Call us now:
Having the right number of formal assessors is going to be important for the CMMC programme. But its not an insurmountable ask, it’s a game of capacity and numbers. Albeit training 2,000 people to assess is one thing, having 2,000 people who can assess practices and have the experience to certify compliance is something different.
The big issue for CMMC is not assessor numbers it is compliance. Compliance to NIST SP 800 – 171, then the additional requirements for CMMC. We know all companies will need to be at a minimum CMMC level 1, that’s 15 basic cyber security practices. The next meaningful tier will be level 3 and that’s 130 practices with 110 NIST and an additional 20 CMMC.
It’s a big and expensive capability for any organisation to implement and manage. For some a gap they may have to close, close being the optimal word, as CMMC is being deployed to close a gap in compliance. We know on average companies spend between 8 – 12% of revenue, on IT and that typically contains cyber. If this Mckinsey report is correct (https://lnkd.in/dC5UiEN) cyber spend may remain flat for many sectors.
But for the DIB to implement 130 security practices?
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6736556124859854848