.png)
The final rule states that Managed Service Providers (MSPs) working with Defense Industrial Base (DIB) contractors must comply with the Cybersecurity Maturity Model Certification (CMMC) requirements to ensure the protection of Controlled Unclassified Information (CUI) and Federal Contract Information (FCI). Here are the key compliance requirements:
CMMC Level Alignment: MSPs must achieve the same CMMC level as their DIB clients. This means if a DIB contractor requires Level 3 compliance, the MSP must also be certified at Level 3.
Implementation of NIST SP 800-171 Controls: MSPs must implement the 110 security controls outlined in NIST SP 800-171, which includes measures for access control, incident response, and system and communications protection.
System Security Plan (SSP): MSPs need to document their compliance status, including any plans of action and milestones (POA&Ms) to address gaps, in a System Security Plan.
Regular Security Audits and Incident Response: MSPs must conduct regular security audits and have comprehensive incident response plans in place to quickly address and mitigate any security incidents.
Flowdown Requirements: MSPs must ensure that any subcontractors they work with also comply with the relevant CMMC requirements, ensuring the protection of CUI throughout the supply chain.
Self-Assessment and Reporting: MSPs must perform self-assessments and report their compliance scores in the DoD’s Supplier Performance Risk System (SPRS), with authorization from a senior leader.
Why eTrepid is Your Trusted Partner At eTrepid, we are well-versed in CMMC compliance and can help guide your organization to meet these new requirements. Whether it’s securing FCI, implementing advanced protection for CUI, or navigating the complexities of CMMC certification, we’re here to ensure you’re ready for success.
Let’s Secure Your Future Together Ready to stay compliant and safeguard your sensitive information? Contact us today to make eTrepid your trusted cybersecurity partner.
Comments