We feel this is the best CMMC template package available! Kieri Solutions passed their CMMC assessment using this core documentation. If you are seeking a set of CMMC-specific policy, procedures, and a partially written system security plan (which would take 200 hours worth of work to build from scratch) and you are willing to pay a modest fee, Kieri Solutions sells an excellent product called the Kieri Compliance Documentation. This is a plug for our sponsor, Kieri Solutions. These policies aren’t designed for 800-171 or CMMC so you will need to rework them significantly. SANS Institute provides a set of best practices security policies in both PDF and DOC format. Small businesses can send their employees to this link and collect the certificates of completion to meet two CMMC requirements. This training includes general cybersecurity awareness as well as indicators of insider threat. The information they provide is eye-opening. Cybersecurity & Infrastructure Security Agency (CISA) bulletins.Ĭheck the bottom of the CISA page for a subscribe link. For most of us, the easiest way to achieve this is to subscribe to the U.S. Subscription page for Threat Intelligence bulletinsīoth CMMC and NIST SP 800-171 require that you pay attention to sources of cyber threat intelligence. This training course introduces Controlled Unclassified Information and provides guidance for marking and protecting it. If you don’t have a big enough company to staff a full IT and cybersecurity department, choosing a CMMC-knowledgeable MSP is critical.įree CUI Training from Department of Defense Very few MSPs know what they are doing in regard to CMMC compliance. It is designed to help a small or medium sized defense contractor evaluate Managed Services Providers for CMMC. This document is half training, half scoring template. Real CMMC assessments of defense contractors will ask many of these questions during planning.ĭoD Assessment Methodology – How DIBCAC performs an 800-171 assessment and scores itĭoD Cybersecurity Toolbox – Answers to tough questions about defense cybersecurity, referenced by DIBCAC and CMMC assessors as clarification.Ĭhecklist to evaluate your Managed Service Provider – This package gives some expectations for inheritance, not applicable practices, and evidence. Pre-assessment package for candidate C3PAO assessments. Public 800-171 Self-Assessment Database – This is an Access database that captures data during an assessment and calculates scores based on findings.

This page on the Defense Contract Management Agency’s (DCMA) website has several great resources for defense contractors in the final stages of preparation for 800-171 or CMMC assessment. Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)

Dillards vendor compliance manual