The Situation
Edwards Performance Solutions (Edwards) was an early adopter and thought leader in the Cybersecurity Maturity Model Certification (CMMC) program. But to handle Controlled Unclassified Information (CUI) and perform assessments as a CMMC Third-Party Assessment Organization (C3PAO), Edwards needed its own formal assessment from the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), while staying true to its role as an educator (an active LTP and LPP) and a consulting and assessment leader.
When Sam Bell, Edwards’ Chief Information Security Officer (CISO), began preparing, he worked with the team to design an internal assessment tool that tracked how well Edwards’ security matched CMMC requirements. This happened before the official CMMC assessment guides were released, which gave the team a head start.
The move from CMMC 1.0 to CMMC 2.0 tested Edwards’ agility. The team quickly adapted to the updated scoping guidelines, including changes to its CUI data flow diagrams. That diagramming work let Edwards successfully defend its system scope with the DIBCAC assessors, because every flow of CUI and Federal Contract Information (FCI) was clearly identified.
Our Solution
Edwards used its years of project management experience to design a Government Community Cloud (GCC) High enclave as its C3PAO environment. Strong project management kept the work focused on meeting every CMMC Level 2 requirement.
Edwards’ own subject matter experts have years of experience assessing security controls and recommending improvements. They documented the CMMC controls and recommended solutions to stay compliant. The team created a System Security Plan (SSP), policies, procedures, data flow and network diagrams, and other documents that together govern the cybersecurity program and prove CMMC compliance.
From this experience, Edwards learned the key to a smooth DIBCAC or C3PAO assessment: make sure the documentation meets every assessment objective, back it with the right evidence, and have a team ready to show how each practice works, so assessors can easily mark every practice and objective as met.
Today, Edwards uses this firsthand experience to help Defense Industrial Base (DIB) companies prepare for CMMC certification, and to conduct formal CMMC assessments.
