CMMC: what it is, how it, works, and how to get ready
The new Cybersecurity Maturity Model Certification (CMMC) will soon be required for ANY defense contractor with a CUI (Controlled Unclassified Information). This includes vendors of all sizes and in any country. Suppliers to Canadian government also need to get ready. In winter 2025, Canadian Department of Defense contracts will have a similar requirement for any company bidding on defense contracts.
KDM Analytics’ Blade RiskManager receives shout-outs in this Active Cyber Zone podcast episode, which is must-listen programming for anyone bidding (or hoping to bid) on defense contracts. Chris Daly, host of the podcast, speaks with Leighton Johnson, CISSP, CISM and Joe Jarzombek, PMP, CSSLP – cybersecurity experts with extensive government experience. They cover:
- The origins of CMMC at US Department of Defense and how it has evolved (model 2.11 will emerge from the current federal review)
- How to be certain that you, your product, or service will be affected – and by when (hint: DoD has already started the process with current its contractors)
- How to prepare for CMMC and how long it will take your organization to get ready
- Similar requirements emerging from defense departments in Canada and Europe
- Additional controls that will apply to the large defense vendors and whether that flow down to sub-contractors
- The value of doing your own internal assessment before a third-party (or DoD) gets involved
- The critical role of SBoMs in threat detection
- Tools you’ll need to get ready (KDM Analytics’ Blade RiskManager gets a big nod), and considerations around the use of AI to automate the process
Contact
For more details about third-party CMMC assessments, contact:
T: +1 (301) 984-4193
E: info@acquiredata.com
KDM Analytics
Djenana Campara
T: +1 (613) 627-1010 (Canada)
T: +1 (315) 605-1059 (U.S.A.)
E: info@kdmanalytics.com