10 Things You Should Know Before Your CMMC Assessment

[00:00:01] Hello Climbers and welcome to Climbing Mount CMMC. Boxing up by 6. Good job. What is it doing? What's that? Welcome back Climbers to another episode of Climbing Mount CMMC. Today I will be your solo host for Climbing Mount CMMC.

[00:00:26] Kaylee is on vacation this week so we wanted to give her some reprieve from the daily duties. So wish you the best in your vacation Kaylee. Hope you have a good time. But we're going to go over 10 different things. First five are going to be what you should probably think about on an assessment when you're like coming up to a month or so. And the second five items are going to be things to think about during the assessment. So the first one I would suggest is the assessment prep doc. It's something that we do a lot. We do for every assessment.

[00:00:54] And basically in that document it breaks down every objective. So there's 320 of them. So we break down all 320 assessment objectives and how we meet them, pulling in policies and the different technical controls. So remember in the way that the 800-171-alpha document is written, they'll use phrases like identify, determine. Those types of statements are usually covered by evidence gathering.

[00:01:21] So a lot of times assessors can go ahead and mark you met on those if you have the right documentation and evidence loaded, which is good. That's great having that done in advance. But also in that assessment prep, you should have in there when it starts to get to stuff where you're going to have to verify. So that's where the control is like restrict, control. Those are things, those are power verb words that are going to be used that refer to more than likely something that's going to be a test related by the assessor.

[00:01:51] And so they're going to be like, hey, show me this. So this is where when you already have your assessment prep, you literally have like the menus that you're going to go to and what you're doing because you don't want the assessor spending any more time looking at your environment than they have to. So having all the menus and where you need to go is really helpful in helping you just be very efficient, especially like during the assessment when they ask, okay, we're going to be doing CM or AC domains.

[00:02:18] I'll go ahead and spin through my assessment prep doc and open all of the screens in advance. Before that, so I can move a lot faster. So that helps you. What tickets are you going to show? And these kinds of things. That's all really, really good stuff. So the assessment prep is super helpful. It also can be the basis for the evidence list. Assessors want to see that evidence list in advance. The reason why they want to see that is because they like to copy that information into their assessment document.

[00:02:41] So it helps them know like for each assessment objective, which critical like documentation evidence is going to be referred to those. So if you have that all as part of your prep, makes it really easy when they ask, like, give me the evidence list. You can just like copyright out of that. It's very nice. The second thing that I would recommend is having like a full self-assessment before you go in. So part of the control requirement is that you have done an evaluation of yourself. So that's one thing. And you have to do that yearly, right?

[00:03:10] So having that full assessment recorded and saved and documented is good fastidious process that you want to do as you're coming into that month of your assessment. And you want to keep that for multiple years, right? I think it's like six years that you need to keep it for for your affirmation each year as well. So if you do that self-validation every year, that should really help there. The third thing is I recommend having like a mock assessment, like a month before you go in.

[00:03:35] The reason why that's great is because a lot of times you live in those echo chambers where you sort of believe everything that you've written and all the policies and everything. And if you haven't had an outside source look at and validate what you have, you might be sorely mistaken when you come in. So having that mock or at least an external party look at it before you go in the assessment will be very helpful. Do it at least a month in advance, if not earlier. So that way, if you have some findings, you can go ahead and get them addressed.

[00:04:04] Those are really, really great. Especially during a mock, they're going to find some things that they probably are going to suggest that you change. So having at least a month's time frame for you to give yourself an easy runway to land on between then and when the actual assessment starts should make things go a lot easier. Also, pro tip, make sure the person that does the mock assessment for you, if you have the C3PO that's going to assess you, do your mock. They can do that as long as they're not providing consulting.

[00:04:28] Just try to make sure the people that do the mock are the people that are going to do your assessment because not everybody looks at things the same. So making sure that the people that do your mock are the people that are going to do your assessment is a good, good call. The documentation is up to date. So that would be number four, that you have like the latest versions. Your SSP needs to have a current date on it. If you haven't updated your SSP in two years before you go into your assessment, chances are it's not going to go well.

[00:04:53] So you want to make sure that you've checked all the versions of your documents and that those things are ready to go. That's something that's always really good to do. And then one of the things that seems to always fall in the background for everybody as you're coming in for the assessment is nobody seems to ever talk to HR or your marketing department when you're coming in. They're like the last people that people seem to talk to. And those are the people that are also going to be pulled in a lot of times to your assessment because they're going to want to see the background check.

