Tag: cmmc readiness

Top 10 Cybersecurity Trends for 2024

Futuristic cybersecurity shield emblem superimposed on a circuit board highlighting modern cybersecurity trends and digital protection technologies.

The cybersecurity landscape is undergoing a seismic shift, driven by technological advancements, evolving threats, and a heightened focus on regulation. From the talent crunch in cybersecurity to the rise of Generative AI and the increasing importance of soft skills, the industry is bracing for a transformative year. This guide delves into the Top 10 Cybersecurity Trends for 2024.

1. The cybersecurity skills crunch will mean less people/higher costs for organizations.

One of the most critical challenges facing the cybersecurity industry is the talent gap. According to the Bureau of Labor Statistics1, the employment of information security analysts is projected to grow by 33% from 2020 to 2030. This rate of growth is much faster than the average for all occupations, highlighting the increasing demand for cybersecurity expertise. However, the supply of qualified professionals is not keeping pace with this demand, leading to a talent gap that poses a serious risk to organizations. For businesses, this can mean higher labor costs. In the next few years, scarcity will cause salaries to increase, and upskilling existing employees will require added costs for development and training.

2. Cybersecurity professionals will have increased need for soft skills.

While technical expertise remains a the primary focus for anyone working in cybersecurity, there will be a growing emphasis on the importance of soft skills for cybersecurity professionals. These include interpersonal communication, problem-solving, and emotional intelligence, among others. Effective communication will be crucial when explaining complex security issues to non-technical stakeholders so that decision-makers can understand how and why to take appropriate action. Indeed2 suggests that a blend of technical and soft skills will be the hallmark of the most sought-after cybersecurity professionals.

3. There will be more cybersecurity in board rooms.

According to a Gartner Report3, around 70% of corporate boards are expected to have at least one member with specialized cybersecurity knowledge by 2026. Another report from Moody’s4 reveals that company cyber budgets have jumped by 70% in four years. This significant increase in financial allocation is a testament to the escalating importance of cybersecurity at the highest levels of corporate governance. Boards are not just approving larger budgets; they are actively participating in discussions about how these resources are allocated and used.

As a result, the role of the CIO (Chief Information Officer) will become even more important

According to Info-Tech’s Annual CIO Survey Report For 20245, one of the top priorities for CIOs in 2024 will be to engage with the board on cybersecurity matters. This involves not just presenting technical metrics but translating these metrics into understandable, actionable business strategies. The recent SEC charges against SolarWinds serve as a stark reminder of the consequences of neglecting cybersecurity at the governance level. The SEC alleges that SolarWinds misled investors about its cybersecurity measures, leaving the company vulnerable to a significant cyberattack disclosed in December 2020. This event led to a sharp decline in the company’s value, underscoring the critical importance of taking cybersecurity seriously at the highest levels of an organization. And the SEC’s action in this case should act as a wake- up call for publicly traded companies that wish to avoid the same fate.

4. IoT (internet of things) cyberattacks will increase.

The proliferation of IoT devices, ranging from smart home appliances to industrial sensors, has expanded the attack surface for cybercriminals. According to InformationWeek6, security measures are not keeping pace with the grow of IoT technology, widening the security gap.  For businesses, one of the greatest vectors for threat is IoT devices used by remote and hybrid employees without proper security measures in place on devices used to connect to sensitive data. McKinsey7 notes that the lack of standardized security protocols is a significant concern, especially considering the IoT is expected to potentially be worth up to $12 trillion dollars globally by 2030.

5. More cybersecurity regulations are coming down the pike.

The newest regulations aim to safeguard national security and ensure economic stability by setting standards and guidelines for cybersecurity practices. In the United States, the 2024 defense bill has allocated $13.5 billion specifically for cyberspace activities. Notably, in the US financial sector, the SEC  has introduced new rules requiring companies to include cybersecurity risk factors and incidents in their financial disclosures set to take effect on December 15, 2023. In the UK, the Product Security and Telecommunications Infrastructure (PTSI)8 act was passed into law in 2022 and aims to regulate products capable of connecting to a network, such as IoT devices like networked CCTV cameras, with a compliance deadline of April 29, 2024.

