Cybersecurity Maturity Model Certification and the Importance of Culture
In many of the discussions about the Cybersecurity Maturity Model Certification (CMMC), I find one thing lacking. This is an emphasis on developing a culture of cybersecurity within Defense Industrial Base (DIB) contractors and how that translates into reality for companies large and small. Achieving certification at any of the 5 CMMC maturity levels isn’t just a one-time or even triennial event (every 3 years) to demonstrate compliance with tens or hundreds of security practices to a certified 3rd party assessor (C3PAO). Businesses that think this way may be in for a rude awakening as they go through the initial assessments. And even more so as the CMMC model evolves and becomes more challenging over time.
Source:
