection of controlled unclassified information (CUI) and federal contract information (FCI) that is stored and processed by partner or vendor.

What can you do with this offering?

The online tool with the built-in body of knowledge supports the full life cycle of assessing, planning, and managing cybersecurity capabilities and risk exposure. By signing up with this offer, you will be able to:

• Self-assess or set up an assessment to get input from multiple people in the organization.
• Document the rationale and supporting information for each practice in the framework as evidence for internal and external auditors.
• Compare and contrast the level of readiness across business functions or groups.
• Develop various charts and heatmaps to visualize the current and target state.
• Identify and prioritize gaps based on desired risk posture.
• Create, maintain, and monitor a plan of action or improvement roadmap.
• Monitor and communicate progress year over year.

What is the environment and how is the assessment data protected?

1. Once you sign up, a dedicated environment, just for your organization, will be provisioned. Only you and the people authorized by you will have access to the application and data. People who are participating in the survey can review and update their own data only. The data is not shared with any other organization.
2. The underlying system only allows authenticated sessions over a secured (HTTPS) connection. The data in transit and at rest is encrypted.
3. You can download your own organization data into spreadsheets and delete the data online at any time.