[00:05:18] They're going to see that the people that do the authorization before they get in access and employment to the company, which is usually your HR, that they've done the training before they're given access. So you want to make sure that they have all of that evidence. It's a good idea to get a few of your background checks redacted. So if it has PII type information that you don't feel comfortable showing the assessor, that's fine. You can redact it just to prove that they have had that background check and that it checks all the boxes. So those are the first five that I would say when you're coming to the assessment.

[00:05:49] So the next five, what do you do about things when you're in the assessment? Some good pointers around that. So I jotted down like five quick things. The first one I would say is just stay calm during the assessment. A lot of times there's going to be findings. And so kind of like one and two would be if you do have a finding, determine whether it's just something that's going to take a corrective action, like maybe just a minor policy change or something along those lines.

[00:06:14] Or if it's a not met where you're going to have to provide more evidence to the point where you might fail. And what's the difference between the two? Well, policy change would be like if you were referring to your access control policy, you know, section 1.1 and it's actually 1.2. That would be a minor thing. Or it might say maybe you might have had in your policy talk about how you had something authorized and it was something that you've now changed.

[00:06:43] It's clearly shown that you don't have it. You can prove that you technically are not doing that anymore. But your policy sort of refers to it still. A lot of times assessors would let you adjust that because you've been able to show that you're doing it a certain way. But your policy just needed to get updated. They usually will give you grace around those types of things. Where they might fight you is a lot of times around the technical controls.

[00:07:07] So, for example, say they have a question on whether you're actually doing MFA correctly in the way that the control is written. If you get a not met on that, there's not really any coming back from that. So, that's where having someone examine your environment ahead of time, just especially from a technical perspective to make sure it's meeting all the right controls should help alleviate a lot of that. And then in that assessment prep, validating and making sure those configurations are in alignment before your assessment is really helpful.

[00:07:36] One of the things I would recommend, too, is reread the cap when you're going into the assessment. Like the day before or something. Just go through and reread it. It's not a very long document. And refresh your mind about what your rights are, about how the assessment is supposed to be done, what rights you have to handle if you have any objections. Those are just really, really important stuff. The next one that I would recommend is cameras off, which is weird. Sometimes people don't really think about it. And a lot of people don't like having their cameras on in the first place, which is fine.

[00:08:06] But during the assessment, assessors are reading everything. So, your face can say a lot. So, having your camera on during your assessment may not be such a great idea, especially if you're very expressive with stuff and you're kind of like, you know, your face is an open book. Definitely turn your camera off. Don't have it on because assessors will zoom in on that. And if you look all shocked or whatever, they're like, well, why is he or she shocked? What's going on here? So, that's a good thing.

[00:08:32] And another thing that's really important to think the last thing I would leave you with is it's okay to ask for a pause. Or to potentially move on to another objective to give you some time to gather the information. It is wiser to pause and not speak until you double check stuff than to say something that is wrong and feel like you're trying to cover it up. So, for example, say that the assessor says, hey, I don't think you have BitLocker enabled on this system.

[00:09:01] Let's just say, for example, that you don't have the right encryption turned on or something along those lines. And if you aren't 100% sure before you speak, it's okay to want to double check it. And a lot of times the assessor is because they're time sensitive. They want things to be done right away. And that makes sense. But you may not have the ability right then to be able to look and dig like you want to give them an accurate answer. So it is okay to say, hey, I'm going to have to double check on some of these things. I'm going to have to get this information.

[00:09:30] Can we go on to the next assessment objective and then get that back to you evidence-wise? And the assessor has every right to mark that as not met then, which they probably would because they want to make sure they don't miss that. So they may mark it as not met and it could be listed as a finding on your hot wash at the end of the day. But if you're able to find the information and close it out and give them the right accurate information, they should flip it back to met again once you give them all the accurate information. Say, yeah, here's some screenshots. See here. This is how this is.

[00:10:00] I got this here. We're good, right? And a lot of times they're okay with that. But it's better to be cautious and make sure that you're providing that information accurately than to misrepresent and then have to back puddle it. That's not a good look. And that's where having that assessment document, like I said before, is very helpful because when you do that, a lot of times you're able to have all that information in advance and ready to go. Right? And that helps make that assessment process go a lot smoother.

[00:10:28] You can refer back to your prep doc and go, okay, well, this is the information and you can show that to them a lot of times and have the menus all there and it usually goes pretty well. But sometimes you get stumped. So it's okay to be like, hey, let me get back to you on that. Well, I hope you found this very helpful, this list of items or things just over the years that I've kind of gone through. And it's been very helpful for us as we go through assessments, getting ready, as well as going through them real time to keep those in mind.

[00:10:56] Please make sure to follow us, hit subscribe, as well as provide any feedback or comments or anything that you'd like to see us cover would be very helpful. But as always, everybody, keep on climbing. Goodbye for now.