Similarly, the EU is focusing on the cybersecurity of a product’s life cycle for IoTs that connect to a network by implementing the European Cyber Resilience Act (CRA). The CRA is designed to replace the existing European Union agency for cybersecurity ENISA.  It will oversee certification schemes for ICT products, services, and processes and is set to be officially released in 2024.

6.  Generative AI will continue to have long lasting impacts on cybersecurity.

The integration of Artificial Intelligence (AI) into cybersecurity is not a new phenomenon, but the advent of generative AI marks a significant milestone. One of the most concerning developments is the use of deepfake technologies for social engineering attacks. According to a report by Cyber Magazine9, the proliferation of deepfakes is causing increasing concern in the cybersecurity community. AI-generated synthetic media can impersonate individuals, manipulate content, and deceive systems, making them a potent tool for cybercriminals aiming to compromise business networks and data. Beside deepfakes, AI is contributing to more sophisticated phishing attempts. AI can be used to create more believable phishing emails with programs like ChatGPT, Bard, and Claude and to automate the process of sending these emails, making attacks more efficient and harder to detect.

On the flip side, advancements in AI are also empowering organizations to bolster their defenses. A Gartner report10 highlights the growing importance of Machine Learning in data science, including real-time anomaly detection. Additionally, AI-driven incident response mechanisms are becoming increasingly sophisticated. These systems can automatically isolate affected network segments, initiate predefined security protocols, and even communicate with human operators to provide real-time updates on security incidents.

7. You will see evolving, more sophisticated phishing attacks and the cost will be much higher.

Phishing attacks have long been a staple in the cybercriminal’s toolkit, and Humans are the weakest link in the chain. 95% of cybersecurity issues traced to human error11. The advancement of automated technologies and generative AI tools that can create more realistic and emotionally evocative phishing attempts is a large contributing factor on this front. Cybersecurity Ventures12 predicts that by 2025, cybercrime will cost companies and individuals over 10 trillion dollars worldwide.

8. Cyber warfare and state-sponsored cyberattacks will continue to increase.

Ongoing conflicts and significant electoral events around the world are expected to be flashpoints for cyber warfare activities. According to the U.S. Department of Homeland Security’s homeland threat assessment for 202413, state-sponsored cyberattacks are among the top threats facing the nation. Critical infrastructure sectors such as energy, transportation, and healthcare are likely to be primary targets. In 2022, one of the biggest attack types on infrastructure was remote management devices with a marked increase happening over the course of the year.  In the current geopolitical environment, the trend for cyber warfare shows no signs of slowing.

9. There will be a move towards cyber resilience as cyberattacks become more common.

Organizations will no longer be solely focused on preventing cyberattacks; they will also be investing in strategies to ensure operational continuity in the aftermath of an attack.  According to the National Institute of Standards and Technology (NIST)14, cyber resilience is “the ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that use or are enabled by cyber resources.” However, it is not a one-size-fits-all concept; it can be implemented at multiple levels, including individual system elements, entire systems, and even across organizations or sectors. As cyberattacks become more frequent, organizations will likely invest more in training programs, technological solutions, and governance models that support cyber resilience. The aim is to build systems that not only defend against cyber threats but also adapt and recover quickly when attacks occur.

10. The zero trust model will continue to evolve.

The concept of zero trust has been a cornerstone in cybersecurity, operating on the principle of “never trust, always verify.”15 However, the zero trust model, which relies heavily on static rules and policies, is becoming increasingly inadequate. According to Gartner16, the future of it will demand more dynamic and adaptive security measures to cope with the complexities introduced by emerging technologies and sophisticated cyber threats. One of the major shifts in zero trust will be the incorporation of AI for real-time authentication. AI algorithms can analyze behavioral patterns and other contextual factors to make instantaneous trust decisions. Beyond that, the zero trust model will increasingly incorporate continuous monitoring of user activity. This approach extends the security perimeter past the initial point of entry, continuously verifying the legitimacy of a user’s actions throughout their session.

