Demonstrate Cybersecurity Excellence with DoD

CMMC Compliance

Government contractors have an enormous responsibility to protect the controlled unclassified information (CUI) they collect and share with the Department of Defense (DoD). Poor cyber hygiene not only jeopardizes a key revenue stream but endangers the nation’s Defense Industrial Base. With Kiteworks FedRAMP authorized enterprise content firewall, government contractors verify adherence with DoD’s rigorous cybersecurity requirements for CMMC compliance.

Take the Short Road to Secure Business with the DoD

Reduce cost, administration, and complexity by deploying a single platform to protect and manage the breadth of your content communications, including encrypted email, file sharing, SFTP, managed file transfer (MFT), forms, and custom enterprise integrations, with no file size limitations.

Turn On CMMC 2.0 Compliance

Support Nearly 90% of Level 2 Practice Requirements Out of the Box

Deploy Kiteworks for a big head start in the race to comply with CMMC Level 2. The platform itself checks the boxes for defense in depth, such as built-in hardening, encryption of data and metadata, and zero trust between services. Simply select the policies you need, such as least-privilege access controls and separation of duties to prevent unauthorized access, and leverage its comprehensive, centralized logging and reporting to prove compliance to auditors.

Learn more about Kiteworks CMMC 2.0 practice mappings

Ease Deployment With FedRAMP Moderate Authorization

Avoid the time and cost of proving your cloud platform meets 325 NIST 800-53 security controls—critical to CMMC—by adopting one the U.S. federal government has already approved: FedRAMP Moderate Authorized. Unlike using “FedRAMP equivalent” vendors, you won’t need to show it complies with requirements for regular pen tests, employee screening, strong encryption, physical security, incident response plans, and many others.

Learn more about Kiteworks FedRAMP Authorization

Ease Deployment With FedRAMP Moderate Authorization

Safeguard CUI With Centralized, Comprehensive Access Controls

Efficiently administer a single set of user roles and policies to protect all the communication channels the Kiteworks platform consolidates. Reduce inadvertent or malicious CUI exposure with default least-privilege access controls over folders, emails, SFTP, managed file transfer (MFT) flows, and forms, as well as clients, functions, repositories, and domains. And no matter what deployment option you choose, Kiteworks employees never have access to content in your Kiteworks system.

Learn more about Kiteworks security

Protect CUI With Seamless Encryption and Data Protection Integrations

Kiteworks encrypts CUI with strong ciphers in transit and at rest. End-users email and share files with partners from wherever they work, in Outlook, in Office, on the web or mobile, or with plugins to enterprise applications. They never have to worry about keys or certificates because the platform manages them invisibly behind the scenes. Prevent the spread of leaks or malware, however, by automatically scanning files with DLP, ATP, and AV.

Simplify Audits and Hold Malicious Actors Accountable With Unified Logging and Reporting

Depend on the comprehensive, immutable audit trail Kiteworks provides for all user, automated, and admin activities, including all actions on content, permissions, and configuration. Analyze, alert, and report on the events using built-in tools, or forward to your SIEM via syslog or the Splunk Forwarder for deeper analysis.

Learn more about content visibility

Tightly Manage Configurations to Maintain Security

The Kiteworks hardened virtual appliance follows the principle of least functionality required for CMMC compliance by exposing only a few essential ports, with all nonessential services disabled. Further, the server prevents users and administrators from accessing the operating system or installing software, enforces strict separation of duties, and logs every configuration change. And when you prepare for audits, it provides the reporting you need to validate configurations and documented controls.

Frequently Asked Questions

CMMC 2.0 is an update to the Cybersecurity Maturity Model Certification (CMMC) that was initially released in January 2021. It is the Department of Defense’s (DoD) method for requiring organizations in the DoD supply chain to protect federal contract information (FCI) and controlled unclassified information (CUI) to the appropriate level determined (there are three levels in CMMC 2.0). CMMC 2.0 is a restructure of CMMC’s maturity levels by eliminating two of the original five ratings, improved assessment protocols that reduce costs for contractors, and the introduction of a more flexible path to certification through Plans of Action & Milestones (POA&Ms)

Compliance with NIST standards are levied as contractual requirements through inclusion of clauses such as FAR 52.204-21 and DFARS 252.204-7012. CMMC requirements result in a contractor self-assessment, or a third-party assessment by a CMMC Third Party Assessor Organization (C3PAO), to determine whether the applicable NIST standard (as identified by the DFARS clause) has been met. Under CMMC 2.0, a Level 2 assessment will be conducted against the NIST SP 800-171 standard and a Level 3 assessment will be based on a subset of NIST SP 800-172 requirements.

CMMC C3PAO is a CMMC Third Party Assessor Organization (C3PAO) authorized and certified by the CMMC Accreditation Body (CMMC-AB) to conduct assessments of contractors and subcontractors seeking certification to demonstrate compliance with the CMMC standard. C3PAOs are entrusted with assessing and certifying that companies in the defense industrial base (DIB) supply chain have met the cybersecurity requirements of the CMMC standard. Their responsibilities include evaluating and issuing certificates of adherence to the CMMC standard. The C3PAO must review and certify the contractor or subcontractor’s audit and self-assessment reports based on the DoD’s Cybersecurity Maturity Model. The C3PAO must also be able to recommend and implement corrective actions as needed.

CMMC 2.0 applies to all third parties within the defense supply chain, including contractors, vendors, and any other contracted third parties related to the support of the department of defense (DoD). All civilian organizations that do business with the DoD must comply with CMMC2.0, based on the type of CUI and FCI that they handle and exchange. The list of entities includes:

DoD prime contractors
DoD subcontractors
Suppliers at all tiers in the DIB
DoD small business suppliers
Commercial suppliers that process, handle, or store CUI
Foreign suppliers
Team members of DoD contractors that handle CUI such as IT managed service providers

According to Kiteworks, working with a CMMC Third Party Assessor Organization (C3PAO) provides several benefits for organizations seeking certification under CMMC 2.0 standards:

Expertise: A certified third-party assessor has extensive experience assessing cybersecurity programs across multiple industries and can provide valuable insight into best practices for achieving compliance with CMMC 2.0 standards.
Objectivity: An independent third-party assessor provides unbiased feedback on an organization’s security posture that can help identify areas where improvements are needed.
Cost Savings: Working with a certified third-party assessor can save time and money compared to hiring internal staff or consultants who may not have expertise in assessingcybersecurity programs.
Efficiency: A certified third-party assessor can quickly identify gaps in an organization’ssecurity posture, helping to reduce time spent preparing for certification.
Peace of Mind: Having an independent third-party assessor review a DoD supplier’s cybersecurity program provides peace of mind, ensuring that organizations have taken all necessary steps toward achieving compliance with CMMC 2.0 standards.

Government contractors, subcontractors, and systems integrators trust Kiteworks to unify, control, track, and secure sensitive documents in compliance with CMMC 2.0