(Baltimore, Maryland 17 June 2020) The Cybersecurity Maturity Model Certification Accreditation Body (CMMC-AB) released applications and many program details for the “training, credentialing and accreditation ecosystem” today. The applications are the first step along a path for stakeholders that seek to participate in providing CMMC assessments for members of the Defense Supply Chain (DSC).
“We are pleased to announce many details of the CMMC-AB training, credentialing, and accreditation ecosystem,” said Ty Schieber, Board Chairman of the CMMC-AB. This is an important milestone for the CMMC program and is the result of months of incredibly hard work and close collaboration with our DoD and industry partners to ensure that we work together to establish an effective, scalable, and reliable assessment system.
“Our goal is to ensure we implement a clear, consumable, and consistent CMMC assessment & certification methodology. Our system is purpose-built to support affordable and effective CMMC certifications of Organizations Seeking Certification (OSC) who represent the most important part of the Defense Supply Chain. Within five years, all suppliers to the DoD will need a CMMC maturity level certification to be eligible for award of DoD contracts or subcontracts.”
A pictorial diagram of the CMMC-AB ecosystem is attached to this press release and available on the CMMC-AB website. C3PAO and Certified Assessor applications, amongst others, are available today.
- C3PAO – Certified 3rd Party Assessment Organization
- CP – Certified Professional (prerequisite to becoming a Certified Assessor)
- Maturity Level 1 (ML-1) Certified Assessor
- Maturity Level 3 (ML-3) Certified Assessor
- RPO – Registered Provider Organization
- RP – Registered Practitioner
- LPP – Licensed Publishing Partner
Pricing and Availability
The application fee for an individual assessor to enter the program by first becoming a Certified Professional is $100. The application fee for the C3PAO, the organization that houses the assessors, is $1,000.
Jeff Dalton, the CMMC-AB Credentialing Committee Chair, identified that the CMMC-AB also created a new class of service providers. Registered Provider Organizations (RPO), Registered Practitioners (RP) - who will be authorized to provide non-certified advice to contractors preparing for the CMMC requirements.
According to Dalton, “The RPO and RP were created to help assure OSCs that contractors and individuals offering consultative advice have the necessary baseline understanding of the CMMC-AB adoption and assessment methodology, and adhere to a Code of Professional Conduct. The Code of Professional Conduct helps in preventing the provision of misleading or unsubstantiated compliance advice.” The Code of Professional Conduct is under the latter stages of review and will be released to participants and publicly at a later date. The RPO is priced at $5,000 for the organization and $500 for each practitioner.
According to the Training Committee Chair, Ben Tchoubineh, the online training for the RP program will be available in July 2020.
The CMMC-AB anticipates the release of additional stakeholder applications and further details about the overall implementation timeline in the coming weeks.
Training will begin for the Provisional Program (details following on or about 30 June 2020) in July and be provided directly by the CMMC-AB. Training for participants in the full credentialing program will be offered by universities, community colleges, and private licensed training providers beginning late in 2020 or early 2021.