No let up to the DoD’s aggressive timeline
Ben Tchoubineh, the leader of the CMMC AB’s Training Committee, led yesterday’s national conversation on the timeline for training and certifying C3PAOs. Tchoubineh’s much awaited comments provided a clear plan for rolling out C3PAO training. Training will start with the Provisional Program, which will roll out over the next few months and will enable initial assessments. As soon as the Provisional Program has completed, it will be followed by a more extensive Formal Program. In adopting this two-pronged approach, the CMMC AB is ensuring the initial wave of CMMC audits gets off to a running start and meets the DoD’s aggressive timeline.
Provisional Program
The focus of the AB’s Provisional Program is to ensure it keeps up with the DoD’s targets for CMMC rollout while keeping an eye on incorporating lessons learned to a more scalable formal program later this year. While the training for the Provisional Program still needs final approval from the DoD and AB, it is close to ready. The AB expects to roll out the first wave of training for the Provisional Program this summer.
Training and the complete rollout will take place over the following 3-6 months and will be done in close collaboration with AB. Initially, 60 highly experienced assessors and auditors will be trained and certified. This first group of assessors will obtain the skills that will enable them to conduct CMMC audits up to level 3. Only later will they be able to get training for auditing at CMMC Level 5.
Formal Program
As soon as Provisional Program is completed, the AB intends to quickly follow up with the roll out of the Formal Program. The Formal Program will enable the full-scale, industry-wide assessment of DIB companies that will transform the DIB’s cybersecurity posture.
Tchoubineh said that the Formal Program will be built through major partnerships to meet training demands. The program will be designed to promote innovation and quality but also flexibility by including online education, training through universities, and colleges.
The Formal Program tracks will start with enabling individuals to become CMMC-AB Certified Professionals. With this certification, individuals can become an internal consultant that can help a DIB company prepare for an audit. Tchoubineh laid out the subsequent and tiered training and prerequisites required to meet CMMC-AB certified Assessor Maturity Level 1 (CA1), CMMC-AB certified Assessor Maturity Level 3 (CA3), CMMC-AB certified Assessor Maturity Level 5 (CA5), and finally a Certified CMMC-AB instructor. These subsequent training levels can only be achieved after successfully passing the examinations for the levels underneath it.
Tchoubineh also said the AB will work to keep the Formal Program dynamic so that it constantly improves. The AB will also be responsible for maintaining a Body of Knowledge (BOK) to promote standardization and quality of training across all levels. Tchoubineh sees the BOK as being key to enabling future training materials, classes, and testing.
Conclusion
The AB has shown they are looking to keep up the rapid pace that Katie Arrington has consistently messaged. This was clearly telegraphed with Tchoubineh having the first training of C3PAOs this summer and audits soon after. If DIB companies were looking for a message to take away from the conversation, it would be that the CMMC program is marching forward despite COVID-19 and DIB companies should start developing and implementing their strategy to prepare for CMMC.
Learn more about how PreVeil can facilitate your compliance with CMMC. Contact us!