CYBERSECURITY MATURITY MODEL
CERTIFICATION (CMMC)
DRAFT CMMC MODEL REV 0.4 RELEASE
& REQUEST FOR FEEDBACK
September 2019
Distribution A. Approved for public release
Agenda
• CMMC Overview
• Model Framework
• Model Details
– Summary of Changes
– Counts by Level and Domain
– Examples of Practices by Level
• Feedback Request
Distribution A. Approved for public release 2
CMMC Overview
Distribution A. Approved for public release 3
Introduction
• CMMC Vision
– Be a unified cybersecurity standard for DOD acquisitions to reduce exfiltration of
Controlled Unclassified Information (CUI) from the Defense Industrial Base (DIB)
• CMMC Schedule
– CMMC Rev 1.0 will be released in January 2020
– Will be included in RFIs starting in June 2020
– Will be included in RFPs starting in Fall 2020
• Multiple Opportunities for Stakeholder Feedback
– Listening Tour: Visit the website at www.acq.osd.mil/cmmc/
– Public comment of draft CMMC Rev 0.4 in September 2019
– Public comment of draft CMMC Rev 0.6 in November 2019
Distribution A. Approved for public release 4
What is CMMC?
• CMMC is the Cybersecurity Maturity Model Certification
– Combines various cybersecurity standards and “best practices”
– Maps these practices and processes across several maturity levels that range from basic
cyber hygiene to advanced
– For a given CMMC level, the associated practices and processes, when implemented,
will reduce risk against a specific set of cyber threats.
• The CMMC effort builds upon existing regulation (DFARS
252.204-7012) that is based on trust by adding a verification
component with respect to cybersecurity requirements.
• The goal is for CMMC to be cost-effective and affordable for small
businesses to implement at the lower CMMC levels
• The intent is for certified independent 3rd party organizations to
conduct audits and inform risk
Distribution A. Approved for public release 5
Request for Feedback of
Draft CMMC Model Rev 0.4
• As you review this midpoint release of the model, please consider:
– The final version of this model will be released in January 2020
– The model is still being refined and a reduction in size is anticipated
− Down selecting, prioritizing, and consolidating capabilities is still to occur
– Practices within the model have not been cross-referenced across domains or to all references
o E.g., in the System Integrity domain capability 3 on Malicious Content (SII-C3), there are currently only Level 1 practices focused on
antivirus, when there are related higher-level practices that could be added or cross-mapped from other domains in future releases
– A methodology to handle maturity level trade-offs is planned
– Detailed assessment guidance is still under development
• Help us by answering these questions:
1. What do you recommend removing or de-prioritizing to simplify the model and why?
2. Which elements provide high value to your organization?
3. Which practices would you move or cross-reference between levels or domains?
4. In preparation for the pending easy-to-use assessment guidance, what recommendations might
you have to clarify practices and processes?
Distribution A. Approved for public release 6
CMMC Model Framework
Distribution A. Approved for public release 7
CMMC Model Framework
• CMMC model framework CMMC Model Framework
consists of 18 domains, based
on cybersecurity “best practices” Domains
Key sets of capabilities
for cybersecurity
• Domains are comprised of
capabilities
Capabilities
• Capabilities are comprised of Achievements to
ensure cybersecurity
practices and processes, which within each domain
are mapped to CMMC Level 1
through Level 5
– Practices are activities performed at each Practices &
level for the domain Processes
Activities required
– Processes detail maturity of by level to achieve
institutionalization for the practices a capability
Distribution A. Approved for public release 8
CMMC Model Level Descriptions
Description of Practices Description of Processes
• Basic cybersecurity • Practices are performed, at
• Achievable for small companies least in an ad-hoc matter
Level 1 •
•
Subset of universally accepted common practices
Limited resistance against data exfiltration
• Limited resilience against malicious actions
• Inclusive of universally accepted cyber security best practices • Practices are documented