The adoption of zero trust is on the rise. According to a 2023 report by Fortinet17, 67% of survey respondents have adopted zero trust network access but have struggled to implement the full suite of strategies.  In fact, in 2023, only 28% had achieved complete implementation – down from 40% in 2021. While there is an increase in the intention to adopt zero trust, the difficulties in achieving full planned deployment in the business environment require a higher degree of commitment.

Conclusion

As we confront the unfolding cybersecurity trends of 2024, it becomes clear that this year will be a watershed moment for digital defense. In an era where technological progress and cyber threats accelerate in tandem, robust and forward-thinking cybersecurity strategies are not just advisable—they are imperative. Organizations are called to bolster their digital ramparts with a blend of seasoned experts, cutting-edge AI technologies, and resilient operational blueprints that promise not just to endure but to dynamically counteract cyber incursions. The path to a fortified cyber future is complex and demands a unified front across all sectors and communities. It’s a path that companies like Back To Business IT are equipped to help navigate. Staying ahead of the curve and ready to act decisively will transform these emerging challenges into stepping stones for a more secure and resilient digital landscape.


1. https://www.bls.gov/OOH/computer-and-information-technology/information-security-analysts.htm

2. https://in.indeed.com/career-advice/career-development/cyber-security-skills

3. https://www.gartner.com/en/newsroom/press-releases/2023-03-28-gartner-unveils-top-8-cybersecurity-predictions-for-2023-2024

4. https://www.businessinsurance.com/article/20230929/NEWS06/912360168/Company-cyber-budgets-jump-70-in-four-years-Moody%E2%80%99s-

5. https://www.infotech.com/research/ss/annual-cio-survey-report-2024

6. https://www.informationweek.com/data-management/iot-technology-growth-and-security-trends-this-year-and-beyond

7. https://www.mckinsey.com/industries/technology-media-and-telecommunications/our-insights/cybersecurity-for-the-iot-how-trust-can-unlock-value

8.https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1037629/PSTI_FactSheet_1__Overview__1_.pdf

9.https://cybermagazine.com/technology-and-ai/the-rising-tide-of-deepfakes-as-ai-growth-cause-concern

10. https://www.gartner.com/en/newsroom/press-releases/2023-08-01-gartner-identifies-top-trends-shaping-future-of-data-science-and-machine-learning

11. https://www3.weforum.org/docs/WEF_The_Global_Risks_Report_2022.pdf

12. https://cybersecurityventures.com/cybercrime-damage-costs-10-trillion-by-2025/

13. https://www.dhs.gov/sites/default/files/2023-09/23_0913_ia_23-333-ia_u_homeland-threat-assessment-2024_508C_V6_13Sep23.pdf

14. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v2.pdf

15. https://www.nist.gov/blogs/taking-measure/zero-trust-cybersecurity-never-trust-always-verify

16 https://www.gartner.com/en/newsroom/press-releases/2023-10-17-gartner-unveils-top-predictions-for-it-organizations-and-users-in-2024-and-byond

17. https://www.fortinet.com/blog/industry-trends/zero-trust-report-key-takeaways#:~:text=In%202021%2C%2040%25%20of%20respondents,54%25%20in%20the%20previous%20survey

The Impact of NIST SP 800-171 Revisions on CMMC Compliance

Impact of NIST SP 800-171 Revisions on CMMC Compliance

Maintaining compliance with the evolving Cybersecurity Maturity Model Certification (CMMC) requirements is crucial for defense contractors and organizations. In this article, we’ll explore the recent revisions of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 and their direct impact on CMMC compliance. As a leading provider of cybersecurity solutions, Back To Business I.T. aims to empower defense contractors with the necessary insights to navigate these changes effectively.

Understanding NIST SP 800-171 serves as the baseline for protecting Controlled Unclassified Information (CUI) on nonfederal systems and organizations. These guidelines establish essential security requirements that federal agencies and government contractors must follow when handling sensitive information. CUI encompasses data such as intellectual property, health information, and critical energy infrastructure information. Compliance with NIST SP 800-171 is a prerequisite for defense contractors seeking to secure Department of Defense (DoD) contracts.

