Get audit-ready for CMMC
CMMC 2.0 · Cybersecurity Maturity Model Certification
US Department of Defense framework requiring defense contractors to implement cybersecurity practices and processes at progressive maturity levels to protect controlled unclassified information.
CMMCWhat is CMMC?
US Department of Defense framework requiring defense contractors to implement cybersecurity practices and processes at progressive maturity levels to protect controlled unclassified information.
Who it applies to
Contractors and subcontractors in the defense industrial base handling federal contract information or controlled unclassified information. Flows down the supply chain, so smaller suppliers are pulled in by their primes.
How the standard is organised
Tiered levels of increasing rigour built on the NIST SP 800-171 requirements, with the assessment method — self-assessment or independent assessor — determined by the level.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
CMMC on the Bitkosh platform
The 149 CMMC controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- SC.L2-3.13.14Voice over Internet Protocol
Control and monitor the use of Voice over Internet Protocol technologies.
System and Communications Protection (SC) - RA.L3-3.11.4eSecurity Solution Rationale
Document or reference in the system security plan the selected security solution, its rationale and the risk determination.
Risk Assessment (RA) - CM.L3-3.4.1eAuthoritative Component Repository
Establish and maintain a trusted, authoritative source and repository of approved and implemented system components.
Configuration Management (CM) - IA.L3-3.5.3eTrusted Component Connection
Prevent components from connecting to organizational systems unless they are known, authenticated and in a properly configured state or trust profile.
Identification and Authentication (IA) - SI.L2-3.14.6Monitor Communications for Attacks
Monitor systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
System and Information Integrity (SI) - RA.L3-3.11.5eSecurity Solution Effectiveness
Assess security solution effectiveness at least annually, on relevant threat information or after a relevant incident.
Risk Assessment (RA)
More information security & cybersecurity frameworks
Frequently Asked Questions
Who publishes CMMC, and who does it apply to?
How is CMMC conformance demonstrated?
How is CMMC structured?
Ready to get audit-ready for CMMC?
See how the Bitkosh Readiness Platform gets you audit-ready for CMMC — and the other 47 ready frameworks — from a single control library.