Slide 1: Supplier Cybersecurity Readiness Webinar
Supplier Cybersecurity Readiness Webinar Cybersecurity Webinar: Complying with DFARS 252.204-7020 (NIST Assessment) and Preparing for CMMC – Delta Practices & Assessment Prep May 25 2021 ©2021 Lockheed Martin Corporation 1
Slide 2: Disclaimer
Disclaimer • Webinar content is based on: o Office of Under Secretary of Defense (OUSD) CMMC publications o National Institute of Standards & Technologies (NIST) publications o Carnegie Mellon University (CMU) Software Engineering Institute (SEI) Computer Emergency Response Team (CERT) publications
Slide 3: Learning Objectives
Learning Objectives • CMMC Level 3 – NIST 800-171 plus • Preparing for CMMC assessment: Lessons Learned from Mock Assessments & Training – Follow the Data – Get To Know: Assessment Guide/Practices/Assessment Objectives • Essential Artifacts • Evidences • Inter-Connected Practices • Explain Lockheed
Slide 4: Level 3 Background and Delta 20
Level 3 Background and Delta 20 Model leverages multiple sources and references • CMMC Level 3 includes all of the Level 1 – Level 3 practices from NIST SP 800-171 as well as others CET202105006 4
Slide 5: What are the Delta 20 practices?
What are the Delta 20 practices? • The CMMC Practices and their Source Mapping can be found in Appendix E of the CMMC Appendices V1.02 - The Practices in Level 1-3 without an entry in the NIST SP 800-171 Rev 1 column AM.3.036 AU.2.044 AU.3.048 IR.2.093 IR.2.094 IR.2.096 IR.2.097 RE.2.137 RE.3.139 RM
Slide 6: Documentation, Documentation, Documentation
Documentation, Documentation, Documentation • There are 3 Maturity Processes applied to each of the 17 domains – ML.2.999 -- Establish a policy – ML.2.998 -- Document the CMMC practices to implement the policy – ML.3.997 -- Establish, maintain, and resource a plan – L3 Assessment Guide defines the A
Slide 7: What does the Assessment look like?
What does the Assessment look like? Phase IV: Phase I: Planning Phase II: Conduct Phase III: Report Remediation/ Adjudication REMEDITATION • OSC contacts C3PAO • Assessment Team • Initial scope agrees to remediation information gathered • C3PAO forwards request for approval • C3PAO identifies and •
Slide 8: Pre-work analysis activities/artifacts
Pre-work analysis activities/artifacts • OSC Sponsor and Lead Assessor will determine the assessment scope • Complete Self-Assessment using L3 Assessment Guide • Gather Essential Artifacts for Assessment Team to review – System Security Plan – Network Diagram and Information Flow Diagram (informatio
Slide 9: Assessment Observation Activities
Assessment Observation Activities • OSC should become intimately familiar with the CMMC L3 Assessment Guide and the Assessment Objectives associated with each practice • Each practice will require two types of Objective Evidence – Assessment Objectives identify the specific list of objectives that m
Slide 10: Assessment Observation Activities cont.
Assessment Observation Activities cont. CET202105006 10
Slide 11: Second half of Assess Guide
Second half of Assess Guide Objects CET202105006 11
Slide 12: Interconnected Control Examples
Interconnected Control Examples • AC.1.001, controls system access based on user, process or device identity – Leverages IA.1.076 • AC.2.013, requires the control of remote access sessions – Complements 5 other practices • MP.1.122, requires all media, hardcopy and digital, must be properly marked t
Slide 13: Lockheed Martin's Expectations
Lockheed Martin’s Expectations • Continue to progress your NIST 800-171 implementation… Full implementation (closing all POAMs) is foundational to Cybersecurity Maturity Model Certification (CMMC) Readiness o Accurately maintain your vendor profile in Exostar TPM (applicability of cyber DFARS requir
Slide 14: Additional Cybersecurity Resources
Additional Cybersecurity Resources • Key CMMC and CUI Information Sources o Official CMMC document source o Official CMMC Updates o Official CMMC FAQ o Exostar blog entry on CMMC o Cyber Assist (CMMC help website) o CMMC Accreditation Body o CMMC For Suppliers o CMMC Vs. NIST 800-171 and other Frame
Slide 15: Questions & Answers
Questions & Answers 15
Slide 16: Lockheed Martin
LOCKHEED MARTIN