The Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) framework begins rolling out this year, with CMMC requirements expected to be built into as many as 15 “pathfinder” contracts for primes. It’s estimated that each prime contract will have roughly 100 subcontractors, meaning that up to 1,500 primes and subcontractors will need to comply with CMMC in order to do work for the DoD on those first contracts.
From there, CMMC implementation will pick up speed. DoD intends to increase the number of prime contracts that include a CMMC requirement based on the following targets:
The DoD has said that the FY2021 pathfinder contracts will focus on mid-sized projects that require the contractor to achieve CMMC Level 3. Primes will be required to flow down the appropriate CMMC requirement to their subcontractors.
CMMC Level 3 applies to contractors that process or store CUI (Controlled Unclassified Information) and requires that organizations demonstrate “…a basic ability to protect and sustain an organization’s assets and CUI.”
It is clear that Commercial O365 is not CMMC compliant. Commercial O365 cannot meet the clauses c through g of DFARS, which require forensic incident reporting and media preservation. Microsoft acknowledges this fact and offers its expensive and difficult to implement GCC High platform to service the DIB instead. Fortunately there’s a more secure, easier, and less expensive alternative to GCC High for CMMC compliance: PreVeil Email and Drive, which can be layered over Office 365.
PreVeil’s security architecture was built on Zero Trust principles , and is grounded in world-class end-to-end encryption. With PreVeil, email, files and data are never decrypted on any server anywhere. If attackers breach a server, all they will get is useless gibberish. PreVeil’s servers can never see your data. Microsoft’s can. And that means that an attacker breaking into the server (for example, by compromising an administrator) can also access all your organization’s data.
Moreover, PreVeil’s email and file sharing service is a fraction of the cost of GCC High. PreVeil needs to be deployed only to your employees who handle CUI, whereas GCC High typically requires deployment across your entire organization. And PreVeil makes configuration and deployment simple and inexpensive, with no need to rip and replace your existing infrastructure. Your employees don’t even need to change their Outlook email address.
PreVeil’s straightforward solutions also help you avoid expensive CMMC consultant engagements, which are par for the course for GCC High installation.
PreVeil Drive, as demonstrated in the video below, enables end-to-end encrypted file sharing and storage of CUI that is CMMC Level 3 compliant. Users can access files stored on PreVeil Drive from any of their devices, or share files with other users who have the appropriate access permissions through PreVeil’s Trusted Communities. Unlike Office 365’s SharePoint service, which always has access to your data, only you and the people with whom you’ve explicitly shared files can decrypt them. PreVeil Drive is easy to use and automatically integrates with Windows File Explorer and Mac Finder. Again, unlike GCC High—for which deployment means ripping and replacing your email server—PreVeil has no impact on your existing file servers. It’s available for Windows, Mac and, with PreVeil’s mobile app, for iPads and smartphones as well.
PreVeil Drive: Video demonstration
All DoD contractors, regardless of size, will soon need to comply with CMMC requirements. To help you do so, PreVeil leverages a fundamentally better security paradigm. But better security isn’t enough. If security is difficult to use, it won’t be used. To be effective, security must be as frictionless as possible. PreVeil was created with this principle in mind so that all your security objectives, including CMMC compliance, will be met.
PreVeil’s popular CMMC white paper – downloaded more than 1,500 times by defense contractors—presents detailed information on what your company needs to do to comply with CMMC and, likewise, work with the DoD. Our aim is to make that process as seamless and affordable as possible while providing unparalleled security.
To learn more about PreVeil and how your company can get started with CMMC compliance, contact us.