- CMMC Compliance Program Management
Services provided through Achieva Tech’s CMMC Compliance Program Management Services will include:
| Product or Service | Description | CMMC | NIST Area |
| CMMC Level 2 Readiness Assessment | Included in Program Onboard is a formal Assessment with Compliance alignment to NIST 800-171 controls and CMMC Level 2, with Report of Findings, and POAM. (a $25,000 value)
|
A validated, detailed self-assessment that will be the basis for the alignment to standards and creates a detailed, complete POAM. |
| CMMC IT Documentation Toolkit Compliance Program | The Toolkit is a How To implement and maintain a CMMC Compliance Program. It also Includes the required Policies, Plans, and Procedures for CMMC compliance at Levels 1-2. (a $6,750 value)
|
Addresses the written documentation Maturity Levels 1-2. Provides a framework for the compliance program. |
| Documentation Customization | Customize IT Documentation and update documentation as requirements change or business grows. Guidance for creation of internal process documentation and trainings.
|
Addresses the written documentation Maturity Levels 1-2 |
| Documentation Review
|
Review of existing organization documentation of the covered information systems, facility, and people/processes.
|
Documentation of people, processes, technology, and facility is required for CMMC Compliance. Some existing documentation may be able to be used or modified for compliance.
|
| Weekly Program Onboard Meetings | Stakeholders meet weekly to onboard the program until the first Risk Management Meeting.
|
Continuous compliance management is required, as such, a strong onboard is essential.
|
| POAM Management | Continued management of POAM items to initially close all items out, then to continue to add and close items as systems change.
|
A managed POAM with completion dates for all items is a requirement of CMMC. |
| External Service Provider Readiness
|
Coordinate with external service providers (ESP’s) in scope for CMMC assessment to assure their readiness for Level 2 compliance, including Shared Responsibility Matrices and documentation for their scope.
|
ESP’s in scope will be part of the organization’s CMMC assessment and must also be assessment ready. |
| System Security Plan Review and Modification Guidance
|
Review and update the Systems Security Plan (SSP) where it is out of alignment with the current configurations or practices, or where is needs to be more descriptive of the story of how the controls were implemented.
|
SSP is the most important and vital document in the CMMC Program. |
| Initial and Quarterly Risk Assessments | Quarterly Risk Assessments are completed as per the Risk Management Plan and assure continued compliance.
|
Risk assessments are required for compliance. |
| Yearly Security Assessment Direction and Analysis | Direct and analyze results of Yearly Security Assessments. These assessments are completed to assure satisfactory implementation of the controls, and to identify security concerns and gaps to close for resiliency and continuity.
|
Security assessments are required for compliance. |
| Quarterly Risk Management Meetings | Establish a cadence of accountability and check in’s for continuous compliance. Facilitate regular Risk management Meetings for continued compliance and POAM completion. The Risk Management Team meets quarterly to review the findings of Security Assessments, Risk Assessments, Vulnerability Assessments, regular compliance checks, and to review the required documents and processes to maintain compliance.
|
The Risk Management Meeting and Processes are the mechanism for Governance of your CMMC Compliance Program. |
| Stakeholder Briefings
|
Meet with identified stakeholders so they understand their role in CMMC Compliance, as well as assure they are following their documented processes for compliance.
|
Assessors will interview key stakeholders and process owners during the assessment process. |
| Certification Assessment Support
|
We won’t leave you hanging during assessment! We’ll provide the preparatory technical and documentation work, the coaching for company team members who are involved in the certification process, as well as guidance with closure of any POAM items from the certification assessment.
|
The goal of the CMMC Compliance Program is to get compliance and achieve a certification every three years. |
Reviews
There are no reviews yet.