CMMC Compliance Assessment Services
If CMMC or NIST 800-171 compliance is vital to your business’ future success, you can trust Linford & Company LLP to guide you on your compliance journey
"*" indicates required fields
What is CMMC and NIST 800-171?
The Cybersecurity Maturity Model Certification (CMMC), based on National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, is a comprehensive framework supporting the assessment of compliance requirements designed to support the secure implementation and operation of systems that store, process, or transmit sensitive information. While it is directly applicable to any organization within the Defense Industrial Base (DIB), other industries also rely on 800-171 to establish a level of assurance in relation to the handling of sensitive data shared between organizations.
Who does CMMC and NIST 800-171 apply to?
Businesses directly or indirectly supporting the Department of Defense (DoD) and that handle controlled unclassified information (CUI) are required to undergo a CMMC assessment as a requirement for contract award. In addition to the defense community, other industries often leverage NIST 800-171 compliance, which is the basis for CMMC as a required element in contracts and other business agreements.
What is Controlled Unclassified Information?
According to the National Archives, the party responsible for establishing the Controlled Unclassified Information (CUI) program, CUI is “information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies but is not classified under Executive Order 13526 or the Atomic Energy Act, as amended.” Therefore, CUI is sensitive data, which could include PII, ePHI, and data elements from more than 20 categories, as defined in the CUI Registry. Due to the broad coverage of the CUI designation, many industries outside of the DoD (i.e., energy production and distribution) rely on 800-171 compliance to verify the safe handling of sensitive information.
How CMMC Works
What is the purpose of CMMC?
CMMC as a certification process was developed to enhance cybersecurity practices within the defense industry, and is intended to address evolving threats and protect information supporting programs and organizations which, in turn, support the DoD and the federal government. Initially released in 2020, the CMMC underwent a significant overhaul and version 2.0 was released in November 2021.
What is CMMC certification?
CMMC compliance certification is based on the satisfactory completion of an assessment by a C3PAO organization. The assessment is based on assessment procedures detailed in NIST SP 800-171A, as well as guidance provided by the DoD.
How do I get CMMC certified?
The CMMC Accreditation Body (CMMC-AB) will certify C3PAO organizations as well as the assessors who will participate in assessments. There are several phases in the process including readiness assessments, and, ultimately, certification by the CMMC-AB. Details about CMMC v2.0 implementation are evolving and some changes are expected to occur over the next year as final rulemaking is performed by the DoD. If getting certified is your goal, focus now on implementing the requirements in NIST SP 800-171 and the assessment objectives in NIST SP 800-171A.
How do CMMC and NIST 800-171 assessments work?
- Step One: Conduct a readiness assessment.
- Step Two: Engage in remediation activities to address compliance gaps.
- Step Three: Begin the assessment with a C3PAO.
- Step Four: Complete interviews, evidence collection, and other testing.
- Step Five: Obtain CMMC compliance certification.
What is the cost for CMMC certification?
Since the CMMC assessment and certification process is not yet finalized, the costs for CMMC certification can only be estimated. When considering the costs associated with certification, organizations should factor in a number of sources for the expenses associated with certification including staffing, technical control solutions, readiness assessment fees, as well as fees paid to a C3PAO firm for assessment services.
What is a C3PAO?
Within the CMMC ecosystem, those who perform assessments are known as CMMC Third-party Assessor Organizations, or C3PAO for short. C3PAOs are authorized to manage the assessment process and enter into contracts to deliver CMMC assessments. This is somewhat similar to the designation of 3PAO within the FedRAMP ecosystem; however, authorization as a 3PAO for FedRAMP does not authorize an organization to perform CMMC assessments. Linford & Company is currently a C3PAO candidate and is working towards completion of a Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) assessment against the CMMC v2.0 Level 2 requirements.
Our Certified CMMC Assessors
Richard Rieben
Partner | CSISSP, CCSFP, GSNA
Lois Colby
Partner | CPA, CIA, CISA
Mark Larson
Partner | CISSP, CISA
Big 4 IT Auditors
Our highly-experienced auditors simplify complex NIST requirements while delivering thorough CMMC assessments in an efficient manner.
Our
Partners
Our
Partners
Why Choose Linford & Company LLP
Achieve CMMC Compliance
Demonstrate CMMC compliance and achieve certification by partnering with an authorized assessor firm that employs only qualified auditors with experience in DoD and government certifications.
Flexible and Tailored Approach
Linford & Company tailors the audit process to meet the needs of our clients, and we leverage our own tools or our client’s chosen GRC platform to perform assessments.
Support from Professionals
Our auditors have worked with dozens of clients to help them navigate the complexities of assessments based on NIST requirements including NIST 800-53 and 800-171, the standards that CMMC compliance is based on.
Ready for a CMMC Compliance Assessment?
Fill out the form and we’ll put you in touch with one of our experienced auditors. Your contact information stays with us and is only used to talk with you about your CMMC or NIST 800-171 audit — we do not sell or share your contact information with anyone.
"*" indicates required fields