Role of PKI in CMMC 2.0 Compliance

There has been a great deal of chatter and activity within the security industry, lately, regarding the Cybersecurity Maturity Model Certification (CMMC) Program. This program directly impacts many, if not all, of our DoD ECA Program Partners at IdenTrust who serve as contractors tasked with implementing “required security measures necessary to safeguard Federal Contract Information (FCI) and Controlled Unclassified Information (CUI)”[1].

The primary goals of this program to be considered[2]:

• Safeguard sensitive information to enable and protect the warfighter
• Enforce DIB cybersecurity standards to meet evolving threats
• Ensure accountability while minimizing barriers to compliance with DoD requirements
• Perpetuate a collaborative culture of cybersecurity and cyber resilience
• Maintain public trust through high professional and ethical standards

IdenTrust supports the DoD contractor with our External Certificate Authority (ECA) Medium Assurance products by providing the crucial PKI digital certificates in order to achieve CMMC compliance.

1. Enhanced Security: Our ECA Medium Assurance certificates provide strong encryption and authentication of authorized users and devices to access FCI and CUI as well as any Personal Identifying Information (PII) of the warfighter, the members of our Armed Forces.
2. Data Integrity: The IdenTrust ECA  [CM1]  certificates help maintain data integrity by ensuring data has not been altered or tampered with during transmission as well as authenticating machines and systems.
3. Access Control: Robust access control systems can leverage the IdenTrust ECA Medium Assurance suite of Identity certificates to authorize and control logical access to systems and data.  The Assurance levels escalate to fit the increased sensitivity and security of the data as dictated by the DoD.
4. Compliance: The IdenTrust ECA Program and certificates are aligned with various federal cybersecurity frameworks, such as NIS SP 800-171 to meet CMMC 2.0 compliance.

In summary, within an ever-evolving cybersecurity landscape, ensuring the identity of persons and systems is the fundamental building block to create and maintain a mature model for your DoD contracted program and business.  CMMC 2.0 compliance provides the framework, tiered models, assessment requirements and phased implementations needed to conduct business with the DoD.