Ready or Not: First CMMC Level 2 Certification Requirement Hits SAM.gov
The Department of Defense has officially mandated CMMC Level 2 certification for contractors bidding on the Army’s Marketplace for the Acquisition of Professional Services (MAPS). This crucial update underscores the DoD's commitment to strengthening cybersecurity across its supply chain. In this blog post, we’ll discuss what this requirement means and how contractors can effectively prepare for compliance.
If you thought it was going to be a year or more before we saw CMMC Level 2 in solicitations, think again. Fresh off the effective date for CMMC, the Department of Defense (DoD) just raised the bar for contractors hoping to sign a contract in the recently published solicitation for the Army’s Marketplace for the Acquisition of Professional Services (MAPS). Within this updated solicitation, the requirement for CMMC Level 2 certification was added as a gate criteria to bid officially on the contract.
Earlier Than Expected
The final rule for the Cybersecurity Maturity Model (CMMC) 2.0 initiative went into effect December 16, making the long-anticipated changes “official” at last. While the 32 CFR final rule phases in CMMC in contracts based on the effective date of the final 48 CFR rule, the MAPS solicitation indicates that we may see the requirements much earlier.
Unpacking the MAPS Procurement Opportunity
MAPS is an Indefinite Delivery/Indefinite Quantity (IDIQ) contract. Essentially, it’s a huge contract that enables the Army to streamline the process for acquiring professional support services, including consulting, logistics, and training. The Army uses MAPS as an umbrella contract for multiple support needs instead of issuing several smaller contracts for different needs. The newly updated Draft 2 of Sections L&M includes the language:
“Please provide proof of your CMMC Level 2 or higher Certification or documentation showing that you have contacted a Certified Third-Party Assessment Organization and scheduled your CMMC Level 2 review.”
In other words, contractors cannot submit a bid for MAPS without meeting the basic gate criteria of either a CMMC Level 2 certification or a scheduled assessment. The final bid date for MAPS, as of this writing, is anticipated to be in March 2025. The award date is set for August 2025, although the Army doesn’t anticipate releasing its first task orders under MAPS until sometime in 2027.
Note that the anticipated time of award would likely be after the start of Phase 2 of CMMC implementation which is when CMMC can be considered a condition of award. It’s also interesting that the Army chose to address the likely bottleneck around getting certified by simply requiring an assessment to be scheduled.
Scheduling Assessments
Scheduling the assessment is typically the last step in the CMMC journey. To be ready, a contractor needs to do the work to be ready. On average, most organizations can anticipate it taking 12 to 18 months from start to assessment-ready, so starting now and either completing certification or being prepared for an audit by March 2025 is unrealistic. The certification processes include multiple stages, including:
- Engage a Knowledgeable Partner: A trusted partner can help you successfully complete CMMC certification more quickly.
- Complete a Scoping Exercise: Understand what’s in scope for your CMMC certification using the official scoping guide or work with a trusted partner to accelerate your progress.
- Deploy and configure technology: Most companies require at least a technology refresh, if not a full overhaul of their IT networks in order to meet NIST 800-171 Rev2.
- Manage and monitor: Configuring the services required to align to NIST 800-171 is only the start. Companies must also execute a mature operational framework to achieve and remain within compliance.
- Create Detailed Documentation: Document security policies, incident response plans, assets, and personnel. Include who interacts with Controlled Unclassified Information (CUI), the systems that store, process, or transmit CUI, CUI data inventory and segmentation plans, and more.
- Schedule CMMC Assessment: Contact a C3PAO to schedule an assessment. There’s limited availability, so getting on the schedule is important in order to submit a bid for MAPS.
C3 Integrated Solutions Accelerates CMMC 2.0 L2 Compliance
If you are one of the many organizations that has waited to see how CMMC develops before taking action, now is the time to get started. This is just the first contract to include this gate-keeping clause, but there are certain to be more contracts coming soon that have embedded contract requirements for CMMC compliance.
C3 Integrated Solutions created the Steel Root portfolio of CMMC services and solutions to help you achieve compliance quickly and completely. With a prescriptive design and mature operational processes, we can accelerate readiness for CMMC. Our Steel Root Compliance Program fulfills 80% of all CMMC L2 requirements and supports you with the remaining 20%. It includes:
- Steel Root Reference Architecture: Featuring a defined use case and system boundary, FedRAMP-authorized cloud services, vetted baseline configuration, and system implementation.
- CMMC-Focused Managed Services: Provides systems administration, support desk, security monitoring, standardized procedures and processes, managed platform configuration updates, as well as continuous system review and managed improvements.
- Compliance Advisory Services: Delivers a managed compliance program, organizational policy and procedural development, assessment-ready documentation, assessment prep and assistance, and ad hoc consulting
For organizations that already have a trusted compliance partner, we offer the Steel Root Technology Platform. This platform is a fully managed system that meets 100% of IT-related CMMC L2 assessment objectives. It includes everything in the compliance program except the compliance advisory services.
If you need help navigating your way to CMMC Level 2 certification, reach out to C3 Integrated Solutions now.
Meet the Author