The Impact of NIST SP 800-171 Revisions on CMMC Compliance

The revisions in NIST SP 800-171, particularly the upcoming Revision 3, significantly influence the compliance landscape for defense contractors pursuing CMMC certification. Let’s explore how these revisions affect CMMC compliance:

  1. Enhancing Alignment: NIST has aligned the language of SP 800-171 Revision 3 with the closely related SP 800-53 Rev. 5, enabling defense contractors to apply the technical tools and controls outlined in SP 800-53 to achieve CMMC compliance. This alignment streamlines the implementation process and ensures a consistent approach to cybersecurity.
  2. Strengthening Security Requirements: The revised NIST SP 800-171 places increased emphasis on cybersecurity, reflecting the evolving threat landscape and state-level espionage targeting CUI. The new requirements address specific threats to CUI and incorporate state-of-the-practice cybersecurity controls. By adhering to these enhanced security requirements, defense contractors can bolster their cybersecurity posture and better protect sensitive information.
  3. Simplifying Implementation: NIST SP 800-171 Revision 3 introduces clearer instructions and specific criteria, reducing ambiguity and facilitating easier implementation. This streamlining of requirements simplifies the compliance process and enables defense contractors to align their cybersecurity practices with the latest industry standards.
  4. Aligning with Future CMMC Levels: The revisions in NIST SP 800-171 provide a foundation for future CMMC levels beyond Level 3. By incorporating the enhanced security requirements and alignment with SP 800-53 Rev. 5, defense contractors get a head start in preparing for future CMMC levels, ensuring a smooth transition as the certification evolves.

To achieve CMMC compliance, defense contractors must remain up-to-date with the revisions in NIST SP 800-171.

The upcoming Revision 3 brings enhanced alignment, strengthened security requirements, simplified implementation, and a forward-looking approach to future CMMC levels. By effectively understanding and implementing these revisions, defense contractors can ensure their cybersecurity practices meet the rigorous standards required for DoD contracts.

Back To Business I.T. is committed to supporting defense contractors on their journey towards CMMC compliance, and we’re ready to provide tailored cybersecurity solutions. Take the first step today by scheduling a gap analysis with our expert cybersecurity consultants.

Department of Defense prepares rollout of national cybersecurity standards

DoD cybersecurity standards

By Tyler Greenwood, Vice President of Back To Business I.T. (originally published in the Dayton Business Journal)

Cyber incidents like the SolarWinds attack in 2019 and the Colonial Pipeline ransomware attack in 2021 have the U.S. Department of Defense (DoD) taking urgent action to strengthen national cybersecurity regulations.

A report released last November found most prime contractors (and their subcontractors) hired by the DoD in the last five years failed to meet minimum cybersecurity standards, putting U.S. national security at risk. Security gaps in the federal supply chain have been well known for years, but attempts to fix them have failed.

Enter: CMMC

In response to heightened security risks, the DoD introduced Cybersecurity Maturity Model Certification (CMMC) program. Its goal is to ensure any company involved in the federal supply chain is protecting controlled unclassified information.

Under CMMC guidelines, more than 300,000 contractors must meet 110 NIST SP 800-171 controls, which the government sees as a reasonable cyber risk management approach. In addition, 80,000 of these organizations must complete a third-party assessment and certification to continue bidding on defense contracts.

When will CMMC certification be required?

The DoD is expected to release a final rule on CMMC framework by March 2023, which means contractors could start seeing requirements in RFPs/RFIs as early as May.

If your business is one of the 80,000 contractors that requires an outside assessment and certification, you may have less than a few months to do so. Failure to achieve compliance before the published rule could mean leaving money on the table and losing the ability to do business with the Department of Defense.

