DoD’s CUI Compliance Tree Is Set to Bear Fruit in 2025... Just In Time to be Empowered by Zscaler Zero Trust Solutions

(Not So) Fun Fact: 

American Apple trees take between 2-5 years to bear fruit. Similarly, the Department of Defense’s (DoD) Cybersecurity Maturity Model Certification (CMMC) has taken the same timeline toward fruition. As a seedling of an idea, CMMC was planted in Executive Order 13556. However, it wasn't until 2019 that the DoD announced CMMC, signaling a move away from relying on "self-attestations" as its cybersecurity compliance modus operandi. With CMMC, the DoD mandated a “trust but verify” program to ignite a cultural shift across the Defense Industrial Base (DIB) to protect sensitive defense information. 

CMMC’s Ethos: Protecting CUI 

Think of controlled unclassified information (CUI) as our national security’s digital supply chain—its protection is vital and non-negotiable. With the CMMC rule finalized, the DIB will now be compelled to not only ensure that their infrastructure storing, processing, and transmitting CUI is fortified to safeguard CUI but assessed against CMMC’s framework which uses NIST 800-171 and NIST 800-172 as its foundation. The stakes are high—failure to comply means exclusion from the DoD's business ecosystem.

What Is CUI?

CUI is a category of unclassified information within the U.S. federal government that requires safeguarding or dissemination controls pursuant to and consistent with applicable laws, regulations, and government-wide policies. (Whew, that’s a lot to say in one breath!) 

CUI includes a wide range of information types that are sensitive but not classified, such as:

• Controlled technical information: Technical information surrounding government architectures or IT systems.  This includes diagrams, equipment lists, SBOM’s, IP addresses, etc.
• Personally identifiable information (PII): Information that can be used to identify an individual, such as names, social security numbers, and addresses.
• Financial information: Data related to financial transactions, banking information, and other fiscal records.
• Proprietary business information: Trade secrets, business plans, and other corporate-sensitive information that could provide competitive advantages.
• Export control information: Technical data and other information subject to export control regulations.
• Health information: Medical records and health-related data governed by privacy regulations.
• Legal information: Documents protected by attorney-client privilege or that are part of ongoing legal proceedings.
• Infrastructure information: Details about critical infrastructure, including telecommunications, energy, and water systems.

The primary goal of CUI designation is to standardize the handling of sensitive information across federal agencies and their contractors, ensuring that such information is adequately protected from unauthorized access and disclosure, while still being accessible to those who need it to do their jobs.

The Road to CMMC Is Paved By Identifying and Protecting CUI

As the CMMC framework becomes an operational reality, it is imperative for DIB organizations, i.e., organizations seeking assessment (OSA), to have a comprehensive understanding of where CUI resides within their infrastructure. Identifying CUI within your systems is the first step towards creating a robust security boundary that meets CMMC requirements. Once CUI is identified, the CMMC boundary can be established and compliance with the NIST 800-171 controls can be assessed and implemented. Understanding where CUI resides and its various transactional paths is essential for protecting sensitive information from cyberthreats and ensuring that your organization can demonstrate CMMC compliance. Additionally, establishing an access boundary, technical and procedural, is also important as it highlights where in the organization the data and the IT systems need to be protected with the NIST 800-171 controls. 

CMMC + Modernized Defense-in-Depth = Zscaler

Zscaler enables defense, healthcare, and education institutions on their journey towards CMMC compliance. Our solutions are designed to help you meet the stringent requirements outlined in the CMMC framework, with key solutions including:

