Internal CMMC Implementation as a Contractor
Achieving internal CMMC (Cybersecurity Maturity Model Certification) Level 2 status, as many know, is no small feat. It’s a comprehensive organizational journey that demands much more than just your basic IT upgrades. As organizations across the Defense Industrial Base (DIB) work towards their own CMMC compliance, key lessons are emerging from those who have successfully navigated the process. One of those voices is Dy Eddington, Director of Information Security at AV (formally known as Blue Halo). In this episode of CybHer, Dy got to share her experiences leading her team through the rigorous assessment process.
There are many aspects of internal CMMC implementation that set it apart from other cybersecurity standards. One of those being its wide scope. It’s not just an IT initiative or a localized security issue; CMMC is an entire organizational transformation. In this discussion, the speakers stressed that CMMC must be woven into the fabric of the entire company, engaging leadership, operations, HR, finance, and every department in between. Leadership buy-in was noted as the backbone of a successful implementation. Without it, initiatives can stall, resources can fall short, and teams may lack clarity to meet compliance demands.
Documentation and Training: The Foundation of True Readiness
One common pitfall in preparing for a CMMC assessment is treating documentation as just a way to list out your policies and procedures. Instead, your documentation should be a living reflection of how your teams actually operate. They must be practical, personalized, and accurate, while also being clear enough to guide daily operations and strong enough to satisfy auditors.
Equally important is training. A well-prepared team is not just technically capable but also well-versed in compliance expectations. Regular training ensures that employees know how to execute secure practices and understand the “why” behind each control. Preparation generates confidence, which is critical during the assessment.
Cross-Functional Collaboration and Communication
Successful CMMC journeys require strong collaboration across departments. Understanding how departments interact, share data, and communicate with each other is essential for implementing the right controls in the right places. This extends beyond internal teams. Developing relationships with your subcontractors is also crucial. Since CMMC compliance often includes third-party risks, prime contractors must ensure that their partners are aligned with security requirements.
Continuous Improvement and a Supportive Industry Landscape
Achieving certification is nowhere near the end of the road when it comes to remaining compliant. It’s only just a milestone on an ongoing journey of continuous improvement. Compliance must be sustained, with organizations adapting to new threats, frameworks, and updated business operations. Maintaining a culture of security is just as important as passing the assessment itself.
Fortunately, organizations don’t have to go it alone if they don’t want to. The broader CMMC ecosystem is rich will guidance, tools, and community support. Professionals in the industry should ask questions and take full advantage of the resources available. There’s zero shame in not knowing; but there is risk in not learning.
Thriving Beyond the Assessment: You Passed! What’s Next?
Achieving internal CMMC Level 2 status is a challenge, but it’s also a powerful opportunity to strengthen organizational resilience and foster a culture of security. With the proper company mindset, organizations can not only pass their assessment; they can thrive in a more secure and connected system.
Passing your audit is just the beginning. Now, it’s time to maintain a CMMC regulated environment. Which is sometimes just as difficult.
If you have any questions, reach out to us. Or check out our podcast episode where we dive further into this topic.