Getting started

If your company is still in the beginning stages of CMMC compliance, the time to act is now. Preparation and implementation of the following requirements can take upwards of 18 months. To get started on compliance, contractors should immediately:

  • Work toward meeting the 110 controls in NIST SP 800-171.
  • Identify their Supplier Performance Risk System (SPRS) score.
  • Create a system security plan (SSP).
  • Document plans of action and milestones (POA&M) to demonstrate how you intend to close any gaps for controls not yet met.

Next steps

If your organization has already started on CMMC compliance, consider conducting a preliminary self-assessment to see if you satisfy requirements. This can provide a range of helpful information to ensure you have everything functioning as expected once you’re ready to formally self-attest or go for your official certification.

If your business wants consultative guidance, including assistance walking you through standards you didn’t meet, explaining why, and offering suggestions on closing those gaps, you might find it beneficial to work with a CMMC Registered Provider Organization (RPO), such as Back To Business I.T.

As a full-service I.T. firm and the region’s leading CMMC-AB RPO, Back To Business I.T. can help you achieve NIST SP 800-171 compliance as well as help you prepare your plan of action and milestones (POA&M) and system security plan (SSP) required for CMMC certification. Learn more at www.backtobusinessit.com/cmmc-readiness.

CMMC 2.0 Updates

cmmc 2.0 updates

WHAT IS CMMC 2.0?

The Cybersecurity Maturity Model Certification (CMMC) was introduced by the U.S. Department of Defense (DoD) on January 31, 2020 to ensure the protection of sensitive unclassified information or controlled unclassified information (CUI).

Originally, the CMMC framework had five levels of cybersecurity maturity (basic to advanced/progressive) and affected more than 300,000 defense contractors. However, on November 4, 2021, the DoD formally announced the CMMC 2.0 framework. This updated version seeks to simplify the model and reduce compliance costs by streamlining the program and scaling back the requirement that all defense contractors obtain third-party certification of their cybersecurity capabilities. Under CMMC 2.0, about 80,000 contractors will have to undergo third-party assessments while contractors at non-critical CUI levels are able to self-certify. Additionally, contractors who are not yet in full compliance with applicable cybersecurity requirements will be permitted to perform less sensitive contracts if they make a Plan of Action & Milestones (POA&M) and commit to completing the remaining requirements within specified dates. These changes are reflected in the diagram below (published by the DoD):

WHAT ARE THE NEW LEVELS?

1️⃣ Level 1 (Foundational) only applies to companies that focus on the protection of federal contact information (FCI). It is comparable to the old CMMC Level 1. Level 1 will be based on the 17 controls found in FAR 52.204-21, Basic Safeguarding of Covered Contractor Information, and focus on the protection of FCI. These controls look to protect covered contractor information systems and limit access to authorized users.

2️⃣ Level 2 (Advanced) is for companies working with controlled unclassified information (CUI). It is comparable to the old CMMC Level 3. CMMC 2.0 Level 2 (Advanced) requirements will mirror NIST SP 800-171 and eliminate all practices and maturity processes that were unique to CMMC. Instead, Level 2 aligns with the 14 families of security requirements and 110 security controls developed by the National Institute of Technology and Standards (NIST) to protect CUI. Accordingly, the 20 requirements in the old CMMC Level 3 that the DoD had imposed were dropped, meaning that the new Level 2 (Advanced) is in complete alignment with NIST SP 800-171.  Identified within DoD contracts under DFARS 252.204-7012 clause.  DoD is still working to define the “critical” CUI information.

3️⃣ Level 3 (Expert) is focused on reducing the risk from Advanced Persistent Threats (APTs). It is designed for companies working with CUI on the DoD’s highest priority programs, estimated to be about 600 companies. It is comparable to the old CMMC Level 5. The DoD is still determining the specific security requirements for the Level 3 (Expert), but has indicated that its requirements will be based on NIST SP 800-171’s 110 controls plus a subset of NIST SP 800-172 controls.

WHEN WILL CERTIFICATION BE REQUIRED?

