As CMMC consultants and assessors, it is our responsibility to assist contractors, especially SMBs, to migrate to the regulatory environment. Unfortunately, many assessment firms (RPO/C3PAO/RP/CCP/CCA based) get tunnel vision and only focus on CMMC, neglecting the contractor's business. During the Sarbanes Oxley era we prioritized (on a risk basis) the POA&Ms and worked with the company over several years to mature their company into regulatory compliance. Albeit, CMMC won't allow this, but the process is simliar.
Each business is composed of various vertical components, and how they run their business is critical. When assisting contractors on policies and procedures, we must highlight and mature their existing policies and procedures to satisfy CMMC. We don't replace their policies so that CMMC is the only focus. We help the contractor mature into CMMC and walk with them while we/they mature their policies and procedures.
Let's put the contractor's business first and CMMC second when we perform our pre-assessments. By helping the contractor mature, they can grow into the regulatory framework of CMMC over the long term. Remember, the contractor has a business to run, and it is our duty to assist them in migrating to the regulatory environment.
Funny, I did this method with a top 5 prime, and it worked great, and the appreciation was well noted. Listen to your contractor and learn their business then start the CMMC path.
#cmmc #defensecontractors #dod #cyberdefense #aerospace #militarycommunity #security