CMMC

“Highly professional, met all deadlines, responsive to all questions, excellent knowledge of the CMMC model as it stands as well as keeping up to date with changes.  Sawdey has been a great company to work with, we are very happy with our selection of your company to help guide us to CMMC compliance.”

– T.J. McCambridge, Quality Manager, Black Diamond Engineered Products, Inc.

“Sawdey has been excellent in following-up and has gone above and beyond in helping us find solutions to issues.”

– Beth Robb, Project Manager, Liona Enterprises, Inc.

“Very good communication and work products.  Accomplished what we set out to do.”

– Doug Barber, Founding Principal/COO/Executive Vice President/FSO/ITPSO, BB&E, Inc.

One eye-opening finding of the pre-assessment came when comparing it to an assessment performed internally.  Certain cybersecurity requirements were more nuanced than originally perceived, which of course translates to vulnerabilities and a lower SPRS score.  Sawdey Solution Services made it easy to identify the CMMC shortcomings and provided a roadmap to compliance.”

– Garrett Sargent, Founder, PSOAS LLC

Our confidence in your [Sawdey’s] understanding of the standard was high.  We appreciate your [Sawdey’s] understanding of our situation as a very small business trying to gain this certification.”

– John Noel, Vice President, Noel-Smyser Engineering Corporation 

CYBERSECURITY MATURITY MODEL CERTIFICATION (CMMC) PROGRAM

What is CMMC? 

The CMMC Program aligns with the Department of War’s (DoW) existing information security requirements for the Defense Industrial Base (DIB). It is designed to enforce the protection of sensitive unclassified information shared by the DoW with its contractors and subcontractors. The Program provides the DoW with increased assurance that contractors and subcontractors are meeting the cybersecurity requirements for non-federal systems processing Controlled Unclassified Information (CUI).

Key features of the CMMC Program: 

  • Tiered Model: CMMC requires companies entrusted with sensitive unclassified DoW information to implement cybersecurity standards at progressively advanced levels, depending on the type and sensitivity of the information. The Program also outlines the process for requiring protection of information flowed down to subcontractors. 
  • Assessment Requirement: CMMC assessments allow the DoW to verify DIB implementation of existing cybersecurity standards. 
  • Implementation through Contracts: DoW contractors and subcontractors handling sensitive unclassified DoW information must achieve a specific CMMC level as a condition of contract award. 

How is Sawdey well-positioned to help your organization prepare for CMMC? 

  • We have a dedicated team of cybersecurity experts, including a Lead CMMC Certified Assessor (Lead CCA), and CMMC Certified Professionals (CCPs) who have successfully prepared numerous clients for CMMC Self-assessments and C3PAO assessments.  Sawdey Solution Services has its CMMC Level 2 Third-party Assessed Certification and so do many of our clients!
  • We have advised “how-to” build and maintain numerous CMMC Level 1 and Level 2 compliant Information Systems. 
  • We are a Capability Maturity Model Integration for Services® (CMMI-SRV) Maturity Level 3 (ML3)-appraised company following International Organization for Standardization (ISO) 9001/14001/20000-1/27001 certified processes.
  • We have been selected by a major university as a partner responsible for educating suppliers on CMMC within the state of Ohio. 

Specifically, what CMMC services can Sawdey provide your organization? 

  • Significant assistance with achieving the 110 CMMC Controls and 320 Assessment Objectives required of CMMC Level 2.
    • Our CMMC Advisors have a proven history assisting organizations at all stages of their CMMC journeys.
    • Working with Sawdey, you don’t have to look other partners for the key expertise needed to achieve and maintain CMMC compliance.
  • Identification of the needed CMMC level, based on current and anticipated DoW Contracts.
  • Risk mitigation strategies to more effectively manage and reduce cybersecurity risk.
  • Full Cybersecurity Programs including, but not limited to, System Security Plans (SSPs), Cybersecurity Policies and Procedures, Shared Responsibilities Matrices (SRMs), Implementation Schedules, Self-Assessment advising, and Plans of Action & Milestones (POAMs).
  • Assistance with enrolling and uploading your self-assessment score in the Supplier Performance Risk System (SPRS).
  • Continued education and training as DoW cybersecurity rules and standards evolve.

Prepare for CMMC with confidence. 

Sawdey is assisting DoW suppliers throughout the U.S. navigate the complexities of CMMC. With Sawdey, you can achieve a high-quality evaluation of your current cybersecurity posture and learn how best to obtain your desired CMMC level. To gain a competitive advantage, consider successfully completing your CMMC compliance now. 

Key Resources 

    • DoW CIO CMMC information site 
      • Internal Resource section has the more pertinent information 
    • Accreditation Body (AB) for the CMMC Program 
    • Monthly Town Halls on the CMMC Program Status 
    • CMMC Assessment Process (CAP)