The DoD is in the rulemaking process and negotiations with the CMMC Accreditation Body, which is expected to take an additional 9-24 months. While these rulemaking efforts are ongoing, the DoD is suspending mandatory CMMC certification, however, it is strongly recommending defense contractors act now and get CMMC assessed/certified to minimize the risk of DIB companies exposing sensitive unclassified information.

HOW TO GET STARTED

Defense contractors looking to start their CMMC compliance journey should look into meeting the 110 controls in NIST 800-171 as soon as possible, as preparation and implementation can take up to 18 months or more.

Not only can we help you achieve NIST-SP 800-171 compliance, but we can also perform a comprehensive gap analysis and determine your current SPRS score.  Then work with you on a plan to resolve areas of non-compliance. As a full-service I.T. firm, we can also implement solutions to address gaps so you are ready for CMMC certification and future audits.

CONCLUSION

CMMC 2.0’s cybersecurity standards will better arm the DoD in its efforts to defend against cyberattacks that threaten U.S. critical sectors. But it’s clear that the DoD cannot wait for CMMC 2.0 formalized assessments to improve cybersecurity in the Defense Industrial Base. While the CMMC 2.0 requirements work their way through the federal rulemaking process, enforcement of federal cybersecurity regulations governing defense contractors has stepped up. If you’re seeking future business with the Department of Defense, it’s important you get started on the compliance path right away.

What is a CMMC RPO?

CMMC rpo

Throughout 2020, the U.S. Department of Defense released details surrounding the Cybersecurity Maturity Model Certification (CMMC) requirements for companies in the defense industrial base (DIB). These new consolidated cybersecurity requirements are driving suppliers and contractors to dedicate time, money, and other resources to strengthen their cybersecurity strategy to meet compliance. Depending on the company’s existing cybersecurity posture, some will have much more work to do than others, and they will all need professional guidance.

It’s no surprise that the market has been recently flooded with consulting firms claiming to be experts in CMMC compliance requirements. Keep in mind that not all third-party consultancies are created equal. As a small business, we understand how important it is to properly vet vendors, and make sure you’re getting the most out of every dollar you assign to projects like these.

The CMMC Accreditation Body (CMMC-AB) has introduced five certifications and authorizations to differentiate entities offering CMMC compliance services. These are:

  • Certified Third-Party Assessor Organizations (C3PAO)
  • Registered Provider Organizations (RPO)
  • Registered Practitioners (RP)
  • Certified Professionals (CP)
  • Certified Assessors (CA)

We’re happy to provide some details regarding the RPO authorization, and what is involved.

RPOs like The Greentree Group are authorized by the CMMC AB to provide consulting services to government contractors and other companies in preparation for their CMMC assessments. We can also assist during these assessments if there is a finding that will prevent you from attaining your desired CMMC maturity level. However, we do not conduct certification assessments, and we do not grant certified status. Only C3PAOs are equipped to conduct these certification assessments. As an RPO, we are here to provide CMMC guidance and support to companies impacted by these new regulations. It’s important to remember that C3PAOs cannot provide guidance unless they’re also certified as an RPO – and even then, they cannot offer the same services (assessment + guidance) to the same company.

WHAT GOES INTO BECOMING AN RPO

A company must do the following to become certified as a CMMC RPO:

  1. Be an entity owned by a “US person”.
  2. Be registered with the CMMC-AB in order to receive authorization to use the official logo distributed by the CMMC-AB.
  3. Sign an RPO agreement, reflecting a commitment to comply with the CMMC-AB Code of Professional Conduct.
  4. Clear an organizational background check.
  5. Have at least one Registered Practitioner (RP) on their team. An RP is specially trained and authorized by the CMMC-AB to deliver “non-certified advisory services informed by basic training on the CMMC standard” at all times.
  6. Pay an annual registration fee.

These requirements put in place by the CMMC-AB are helpful for companies seeking certification because they provide a measure of legitimacy. As with any new regulations or rules, there will be many companies claiming to be experts in the field, and competing for your business. By selecting a company that has attained its RPO authorization, businesses can be confident that their choice is well suited for the job and committed to CMMC standards.

