Lockheed Martin Corporation · NYSE:LMT
Lockheed Martin — CMMC Level 3 Readiness Supplier Webinar (October 2020)
16 slides from Lockheed Martin's conference presentation, Oct 22, 2020
Slide 1: CMMC Level 3 Readiness Supplier Webinar
1 CMMC Level 3 Readiness Supplier Webinar “Bridging the Gaps to Accelerate CMMC Preparation” October 22, 2020 PIRA CET20200500 1
Slide 2: Disclaimer
DISCLAIMER • Webinar content is based on: o Office of Under Secretary of Defense (OUSD) CMMC Info o National Institute of Standards & Technologies (NIST) publications o National Archives & Records Administration (NARA) definitions o Defense Industrial Base Sector Coordinating Council (DIB SCC) Suppl
Slide 3: Learning Objectives
LEARNING OBJECTIVES • Provide a baseline understanding of CMMC • Clarify differences between NIST SP 800-171 & CMMC v1.02 Level 3 • Highlight common NIST interpretation challenges and information sources • Explain Lockheed Martin’s expectation for CMMC deployment • Prepare for CMMC assessment PIRA C
Slide 4: Cybersecurity Maturity Model Certification Overview
CYBERSECURITY MATURITY MODEL CERTIFICATION OVERVIEW CMMC Model Framework Domains (17) Capabilities (43) Practices (171) • What is CMMC? Key sets of cybersecurity Achievements to ensure Activities required by capabilities cybersecurity within each level to achieve a domain capability o New DoD cybers
Slide 5: CMMC Deployment Expectations
CMMC DEPLOYMENT EXPECTATIONS • OUSD scheduled release of RFI’s with CMMC requirements starting 2020 • OUSD will identify contracts w/CMMC requirements during FY21-25 roll-out • CMMC rollout expected to complete by 2026 • Lockheed Martin working with DoD on Q2 – Q3 2020 pathfinder (Table Top exercise
Slide 6: Do I Need to Be CMMC Level 3 Compliant?
DO I NEED TO BE CMMC LEVEL 3 COMPLIANT? • If you currently receive Controlled Technical Information (CTI) or CUI provided by your customer or generated (developed, collected, transmitted or stored) by, or on behalf of, the contractor in support of the performance of the contract. Examples of CTI: o
Slide 7: NIST 800-171 vs. CMMC Requirements
NIST 800-171 VS. CMMC REQUIREMENTS NIST 800-171 CMMC Level 3 CMMC Levels 4 & 5 POA&M’s allowed No POA&M’s allowed No POA&M’s allowed Contract work allowed if No work allowed until certified No work allowed until certified controls are not 100% that all requirements are that all requirements are impl
Slide 8: Common NIST Interpretation Challenges
COMMON NIST INTERPRETATION CHALLENGES NIST 800-171 Control Requirement Clarifying Questions Control # (CMMC (CMMC Domain) practice #) Source: NIST HB 162 -Self-Assessment Handbook For Assessing NIST SP 800-171 • Do you only grant enough privileges to users to allow them to 3.1.1,.4,.5 (AC 1.001, Acc
Slide 9: Common NIST Interpretation Challenges
COMMON NIST INTERPRETATION CHALLENGES NIST 800-171 Control Requirement Clarifying Questions Control # (CMMC (CMMC Domain) practice #) Source: NIST HB 162 -Self-Assessment Handbook For Assessing NIST SP 800-171 • Is the use of writable, removable media restricted on the 3.8.7,.8 (MP.1.121, Media Prot
Slide 10: Common NIST Interpretation Challenges
COMMON NIST INTERPRETATION CHALLENGES NIST 800-171 Control Requirement Clarifying Questions Control # (CMMC (CMMC Domain) practice #) Source: NIST HB 162 -Self-Assessment Handbook For Assessing NIST SP 800-171 • Have collaborative computing devices (e.g., cameras, microphones, etc.) been configured
Slide 11: Maturity Level 3 – Not Just a Checklist
MATURITY LEVEL 3 – NOT JUST A CHECKLIST • Demonstrate CMMC compliance with effective Policies and Documentation: o Define your organization’s response to cyber incidents Major Highlights: o Develop processes and procedures • e.g. CM.3.067: Define, document, approve, and enforce physical and logical
Slide 12: Relationship Between Practices and Processes
RELATIONSHIP BETWEEN PRACTICES AND PROCESSES XX.2.999: Establish a policy that includes XX domain • Develop and publish organizational policy for the process XX.2.998: Document the CMMC practices to implement the XX domain policy • Practices are established, documented, and followed to implement the
Slide 13: Access Control Domain Example
ACCESS CONTROL DOMAIN EXAMPLE AC.2.999: Establish a policy that includes Access Management • Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems) • Work from Home (WfH) and Bring Your Own Device (BYOD) P
Slide 14: Key CMMC and CUI Information Sources
KEY CMMC AND CUI INFORMATION SOURCES • Official CMMC document source • Official CMMC Updates • Official CMMC FAQ • Exostar blog entry on CMMC • Cyber Assist (CMMC help website) • CMMC Accreditation Body • CMMC For Suppliers • CMMC Vs. NIST 800-171 and other Frameworks • CUI Categories • CUI Training
Slide 15: Q & A
Q&A PIRA CET20200500 LOCKHEED MARTIN a 15
Slide 16: PIRA CET20200500
LOCKHEED MARTIN PIRA CET20200500
Lockheed Martin — CMMC Level 3 Readiness Supplier Webinar (October 2020) on 6ix