Panicked About CMMC? Don't be!

April 22, 2020 Schellman Compliance

The information presented here has been superseded by CMMC 2.0, which you can read about here.

The Cybersecurity Maturity Model Certification (CMMC) has been a hot topic in the federal and defense contracting sector leading up to and since its formal release with v1.0 on January 31, 2020. The details around the implementation of CMMC are rapidly evolving – from the formalization of the CMMC Accreditation Body (CMMC-AB), to guidance on maintaining compliance with the current DFARS 252.204-7012 and NIST SP 800-171 mandates while also ramping up to CMMC Levels 1-5, to understanding when contractors must have CMMC fully implemented, to timelines for when certified third-party assessment organizations (C3PAOs) will be credentialed to perform assessments.

Organizations undoubtedly want to be proactive in their preparation for CMMC and certification for any contract requirements. Because of the evolving landscape and the many unknowns of CMMC, the industry has expressed increased anxiety about achieving CMMC certification right now.

Here at Schellman, we have closely followed CMMC through its draft iterations and formally published versions, attended in-person and web-based symposiums, and have spoken with many clients about their plans and concerns with CMMC. Our biggest takeaway for organizations? Don’t panic! The timeline is not as near as it may seem (think 2021 and beyond) and organizations may be closer to compliant than they realize.

We published a whitepaper titled Panicked about CMMC? Here’s why you shouldn’t be., which details the phased roll-out of CMMC, timelines in play, comparisons to DFARS 252.204-7012 and NIST SP 800-171, and responses to common questions.

Note: CMMC v1.02 was released on March 18, 2020. This version update included minor changes to formatting, spelling, control references, and references to FIPS 140-3. No material changes to the CMMC were made. The changes are detailed in the CMMC Errata.

About the Author

Schellman is a leading global provider of attestation, compliance, and certification services. Operating as an alternative practice structure as Schellman & Company, LLC, a top 100 CPA firm, and Schellman Compliance, LLC, a globally accredited compliance assessment firm, we are able to offer clients services as a CPA firm, an ISO Certification Body, a PCI Qualified Security Assessor Company, a HITRUST assessor, a FedRAMP 3PAO, and as one of the first CMMC Authorized C3PAOs. Renowned for expertise tempered by practical experience, Schellman's professionals provide superior client service balanced by steadfast independence. Schellman's approach builds successful, long-term relationships and allows our clients to achieve multiple compliance objectives using a single third-party assessor. For more information, please visit schellman.com.
More Content by Schellman Compliance

Safety and Cybersecurity First

Three Steps to Ensure Employee Safety during a Pandemic

Schellman Makes Debut on 2021 Vault Accounting 50

Schellman & Company, LLC a leading provider of attestation and compliance services announced today that it ...

Return to Home

Stay up to date and discover new insights into compliance through our team’s thought leadership

Panicked About CMMC? Don't be!

The information presented here has been superseded by CMMC 2.0, which you can read about here.

About the Author

Previous Article

Next Article

Panicked About CMMC? Don't be!

The information presented here has been superseded by CMMC 2.0, which you can read about here.

About the Author

Previous Article

Next Article

Most Recent Articles

In February 2023, the OCR reported recent HIPAA issues & breaches to Congress—we break down the details so you can understand where other organizations fell short and avoid similar pitfalls.

For those operating in the federal space, we break down 4 commonly referenced NIST Special Publications in 800-34, 800-61, 800-63, and 800-218, including what they address and how.

Schellman welcomes Matt Goodrich as our new Head of Transformation. His expertise and vision will be instrumental in helping us drive further growth.

Becoming PCI DSS compliant is a complex process. We walk you through the first steps in determining what you need, as well as the steps for completing an assessment so that you know what to expect.

Considering a HIPAA assessment? Whether you choose to perform it internally or engage an independent third party, we share 7 steps to focus your preparation and boost your compliance.

Having already assessed organizations against the new PCI DSS v4.0, we're publishing the insight gained to help you understand more of what's coming and boost your preparation for the new standard.

With the release of the Biden Administration's new cybersecurity strategy in March 2023, cybersecurity has become an American priority. We break down the details, as well as how you can prepare.

Not sure what you're getting into with HITRUST certification? We break down the complete process into 4 steps so you can know what to expect and how to get from start to finish.

Schellman welcomes Michael Parisi as our new Head of Client Acquisition to assist as an integral part of our proactive growth initiatives.

PCI DSS v4.0 is a big shift for everyone involved in payment transactions, but we explain what and why those specifically in the banking industry should take a closer look at the updated standard.

Considering a FedRAMP Moderate Assessment? We break down what to expect from the process, the elements that will be evaluated, and specific areas to take care of so you can streamline your experience.

Defining the secure exchange of data is critical for PCI DSS compliance. To help you do that more easily, we break down all the elements, which ones are stronger than others, & how they work together.

Wondering how a web application penetration test actually works? We overview the 4 steps of our process so that you can know what to expect from your engagement.

With the debut of HITRUST CSF v11, it's important to know the dates for the phase-out of previous versions. We break down how it'll work for the i1 & r2 assessments so your transition goes smoothly.

With the debut of the Cloud Italy Strategy, cloud service providers may need to adhere to the new requirements. We break these down so that you can more easily jumpstart your compliance.

Internal audit teams can be big boons to an organization, but they're not always an option. We explain the benefits of these teams as well as an alternative to pursue for similar efficiency yields.

Now that HITRUST has released a new version of CSF, we explain what changes and updates have been made to your HITRUST assessment options in version 11. “New year, new me!”

Understand the true depth of the role management plays in a potential ISO 27001 certification, as laid out in clauses 5 & 9.3, so that you can better set expectations with leadership at your firm.

Current pace of software releases making it difficult to remain compliant with change management requirements? Learn how branch protection can help you in this & keep your software development secure.

Looking for insight on where to draw the boundaries of your ISMS? We break down the scoping clauses of the ISO 27001 standard so that you have a starting point regarding what needs to be included.