• Remote access controls: The Zscaler Zero Trust Exchange enforces a strict identity and policy-based access model, ensuring that only authenticated and authorized users can access CUI. This aligns with the CMMC's emphasis on rigorous access controls.
• Data protection: Zscaler's solutions provide robust data protection mechanisms, including encryption, data loss prevention, and secure web gateways. These tools are essential for safeguarding CUI against unauthorized access and data breaches.
• Architectural flexibility: Zscaler’s approach to vendor neutrality allows the OSA to install Zscaler on MacOS, Windows, Linux, and Chromebook code bases. This agnostic and neutral approach coupled with Zscaler’s 140+ API integrations empower organizations to establish, fortify, and enhance their CMMC green and brownfields. 
• Continuous monitoring and incident response: Proactive threat detection and response are critical components of the CMMC framework. Zscaler’s advanced analytics and continuous monitoring capabilities enable organizations to detect and respond to threats in real-time, ensuring compliance with CMMC's stringent monitoring requirements. Furthermore, Zscaler’s FedRAMP High and Moderate platforms comply with DFARS cybersecurity reporting standards.
• Simplified compliance management: Zscaler’s centralized management console offers visibility and control over the entire security posture, simplifying the process of maintaining and demonstrating compliance with CMMC standards.
• FedRAMP and IL5 enabled infrastructures:  As a FedRAMP High and Moderate platform, Zscaler operates above DoD’s FedRAMP equivalency memo, including DoD’s Impact Level 5 (IL5) requirements assessed to support the data protection and confidentiality at the highest levels of our federal government.   

Zscaler’s cloud-based zero trust, data protection, threat intelligence, and policy management solutions allow companies large and small to inherit and implement CMMC’s various protection levels. For more details, download our CMMC white paper, which outlines how Zscaler's innovative security solutions align with CMMC requirements. Leveraging Zscaler provides a clear path to achieving technical and administrative controls, principles, and compliance requirements for both CMMC and zero trust. 

By adopting zero trust, you can enhance your security posture and ensure that CUI is protected against evolving cyberthreats by not automatically trusting anything inside or outside your perimeter and must verify anything and everything trying to connect to their systems before granting access. 

CMMC, like zero trust, is no longer a “theory” or something drafted by a good idea fairy—it is an impactful framework that defense, healthcare, and education institutions use to accomplish its cybersecurity and compliance requirements. For instance, OSAs use Zscaler to accomplish CMMC’s legal, contractual, and cybersecurity requirements. 

Of the many, Zscaler is protecting almost 250 DIB companies including 6 of the top 10 Aerospace and Defense government contractors and manufacturers, protecting close to 640,000 users collectively. Moreover, the University of South Carolina and Texas A&M University have used Zscaler to protect research data enclaves, campus Wi-Fi, and support remote users while fortifying and enhancing their CMMC brownfields and establishing new CMMC enclaves, respectively. 

Join Our Exclusive CMMC Webinar Series

To further assist you in navigating the complexities of CMMC compliance, Zscaler is hosting an exclusive 3-part webinar series. This series is designed to demystify CMMC requirements and provide actionable insights for achieving compliance efficiently.

• Wednesday, November 13, 2024— Leveraging Zero Trust to Secure Controlled Unclassified Information (CUI) In this essential webinar, Sean Connelly and Jeff Adorno will explore the crucial intersection between Zero Trust principles and the safeguarding of Controlled Unclassified Information (CUI). While the Cybersecurity Maturity Model Certification (CMMC) is DoD's mandate for CUI protection, additional compliance requirements are emerging. Join us as our experts discuss how Zscaler’s Zero Trust solutions can accelerate your compliance timeline, ensuring robust alignment with CMMC and other regulatory frameworks.

• Wednesday, December 11, 2024— Achieving ROI in CMMC: Join our speakers in the second session to discuss strategies for reducing technical debt, achieving ROI, and balancing costs while implementing CMMC with Zscaler’s cost-effective solutions.

•  Wednesday, January 15, 2024— Implementing CMMC with Reference Architecture: In the final webinar of the series will cover how to implement CMMC using vetted reference architectures, with insights on deploying  solutions aligned with CMMC controls for a strong cybersecurity framework. 

Attend one or more of the webinars by clicking here and choosing the date(s) you would like to attend!