CMMC 2.0 Implementation Bootcamp

What you will learn

• Identify Federal Contract Information and Controlled Unclassified Information and scope the systems that touch them
• Implement the CMMC Level 1 practices: access control, identification and authentication, media protection, physical protection, system and communications protection, and system and information integrity
• Work through all 14 NIST SP 800-171 domains behind CMMC Level 2, from Access Control to System and Information Integrity
• Build the assessment evidence: System Security Plan, policies, procedures and a Plan of Action and Milestones
• Prepare for a self-assessment or a C3PAO assessment and keep compliance continuous afterward
• Place awareness and training, incident response and risk assessment where they belong in the program

Course outline: 25 modules, 67 lessons

Understanding CMMC and the Defense Industrial Base

• The Defense Industrial Base and National Security
• The Evolution of Defense Contractor Cybersecurity Requirements
• CMMC Level 1 Requirements and Structure
• Your Responsibilities and the Consequences of Non-Compliance

Federal Contract Information: Identification and Protection

• Understanding Federal Contract Information
• Identifying FCI in Your Organization
• FCI Handling and Flow-Down Requirements

Access Control Fundamentals

• Principles of Access Control
• Practice AC.L1-3.1.1 - Limiting System Access
• Practice AC.L1-3.1.2 - Limiting Access to Authorized Functions
• Implementing and Maintaining Access Controls

External Systems and Public Content

• Practice AC.L1-3.1.20 - External System Connections
• Practice AC.L1-3.1.22 - Publicly Accessible Content
• Managing External Boundaries

Identification and Authentication

• Understanding Identification and Authentication
• Practice IA.L1-3.5.1 - Identifying System Users
• Practice IA.L1-3.5.2 - Authenticating Users
• Managing Credentials and Authentication Systems

Media Protection and Sanitization

• Understanding Media and Associated Risks
• Practice MP.L1-3.8.3 - Media Sanitization
• Implementing Media Protection Controls

Physical Protection

• Understanding Physical Security
• Practice PE.L1-3.10.1 - Limiting Physical Access
• Visitor Management and Access Logging
• Managing Physical Access Devices

System and Communications Protection

• Understanding System Boundaries
• Practice SC.L1-3.13.1 - Boundary Protection
• Practice SC.L1-3.13.5 - Public Access System Separation

System and Information Integrity

• Understanding System Integrity Threats
• Practice SI.L1-3.14.1 - Flaw Remediation
• Practice SI.L1-3.14.2 - Malicious Code Protection
• System Scanning and Email Protection

Assessment, Documentation, and Continuous Compliance

• The CMMC Assessment Process
• Documentation Requirements
• Continuous Monitoring and Improvement
• Maintaining Long-Term Compliance
• CMMC Domain Reference
• Access Control and Boundary Protection Deep Dive
• Advanced Authentication Security
• Media Protection and Physical Security Deep Dive
• Communications Protection and Incident Response Deep Dive
• Sustaining Compliance and Security Culture
• Implementation Checklists: All CMMC Domains
• Implementation Checklists, Policies, and Exercises
• Case Studies and Course Completion

Advanced: Introduction to CMMC Level 2 and Controlled Unclassified Information

• Understanding CMMC Level 2 in the Certification Framework
• Understanding Controlled Unclassified Information (CUI)
• The CMMC Assessment Process
• Building Your CMMC Level 2 Compliance Program

Advanced: Access Control (AC)

• Foundational Access Control Practices
• Separation of Duties and Least Privilege
• Session and Remote Access Controls
• Wireless and Mobile Device Controls

Advanced: Awareness and Training (AT)

• Security Awareness and Training Programs

Advanced: Audit and Accountability (AU)

• Audit Record Creation and Content
• Audit Review, Analysis, and Reporting

Advanced: Configuration Management (CM)

• Baseline Configurations

Advanced: Identification and Authentication (IA)

• User Identification and Authentication

Advanced: Incident Response (IR)

• Incident Response Capabilities

Advanced: Maintenance (MA)

• System Maintenance

Advanced: Media Protection (MP)

• Media Protection and Sanitization

Advanced: Personnel Security (PS)

• Personnel Screening and Termination

Advanced: Physical Protection (PE)

• Physical Access Controls

Advanced: Risk Assessment (RA)

• Risk Assessment Process

Advanced: Security Assessment (CA)

• Security Control Assessment

Advanced: System and Communications Protection (SC)

• Communications and Boundary Protection

Advanced: System and Information Integrity (SI)

• System Integrity

Frequently Asked Questions