• Resilient against unskilled threat actors
Level 2 • Minor resistance against data exfiltration
• Minor resilience against malicious actions
• Coverage of all NIST SP 800-171 rev 1 controls • Processes are maintained
• Additional practices beyond the scope of CUI protection and followed
• Resilient against moderately skilled threat actors
Level 3 • Moderate resistance against data exfiltration
• Moderate resilience against malicious actions
• Comprehensive knowledge of cyber assets
• Advanced and sophisticated cybersecurity practices • Processes are periodically
• Resilient against advanced threat actors reviewed, properly resourced, and
Level 4 •
•
Defensive responses approach machine speed
Increased resistance against and detection of data exfiltration
improved across the enterprise
• Complete and continuous knowledge of cyber assets
• Highly advanced cybersecurity practices • Continuous improvement
• Reserved for the most critical systems across the enterprise
• Resilient against the most-advanced threat actors
Level 5 • Defensive responses performed at machine speed
• Machine performed analytics and defensive actions
• Resistant against, and detection of, data exfiltration
• Autonomous knowledge of cyber assets
Distribution A. Approved for public release 9
CMMC Model Structure
18 Domains (Rev 0.4) Capabilities assessed for
Practice and Process
maturity
Identification and
Access Control Recovery
Authentication
Asset Incident Level 5 – Advanced /
Risk Assessment
Management Response Level 5 – Optimized
Progressive
Level 4 – Proactive
Processes
Level 4 – Reviewed
Practices
Awareness and Security
Maintenance
Training Assessment Level 3 – Good Cyber
Level 3 – Managed
Hygiene
Level 2 – Intermediate
Audit and Situational Level 2 – Documented
Media Protection Cyber Hygiene
Accountability Awareness
Level 1 – Basic Cyber
Level 1 – Performed
Hygiene
System and
Configuration Personnel
Communications
Management Security
Protection
System and
Cybersecurity Physical
Information
Governance Protection
Integrity
Distribution A. Approved for public release 10
The Importance of Process Maturity
• A subset of industry feedback has highlighted the challenges of being
100% compliant with some practices
– For example, maintaining a 100% asset inventory over 200k+ machines
• Assessment of process institutionalization helps to mitigate this concern
• Process institutionalization (that is, policies, plans, processes, and
procedures to manage the environment where CUI resides) provides
assurances that practices are being implemented effectively
A comprehensive assessment of process maturity within the model can
offset the need for 100% compliance for some practices
Distribution A. Approved for public release 11
CMMC Model Rev 0.4 Details
Distribution A. Approved for public release 12
Model Rev 0.4 Synopsis - Practices
Description of CMMC CMMC
Rev 0.4 New
Level Rev 0.3 New CMMC Rev 0.4 Material Rev 0.4
Content Sources
Practices Practices Practices
CMMC Basic Cyber • DIB SCC TF WG
Level 1 Hygiene 17 +18 practices 35
Top 10
• NIST
Cybersecurity
CMMC Intermediate Framework 1.1
Level 2 Cyber Hygiene 46 +69 practices 115
• ISO 27001:2013
• AIA NAS 9933
CMMC Good Cyber • CIS Critical
63 +28 practices 91 Security Controls
Level 3 Hygiene
7.1
• CERT Resilience
Management
CMMC
Level 4
Proactive 10 +85 practices 95 Model®
• Additional DIB
Inputs
CMMC Advanced / +30 practices • Subject Matter
Level 5 Progressive 4 34 Experts
Distribution A. Approved for public release 13
CMMC Model Rev 0.4 Levels by the Numbers
Awareness and
Access Control
Accountability
Cybersecurity
Configuration
Authorization
Management
Management
Management
Systems and
Maintenance
Info Integrity
Governance
Assessment
Identity and
Awareness
Situational
Response
Protection
Personnel
Protection
Protection
System &
Audit and
Recovery
Physical
Security
Security
Training
Incident
Comms
Media
Asset
Risk
Capabilities 5 4 8 4 5 4 2 9 2 8 2 5 2 7 6 4 3 5
Practices 30 19 27 16 21 21 17 41 9 13 5 17 8 36 15 17 45 13
Level 1 5 2 2 0 2 2 2 3 1 1 2 4 0 0 1 2 2 4
Level 2 9 5 9 4 8 6 1 15 5 6 2 10 3 9 6 2 10 5
Level 3 11 7 7 5 4 4 9 7 2 5 0 3 3 6 2 3 13 0
Level 4 5 5 7 7 6 9 2 9 1 0 1 0 2 15 5 7 12 2
Level 5 0 0 2 0 1 0 3 7 0 1 0 0 0 6 1 3 8 2
Each domain also includes nine standard processes
Down-selection, prioritization, and consolidation is still to occur