CHOOSING THE RIGHT CMMC RPO FOR YOUR COMPANY

RPO authorization is an important consideration when choosing a provider- but there are other things you should keep in mind. Other important questions you may want to ask –

  • How much experience does the RPO have in cybersecurity and maintaining compliance in highly regulated spaces?
    • The Greentree Group has supported both DoD programs and DIB clients with obtaining and maintaining required cybersecurity compliance for over a decade
  • Do they have experience with other frameworks such as CIS CSC, NIST SP 800-53, NIST SP 800-171, and ISO 27001?
    • Greentree has cybersecurity experts for the cybersecurity framework you require
  • How knowledgeable are they about the defense contracting environment?
    • Greentree’s cybersecurity team has a combined 50+ years of defense contracting experience
  • How many years have they been in business? Are they well-established?
    • The Greentree Group has been in business for 26 years with an established reputation for excellence in customer support
  • How easy is it for the provider to scale efforts appropriate to your business?
    • We support clients of all different sizes and architectures, as your business grows our support for your cybersecurity needs can grow with you

Note: Back To Business I.T. is a service brand of The Greentree Group.

WHY IS THE RPO AUTHORIZATION IMPORTANT FOR YOUR BUSINESS?

The new CMMC-AB authorization process for RPOs is an effective way for companies to sift through the increasing chatter in the CMMC consultancy space. The RPO certification signals that a consulting firm is invested in the CMMC space, and has committed to cybersecurity best practices. By visiting the CMMC marketplace, companies can look for certified RPOs in their area and reach out on their own terms.

We are authorized by the CMMC-AB as an RPO, and ready to guide your business along in the CMMC journey. Are you ready to learn more? Fill out this form and one of our cybersecurity experts will be happy to provide more information about CMMC compliance.

The Greentree Group is a CMMC Registered Provider Organization (RPO)

CMMC Registered Provider Organization

We are now a Cybersecurity Maturity Model Certification (CMMC) Registered Provider Organization (RPO) authorized by the CMMC-AB.

This new achievement solidifies our position as a leader in CMMC compliance solutions and services meant to protect government data in defense contractor systems. According to the National Accreditation Board, CMMC-AB is an independent accreditation body “responsible for establishing, managing, controlling, and administering the CMMC assessment, certification, training, and accreditation processes for the Department of Defense (DoD) supply chain.” Our new Registered Provider Organization (RPO) status reflects our commitment to the CMMC Accreditation Body (AB) code of professional conduct. It allows our company to provide advice, recommendations, and consultation to our customers as they seek their own CMMC-AB certifications.

Since 1993, The Greentree Group has been providing comprehensive professional services and technology solutions to small and medium-sized organizations, including:

  • Cybersecurity solutions
  • I.T. Support
  • Cloud Solutions
  • Technology Strategy

We offer a suite of comprehensive business technology services to include solutions which support Cybersecurity Maturity Model Certification (CMMC) compliance. Our team of cybersecurity experts assist defense contractors in becoming CMMC audit ready by implementing technical solutions and developing documentation and policies required by CMMC. In addition, we provide options for ongoing services to maintain compliance after certification.

CMMC SUPPORTS IT MODERNIZATION AND SUPPLY CHAIN SECURITY

CMMC is a new cybersecurity compliance standard that will be required for contractors to bid and win DoD contracts. The Defense Federal Acquisition Regulation interim rule took effect on November 30, 2020 and initial assessments are expected to begin in calendar year 2021.

CMMC-AB authorized RPOs provide advice, consulting, and recommendations to their clients. They are the implementers and consultants, but do not conduct Certified Assessments. They understand the CMMC Standard, and are qualified as:

  • Aware – Employs staff trained in basic CMMC methodology
  • Registered Practitioner Staffed – Offers CMMC trained consultative services
  • Targeted – CMMC assessment preparation
  • Trusted – Bound by a professional code of conduct

View our listing on the CMMC-AB Marketplace!

Ready to learn more? Our team of cybersecurity professionals would be happy to provide more details about the CMMC requirements, and what they mean for your business. Contact us today!

Skip to content