CMMC level 2 Self Attestation

Description

To comply with CMMC Level 2 and perform self-attestation, a supplier must:

• Understand CUI: Identify if the organization handles Controlled Unclassified Information (CUI).
• Implement NIST SP 800-171 R2: Implement all 110 security requirements outlined in NIST SP 800-171, Revision 2.
• Meet NIST SP 800-171A Objectives: Ensure that all 110 NIST SP 800-171 requirements are met by achieving a “MET” result for all applicable assessment objectives as defined in NIST SP 800-171A.
• Document Implementation: Document policies, processes, procedures, and/or technologies implemented to satisfy the NIST SP 800-171 requirements. This includes creating a System Security Plan (SSP).
• Define Assessment Scope: Clearly define the scope of the self-assessment, identifying all assets (people, technology, facilities, and external service providers) that process, store, or transmit CUI.
• Conduct Self-Assessment: Perform a self-assessment of the organization’s security practices against the NIST SP 800-171 requirements.
• Prepare Documentation: Compile all necessary documentation related to the self-assessment.
• SPRS Reporting: Report the results of the self-assessment, including the required score and other details, to the DoD’s Supplier Performance Risk System (SPRS).
• Annual Affirmation: A senior company official must submit an annual affirmation to the DoD, attesting that the organization has implemented and will maintain CMMC Level 2 compliance.