CMMC Update - Part 2(b) - Getting Certified
Ken Bloch, Director, Maine PTAC

At the risk of sounding like a broken record, this month is the third (and final…for now) installment on the new CMMC implementation. This time we will focus on the subject of getting certified.
If you have been following our articles on the subject over the past year, DoD has rolled out a new cybersecurity standard known as the Cybersecurity Maturity Model Certification, or CMMC. It is a multi-level set of standards required to generate, store or process unclassified government information.
The issue of certification is important, because CMMC is designed to be a requirement to receive an award. In simplest terms, if you aren’t certified at the appropriate level, you can’t be issued a new contract (DoD estimates that 60% of DoD contractors will need Level 1). This requirement will be rolled out over the next several years. Needless to say, this has prompted a lot of companies to start advertising that they can get you certified for CMMC now – for a fee, of course.
That is absolutely not the case. They can’t.
The process is designed for only certain firms to be trained and approved as certifiers by an accrediting body. That board is only now training the first group. And when that group comes online, their first priority will be certifying the small group of companies that DoD has preselected for review based on the specialized, high-risk work that they do.
Once sufficient certifiers are trained, then you can apply to them. Depending on the level that you seek, you will probably have to do some work to get your systems in order. And there will be a cost for the actual assessment/certification itself. DoD estimates that Level 1 assessment will cost firms about $3,000 every three years. DoD will also be training the national PTACs, not to certify, but to assist businesses in getting ready for at least Level 1. More to come on that later.
Lots of moving part still. In the meantime, do NOT sign up with any company that tells you that they can certify you. That is coming, but its not here yet, so save your money.
Questions on CMMC? Please reach out to your local counselor or any of us with your questions or to request assistance. Maine PTAC will be ready to help you. Oh, and stay safe and wash your hands!