Compliance with DFARS and CMMC is essential for any contractor or subcontractor hoping to work with the DoD. But compliance is not a one-and-done proposition. You will need to renew your CMMC certification every three years, as well as annually self-affirming your compliance. Maintaining compliance beyond certification requires effort and commitment. To ensure your efforts are keeping you compliant, you will need to perform periodic reviews, which can be conducted either internally within your own organization or led by an external third-party, and there are benefits and drawbacks to each.
Internal Reviews
Internal reviews are performed by employees of your organization. The reviewers should have some knowledge of the systems and processes they are reviewing. Ideally, they will be independent of the departments or groups being reviewed, although not all businesses—particularly small and medium-sized companies—have the resources to support an internal, independent review team.
In any case, you should approach an internal review as you would an external one. Before starting, plan your approach and identify the participants, the systems to be reviewed, and the scope of the review. The reviewers must strive to be objective while performing their work, adopting the point of view of the DoD. Upon completion, a report should be issued, indicating which requirements continue to be met and identifying any gaps or vulnerabilities, which then need to be addressed in a plan of action.
Benefits of internal reviews:
Drawbacks of internal reviews:
External Assessments and Reviews
External assessments and reviews (or mock assessments) are performed by professional assessors outside of your organization. These assessors will not be as familiar with your systems as your own employees are, but they provide valuable expertise and knowledge of the regulatory requirements being assessed.
When engaging an external assessor, look for an authorized C3PAO or RPO with CMMC Certified Assessors (CCAs) and confirm they are listed in the Cyber AB Marketplace. If you are ready for recertification, you will need to engage a C3PAO who has not previously performed consulting services for you. If you are looking for a consultant to perform a review that will help you prepare for recertification, you can use a C3PAO or an RPO. Either way, you want an organization that has expertise with CMMC and NIST SP 800-171, and has performed assessments against those requirements. You should also review the credentials of the assessors and other professionals who will be working with you.
As with internal reviews, you can make the most of the engagement by planning ahead, clearly identifying the scope of the assessment, the systems involved, and the personnel who will work with the assessment team. During the assessment or review process, make sure your employees are available to cooperate with the assessors, answering questions or providing documentation or demonstrations as needed. The assessment team will provide a final report identifying met requirements and gaps, which you must address with a POA&M, including the date when you expect to bring each requirement into compliance.
Benefits of external reviews and assessments:
Drawbacks of external assessments and reviews:
Which Type of Review Is Better?
The answer is both!
Since each type of review has its strengths and challenges, ideally you will make use of both types. Internal reviews can (and should) be done more frequently; and, if necessary, you can limit the scope of a review to a particular area of concern each time. However, CMMC will require an annual affirmation of compliance, so it is recommended you do a complete internal review at least once a year. The thoroughness and expertise of an external assessment or review is also necessary, especially when you are preparing for recertification. You will need an external assessment every three years at a minimum, but more frequent external reviews will also benefit you. The more frequently you conduct each type of review, the more confidence you can have in your cybersecurity posture and the greater likelihood of your maintaining compliance; although, of course, you need to balance these considerations against your available time and resources. By strategically implementing both review and assessment types, you can use the results of your internal reviews to ensure your systems are robust and compliant, positioning you for quick and efficient external reviews and assessments when needed.
CyberNINES can help you with both types of assessments. As an authorized C3PAO, we can perform external reviews and assessments, as well as offering tips and advice for how to best conduct your own internal reviews. Contact us and see how we can help.
Resources