Level 4

CMMC Level 4 builds on CMMC Levels 1 thru 3 by adding 26 additional practices and one additional process.

CMMC Level 4 provides measures to safeguard CUI and reduce the risk of Advanced Persistent Threats. The additional 26 practices enhance the detection and response capabilities of an organization to address and adapt to the changing tactics, techniques and procedures used by our adversaries.

The process requires that contractors measure their effectiveness against the cybersecurity plan (collect and analyze metrics) and share the information with upper-level management.

It is estimated that less than 1% of the Defense Industrial Base will be required to be compliant with CMMC Level 4 requirements.

Recommendation

  1. Contractors that are required to be compliant with CMMC Level 4 will need to engage an expert cybersecurity consultant to assist with compliance.

Note:  An advanced persistent threat is a stealthy threat actor, typically a nation state or state-sponsored group, which gains unauthorized access to a computer network and remains undetected for an extended period. In recent times, the term may also refer to non-state sponsored groups conducting large-scale targeted intrusions for specific goals.

If you are, or plan to be in the Department of Defense supply chain, you must comply with cybersecurity regulations. To help North Carolina defense contractors understand and implement cybersecurity regulations, multiple State entities and organizations that support the defense industry have established the NC Interagency Cybersecurity Coordinating Committee (I3C). The goals of the committee are to provide defense contractors with 1) up to date and accurate information about cybersecurity regulations and requirements; 2) effective tools they can use to assess their current level of compliance in preparation for DoD certification; and 3) access to reputable companies, institutions and other resources to help them bridge their assessment, compliance, workforce and technical gaps to cybersecurity compliance. 

CyberNC.us is managed by the North Carolina Military Business Center through the North Carolina Interagency Cybersecurity Coordinating Committee (I3C).
Support provided by Fayetteville Technical Community College and NC State University's Secure Computing Institute.

The NCMBC and the I3C are not representatives of the DoD or the CMMC Accreditation body. This website is meant to be a community resource for cybersecurity compliance information.

Copyright 2020, North Carolina Military Business Center.  All Rights Reserved.