What are CMMC Registered Practitioners and do I need one?

How to prepare for a CMMC audit 

To prepare for a CMMC audit, you need to set realistic expectations about: 

• what CMMC level you need, 
• how long it takes, 
• your role in the process, and 
• how expensive it is. 

Which CMMC level do I need to reach? 

The CMMC framework is aligned with NIST 800-171 and consists of three certification levels. 

• Level 1 (17 controls): Sufficient for businesses handling Federal Contract Information (FCI). The audit for this level is not expected to be as documentation heavy. 
• Level 2 (110 controls): Required for handling Controlled Unclassified Information (CUI). Because each control can have multiple objectives, there are over 300 objectives to meet. A third-party audit is likely to be required for all organizations seeking level 2 certification. 
• Level 3: Suitable for organizations at high risk. This level is usually reserved for prime contractors. 

A Registered Practitioner can help you determine which level you realistically need. Together, we’ll examine 1) what kind of information you handle and 2) what systems process and store sensitive information. We’ll also look at what systems you have in place to simplify administrative tasks like user account control (e.g. single sign-on). 

How long does it take to become CMMC compliant? 

Becoming CMMC compliant can easily take 12 to 18 months, depending on your starting point and the level you need to reach. During this period, you need to: 

• assess your current security posture, 
• perform a gap analysis to determine what you are missing to reach your desired CMMC level, 
• implement all necessary controls and processes, 
• complete an audit by a C3PAO, and 
• receive certification by successfully passing an audit. 

How involved will I be? 

We mentioned this in the section on cost, but it bears repeating: you will be regularly and actively involved throughout the process of working toward CMMC compliance. Full collaboration is absolutely critical to a successful implementation and audit. Consider a few reasons. 

CMMC implementation will affect the way you do business. A Registered Practitioner knows cybersecurity and CMMC, but you know your business and team. The combination of your areas of expertise will produce the best result — one that you understand, support, and that works for you day-to-day. 

There will be a LOT of documentation. As you can expect when working with the government, especially the Department of Defense, paperwork is the name of the game. There will be a lot of documentation to produce and review in preparation for the audit. You have information that will be integrated into that documentation. But you will also be expected to understand how all the pieces fit together. 

This is an opportunity to streamline your technology and strengthen your competitive advantage. Too often, poorly designed and implemented tech inhibits business functions. The deep dive that you will do while preparing for certification will reveal inefficiencies and weaknesses in your tools and processes. You can ignore them and do the bare minimum to reach compliance, or you can take advantage of the situation and optimize with the guidance of an expert consultant.