CMMC
BSC provides a CMMC 2.0 Solution tailored for your organization
BSC has extensive experience over the last fifteen years helping organizations navigate the FISMA NIST 800-53 requirements and obtain their government client’s Approval to Operate.
BSC also assists multiple government contractors with the DFARS and NIST 800-171 requirements, including guiding them through the SPRS process through performance of an independent assessment and SPRS score determination.
We have leveraged this experience to become a CMMC-AB Registered Practitioner Organization and developed a robust set of CMMC practices. Our Registered Practitioners are available to help you prepare for your CMMC Assessment through a work cost effective multi-phase process:
- PRE-CMMC PHASE – We can assist you with any NIST 800-171 and SPRS requirements to meet your contract requirements. This includes an assessment against the required controls and calculation of your SPRS score. We will also provide a Plan of Action and Milestones (POA&M) for any open findings. We can then guide you on the SPRS process for entering your score and uploading the POA&M.
- CMMC DETERMINATION PHASE including definition of system boundary and CMMC Level Assessment.
- CMMC READINESS ASSESSMENT – Full CMMC GAP Analysis of all practices based on the required CMMC level.
- CORRECTIVE ACTION PLAN – We provide an action plan to correct deficiencies detected during the Gap Analysis.
- POLICIES, PROCEDURES and PLAN DEVELOPMENT – We have a template for policies and procedures for each of the CMMC domains.
- REMEDIATION PHASE – BSC can provide technical assistance with finding remediation solutions.
- CMMC ASSESSMENT PACKAGE – Finally, we will prepare your organization for the formal C3PAO review. We will provide assistance preparing a repository with documentation and two examples of objective evidence for each practice.
Free Consultation
Remember, there is no charge for the initial phone consultation!
A Quick Look at CMMC 2.0 Levels
The CMMC combines various cybersecurity standards and best practices across several maturity levels ranging from basic cyber hygiene to dealing with advanced persistent threats, and maps these practices and processes across these levels. Based on the latest information, the following are the CMMC levels and their respective requirements. Each level includes the requirements of the previous level.
Level 1
Basic Cyber Hygiene
“Basic Cyber Hygiene” – This is the basic initial level that requires implementing 17 practices from NIST 800-171.
Level 2
Good Cyber Hygiene
”Good Cyber Hygiene” – This requires the 110 practices aligned with NIST 800-171.
Level 3
Advanced / Progressive
“Advanced / Progressive” – This is also still in the planning stages but could include potential new CMMC practices.
