In the ever-evolving world of managed service providers (MSPs), standing out from the competition is paramount. Historically, my focus as an MSP owner has been on delivering top-notch cybersecurity and compliance solutions. However, as the industry shifts towards a more comprehensive approach, incorporating Governance, Risk, and Compliance (GRC) into our offerings has become essential. This transition opens new revenue streams and opportunities to aid our clients in achieving compliance through sophisticated tools provided by leading vendors.
Yet, with these opportunities come challenges and a sense of caution. Having navigated through various audits such as the Defense Information Systems Agency’s Command Cybersecurity Readiness Inspections and frameworks like SOC2 and ISO 27001, I’ve noticed a significant difference with the introduction of the Cybersecurity Maturity Model Certification (CMMC). Unlike previous frameworks, the CMMC uniquely includes “External Service Providers” in the audit scope, posing new implications for MSPs working with defense contractors.
Are MSPs ready to jump into CMMC?
The proposed CMMC framework mandates that MSPs, unless they are cloud service providers, must possess a CMMC certification level equal to or surpassing that sought by their clients. This requirement signifies a considerable shift, as MSPs must now undergo assessments and obtain certifications based on the Controlled Unclassified Information (CUI) they manage. The cost implications are substantial, with assessments for small businesses estimated between $35,000 to $45,000. This does not account for additional expenses associated with preparing necessary documentation such as Systems Security Plans and Policies and Procedures.
Furthermore, the certification process transforms MSPs into Organizations Seeking Certification (OSC), adding another layer of complexity. For instance, utilizing a Cloud Service Provider (CSP) that is FedRAMP Moderate authorized, or equivalent, becomes crucial for MSPs handling CUI in a CMMC Level 2 context. This requirement extends to the tools MSPs employ to manage and secure client systems, ensuring they meet FedRAMP Moderate or equivalent standards and are included in the assessment scope for CMMC. This challenges an MSP’s entire IT and Security stacks to ensure that they can meet this level of compliance or find an alternative solution.
The implications of the CMMC framework underscore the need for MSPs to thoroughly understand and prepare for the compliance requirements of the tools and services they provide. As we pivot towards selling compliance solutions, recognizing the potential in-scope audits and the associated costs is critical, especially when operating in sectors such as defense.
In essence, while the opportunity to sell compliance and enhance our service offerings presents an exciting frontier for MSPs, it also demands a keen awareness of the regulatory landscape and its impact on our operations. As we navigate this complex terrain, staying informed and proactive will be key to not only ensuring compliance but also sustaining growth and competitiveness in the cybersecurity domain.
Next Steps
For MSPs: Preparing for CMMC Certification
- Understand the CMMC Framework: Begin with a thorough review of the CMMC framework to understand the certification levels and the specific requirements for each. Familiarize yourself with the processes and practices that span across maturity levels, from basic cyber hygiene to advanced.
- Conduct a Gap Analysis: Perform a comprehensive gap analysis against the CMMC requirements to identify areas where your current security practices may fall short. This will help you pinpoint specific improvements needed to meet the desired certification level.
- Invest in Training and Awareness: Through Licensed Training Providers, ensure your team is well-versed in CMMC requirements and cybersecurity best practices. Investing in CMMC training will not only prepare your staff for the certification process but also enhance the overall security posture of your operations. Get your staff certified
- Strengthen Your Security Infrastructure: Based on the gap analysis, upgrade your cybersecurity infrastructure to meet or exceed the CMMC requirements. This includes implementing robust cybersecurity tools, processes, and policies that align with the CMMC standards.
- Develop Comprehensive Documentation: Prepare and maintain detailed documentation, including System Security Plans (SSP), Plan of Actions and Milestones, Policies, and Procedures. This documentation is crucial for demonstrating compliance during the CMMC assessment process.
- Engage with a CMMC Certified Third Party Assessor Organization (C3PAO): Early engagement with a C3PAO can provide valuable insights into the certification process and help identify any potential issues before the formal assessment.
For Organizations Utilizing MSPs: Ensuring MSP Readiness
- Verify Certification Status: Ask your MSP for proof of their CMMC certification or their plan to achieve certification. Ensure their certification level meets or exceeds the level required for your organization.
- Review the MSP’s Security Practices: Request information on the MSP’s cybersecurity practices, tools, and policies. Ensure they align with CMMC requirements and your organization’s security needs.
- Get a copy of the Shared Responsibility Matrix: This defines who is responsible for each of the 320 assessment objectives of the NIST 800-171A.
- Assess the MSP’s Experience with Compliance: Inquire about the MSP’s experience in navigating compliance frameworks and their history with audits. Experience with frameworks such as FedRAMP, ISO 27001, or SOC2 can be indicative of their readiness for CMMC.
- Discuss the MSP’s Approach to Documentation: Ensure your MSP has a solid approach to creating and maintaining the necessary documentation for CMMC compliance, including their role in your organization’s documentation process.
- Collaborate on a Security Roadmap: Work with your MSP to develop a security roadmap that outlines steps to achieve and maintain compliance. Regular reviews and updates to this roadmap can help ensure ongoing compliance with CMMC and other relevant cybersecurity standards.
Take Action Towards CMMC Readiness Today
As the cybersecurity landscape continues to evolve, the introduction of the Cybersecurity Maturity Model Certification (CMMC) marks a significant shift in how defense contractors and their Managed Service Providers (MSPs) approach cybersecurity and compliance. The time to act is now—whether you’re an MSP aiming to differentiate your services or an organization seeking to fortify your defense supply chain.
For MSPs: Elevate your cybersecurity offerings and ensure your readiness to meet the stringent demands of the CMMC. Begin by assessing your current cybersecurity posture, identifying gaps, and implementing robust security measures. Let’s not wait for compliance to become a barrier to business—transform it into your competitive advantage.
For Organizations in the Defense Sector: Your operational integrity and compliance with CMMC are paramount. Ensure your MSP is not only prepared but fully aligned with the CMMC requirements to safeguard your operations against evolving cyber threats. Take the step to assess and engage with MSPs who demonstrate a proactive approach to CMMC compliance.
Join us in leading the charge toward a more secure and compliant future. Reach out to discuss how we can support your journey to CMMC certification and beyond, ensuring you’re not just ready for today’s challenges but prepared to meet tomorrow’s as well. Together, we can navigate the complexities of cybersecurity compliance and emerge stronger.
