A Guide to CMMC Certification

CMMC requirements have been created from the best cybersecurity practices from both the private and public sectors to protect secure information. As an extension of this, the DoD will require the 300,000+ organizations within their supply chain to carry a CMMC certification. In compliance with FAR 52.204-21 & DFARS 252-204-7012, after September 30, 2025, the DoD will no longer continue to work with contractors or subcontractors who do not hold a CMMC certification. As an authorized and accredited CMMC Third Party Assessment Organization(C3POA) by the CMMC Accreditation Body, Smithers can help your business attain a cybersecurity certification and ensure you don't lose out on a valuable contract.

The 5 Levels of CMMC Certification

The Cybersecurity Maturity Model Certification is based on levels, each of which builds upon the one before. According to CMMC requirements, a company must achieve at least level 1 CMMC certification to work on a DoD contract. Specific contracts will require CMMC certification in different levels, based on the sensitivity of the information that requires protection and perceived threats. The DoD will specify which level of CMMC you require in Requests for Information (RFIs) and Requests for Proposals (RFPs). These levels are designed to take from existing cybersecurity standards for protecting Federal Contract Information (FCI) and Controlled Unclassified Information (CUI), including ISO 27001, NIST 800-171 and others. The CMMC certification levels are:

● Level 1 - Basic Cyber Hygiene (17 Practices)

● Level 2 - Intermediate Cyber Hygiene (72 Practices)

● Level 3 - Good Cyber Hygiene (130 Practices)

● Level 4 - APT (156 Practices)

● Level 5 - Optimized (171 Practices)

Cybersecurity Certification Roadmap

Smithers' cybersecurity certification roadmap is easy and will put you on the path to achieving your CMMC certification as soon as possible. To become CMMC certified, you'll have to follow some simple steps. First, you will have to identify your desired maturity level of CMMC certification. You can pre-assess your capabilities with Smithers' Cybersecurity Audit Certification Services to ensure you're ready to take your assessment. Once you feel prepared enough, you can then conduct your CMMC assessment with Smithers' certified assessment team. Smithers will be given an allowance of up to 90 days to resolve any findings. After any results are resolved, your assessment will be reviewed by the CMMC-AB. Upon approval by the CMMC-AB, your 3-year CMMC certification will then be issued! Smithers will submit a copy of the assessment report and CMMC certificate to the DoD, so you can begin to apply for contracts immediately.

Why You Need a CMMC Certification

If you're a small business, commercial contractor or foreign supplier that has, or is looking to have, a contract with the DoD, a CMMC certification is your only option. The cybersecurity certification path came into public knowledge around 2019, and many government contractors and subcontractors have already begun their preparations. Don't lose out to the competition. Request a quote from Smithers today to attain a cybersecurity maturity model certification for your business and hold a competitive advantage over the rest. Pair your CMMC certification with our other Cybersecurity Services to achieve the maximum level of security for sensitive data and a top ISS Cyber Risk Score.

Request a Quote for CMMC Certification Today