Cybersecurity Maturity Model Certification CMMC

Here at IQC – the ISO Professionals, we never want to confuse our clients. When we speak of “Basic Cyber Hygiene,” what we want our clients to understand that it’s as basic as it gets. It can include the provision of training to staff members in ensuring the security of accounts and software, the use of antivirus programs, and the like.

Straying from the level of Basic Cyber Hygiene, we’ll go to the next step – this is known as the level where the real CMMC begins. In this step, new data is to be introduced, and it includes Controlled Unclassified Information (CUI). In addition to that, this step requires organizations to have documentation largely based on NIST 800-171-r2 which consists of certain knowledge and skills.

After Intermediate Cyber Hygiene comes to Good Cyber Hygiene. This is the level or the phase where it gets advanced – and since in this level, most of the organizations working with the DoD would have set some things up, this is where it gets trickier. At this level, organizations and companies need to have at least 47 security controls in total – these are used to help out in the deduction of variation and options.

What we always promote here at IQC – the ISO Professionals is the virtue of proactivity, because in the 4^th level of the CMMC comes proactivity. What this requires is that companies need to have the willingness to be proactive in detecting and identifying threats, measuring effectiveness and efficiency, as well as defeating and overcoming all types of threats that would present itself.

After the 47 controls, the CMMC adds another 30 security controls that need to be installed and integrated to achieve and to arrive at the 5^th level. This is the advanced level of the CMMC where it talks about and discusses the response in the changing atmosphere of threats within a given situation or scenario.