A quote among compliance professionals is that 'if it is not documented, then it doesn't exist' and that applies to CMMC for self-assessments or third-party assessments.

You cannot pass a CMMC L1 or L2 assessment (self-attestation or third-party) without the documentation evidence of the due diligence and due care steps taken to address the controls (e.g., policies, standards, procedures, employee training records, etc.). The recurring requirement for policies, procedures and other documentation are exactly what the NFO controls from Appendix E of NIST SP 800-171 address. You cannot accurately fill out a Supplier Performance Risk System (SPRS) self-assessment for the Department of Defense (DoD) without using the AOs from NIST SP 800-171A to evaluate the 110 CUI controls from NIST SP 800-171. The bottom line is without having the documentation evidence that NFO controls fundamentally address: 'Specifications' are the document-based artifacts (e.g., policies, procedures, security plans, security requirements, functional specifications architectural designs) associated with a system. This can only be achieved with evidence that a reasonable cybersecurity program exists and is maintained, which is the entire point of NFO controls.įrom the CMMC L2 Assessment Criteria & Methodology, Assessment Objects (AOs) identify the specific items that will be assessed and include specifications, mechanisms, activities and individuals. The only way to achieve compliance is through appropriate evidence of due diligence and due care, which is accomplished by having appropriate documentation. Within NIST SP 800-171A 'potential assessment methods and objectives' section, you will consistently find requirements for policies, procedures and other written documentation. The purpose of the examine method is to facilitate understanding, achieve clarification, or obtain evidence. The examine method is the process of reviewing, inspecting, observing, studying, or analyzing assessment objects (e.g., specifications, mechanisms, activities). The assessment methods include examine, interview and test components. NARA's CUI Notice 2020-04 specifies NIST SP 800-171A as the authoritative source that assessors use and identifies 'specifications' that are the document-based artifacts (e.g., policies, procedures, security plans, security requirements, functional specifications, architectural designs) associated with in-scope systems. This website is focused on identifying the underlying requirements associated with NIST SP 800-171 & Cybersecurity Maturity Model Certification (CMMC) compliance.

Editorial: There is a lot of misconception about NFO controls.

Dvdpedia nfo