CMMC Compliance: It’s Not Just What You Do — It’s What You Can Prove
When organizations start preparing for CMMC, the first question is usually pretty straightforward:
Are we meeting the requirements?
But there’s another question that’s just as important:
Can we prove it?
A company may require MFA, patch its systems, review user accounts, provide security awareness training, and monitor its environment. Those are all important security practices.
The problem comes when someone asks for evidence.
If an assessor asks how you know accounts are being reviewed, what can you show them? If your policy says systems are patched regularly, do you have reports showing that process is actually happening?
This is where organizations can discover gaps they weren’t expecting.
Implementation and Evidence Need to Match
Having a policy that says your organization performs a security activity doesn’t necessarily demonstrate that the activity is being performed.
The same goes for having a technical control enabled without documentation explaining how it supports the requirement.
Depending on the requirement and your environment, evidence might include:
- System configuration screenshots
- Security logs and reports
- User access reviews
- Vulnerability scan results
- Security awareness training records
- Policies and procedures
- Tickets or change records
- Technical configurations and administrative settings
The specific evidence will vary depending on the requirement and how your organization has implemented it.
A Simple CMMC Readiness Exercise
Pick several NIST SP 800-171 requirements that apply to your environment.
For each one, ask three questions:
1. How are we meeting this requirement?
2. Where is that implementation documented?
3. What could we show an assessor today to demonstrate it?
If your team struggles with the third question, you may have identified an area that needs attention before your assessment.
Find the Gaps Before the Assessment
This is one of the areas we look at during a CMMC gap assessment at NTS Solutions.
We don’t just look for policies or check boxes. We look at how requirements are actually being implemented and what evidence exists to support that implementation.
The goal is to identify those gaps early, while you still have time to address them.
Before your CMMC assessment, don’t just ask:
“Are we doing this?”
Ask:
“How are we going to prove it?”
NTS Solutions — Never Too Secure
Need help determining where your organization stands? Contact NTS Solutions to discuss a CMMC gap assessment.