Distribution A. Approved for public release 14
Model Rev 0.4 – Examples of Level 1-3 Practices
• Examples of Level 1 Practices • Examples of Level 3 Practices
– FAR requirements – All NIST SP 800-171 Rev 1
requirements are met
– Anti-virus
o Multi-factor authentication
– Ad hoc incident response*
– Information Security Continuity Plan*
– Ad hoc cybersecurity governance*
– Communicate threat information to key
stakeholders*
• Examples of Level 2 Practices
– Risk management
– Awareness and training
– Back-ups & security continuity*
* Example capability not covered by NIST SP 800-171 Rev 1
Distribution A. Approved for public release 15
Model Rev 0.4 – Examples of Level 4-5 Practices
• Examples of Level 4 Practices • Examples of Level 5 Practices
– Consideration of supply chain risk – Deployment of organizational custom
protections
– Threat hunting
– Cyber maneuver operations
– Out-of-band administration
– Hardware root of trust for boot
– Use of Data Loss Prevention (DLP)
technologies – Real-time asset tracking
– Detonation chambers – 24x7 SOC operation
– Inclusion of mobile devices – Context aware access control and step-
up authentication
– Network segmentation
– Device authentication
– Autonomous initial response actions
CMMC Levels 4 & 5 are targeted toward a small subset of the DIB sector
that supports DOD critical programs and technologies
Distribution A. Approved for public release 16
Feedback Request
Distribution A. Approved for public release 17
Request for Feedback of
Draft CMMC Model Rev 0.4
• As you review this midpoint release of the model, please consider:
– The final version of this model will be released in January 2020
– The model is still being refined and a reduction in size is anticipated
− Down selecting, prioritizing, and consolidating capabilities is still to occur
– Practices within the model have not been cross-referenced across domains or to all references
o E.g., in the System Integrity domain capability 3 on Malicious Content (SII-C3), there are currently only Level 1 practices focused on
antivirus, when there are related higher-level practices that could be added or cross-mapped from other domains in future releases
– A methodology to handle maturity level trade-offs is planned
– Detailed assessment guidance is still under development
• Help us by answering these questions:
1. What do you recommend removing or de-prioritizing to simplify the model and why?
2. Which elements provide high value to your organization?
3. Which practices would you move or cross-reference between levels or domains?
4. In preparation for the pending easy-to-use assessment guidance, what recommendations might
you have to clarify practices and processes?
We look forward to your feedback!
Distribution A. Approved for public release 18
Copyright & Distribution Information
Copyright 2019 Carnegie Mellon University and Johns Hopkins University Applied Physics Laboratory LLC. All Rights Reserved.
The U.S. Government has Unlimited rights to use, modify, reproduce, perform, display, release, or disclose this material in whole or in
part, in any manner, and for any purpose whatsoever, and to have or authorize others to do so.
This material is based upon work funded and supported by the Department of Defense under Contract No. FA8702-15-D-0002 with
Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development
center and under Contract No. HQ0034-13-D-0003 and Contract No. N00024-13-D-6400 with the Johns Hopkins University Applied
Physics Laboratory, LLC, a University Affiliated Research Center.
The view, opinions, and/or findings contained in this material are those of the author(s) and should not be construed as an official
Government position, policy, or decision, unless designated by other documentation.
NO WARRANTY. THIS MATERIAL IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY AND JOHNS
HOPKINS UNIVERSITY APPLIED PHYSICS LABORATORY LLC MAKE NO WARRANTIES OF ANY KIND, EITHER EXPRESSED
OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR
MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL NOR ANY WARRANTY OF ANY
KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.
[DISTRIBUTION STATEMENT A] Approved for public release: distribution unlimited.
DM19-0824
Distribution A. Approved for public release 19
