Question 1

Can you get me compliant in 3 days?

Accepted Answer

Any vendor, regardless of the solutions they provide, that tell an organization they can get the company’s IT environment compliant in just a few days are giving false hope. Becoming compliant with NIST SP 800-171 includes many variables like network architecture, the way CUI flows through the network, the network’s current cybersecurity posture, and the quality of the organization’s documentation like the System Security Plan and cybersecurity policies.

It is possible to get a cybersecurity program that meets the CMMC requirements stood up in a few months, but most organizations will need 6-12 months to become compliant.

Question 2

How will my current business model be impacted by the remediation?

Accepted Answer

It will depend on the company’s current cybersecurity posture and operations. Most organizations we’ve worked with have had to introduce, at a minimum, new processes and workflows that added new responsibilities to some team members.

Organizations that have minimal technical cybersecurity controls can experience a substantial adjustment to the way the currently work. It’s important for organizations to have as clear of an understanding how implementing the CMMC controls will impact their operations as possible before beginning the remediation process.

Question 3

What can we expect throughout the remediation process?

Accepted Answer

It is very similar to the Bruce Tuckman’s Theory of Team Development: Forming, Storming, Norming, and Performing. The team will put together an initial outline of what needs to be done and likely feel hopeful as roles and responsibilities are defined. As the project continues, conflict may arise as the team finds that certain processes must be revised, or technical controls implemented, to be compliant that don’t align well with the organization’s current method of operations.

Then, as the team beings to better understand why the change is required and accepts its need, the organization can begin to settle into the new workflow and normalcy is established. At this point, most conflicts are resolved, most processes are in place, and the organization is operating a peak performance with the inclusion of the new cybersecurity controls.

Question 4

Is this a one and done remediation or do I need to maintain compliance?

Accepted Answer

This is an ongoing requirement organizations need to monitor and maintain. Unfortunately, we can’t all simply high five after receiving a CMMC Level 2 Certificate of Status and then put it on the mantle for viewing.

There are controls that require continual effort to demonstrate compliance every year. It's a journey, not a destination.

Aethon Guide

Have additional questions?

Frequently Asked Questions

Your trusted partner in cybersecurity and compliance.