.svg)
The Information Systems Audit and Control Association (ISACA) will become the CMMC Assessor and Instructor Certification Organization (CAICO) on April 1. This article will discuss the impact of this change and what it means for government contractors.
ISACA Overview
ISACA is a respected name in the audit and control environment, as it is the creator of the respected Certified Information Systems Auditor (CISA) and Certified Information Security Manager (CISM) certification programs. These programs ensure that an organization’s information systems are protected, and that relevant information security policies are in place. While the Cyber AB remains the official CMMC accreditation organization, ISACA is now responsible for training, examinations, and credentialing for all organizations and individuals involved in CMMC. ISACA will control the certification process for CMMC Certified Professionals (CCP), Certified Assessors (CCA and Lead CCA), and Certified Instructors (CCI).
ISACA has proven experience scaling professional certification programs and creating effective training curricula along with rigorous exams. They also have a global infrastructure and an exemplary record that will ensure consistency and quality for all organizations seeking CMMC compliance in the Defense Industrial Base (DIB).
ISACA’s Improvements to CMMC Rollout
One of the most concerning problems affecting the CMMC rollout is the bottleneck caused by a lack of CCAs and third-party assessor organizations or C3PAOs. With the experience and efficiency of ISACA, government contracts can expect a larger, better-prepared assessor workforce that will help ease the current bottleneck. With the arrival of thousands more certified CCAs and additional C3PAOs, primes and subcontractors will benefit from shorter wait times for CMMC Level 2 assessments. This accelerated process will lead to faster contract readiness and an easier path to winning and maintaining DOD business.
With their decades of audit and controls expertise, ISACA will offer a curriculum that will improve CMMC training quality. Whether your company is preparing for CMMC Level 1 (self-assessments) or third-party assessments required for CMMC Level 2, you will have access to standardized, elite-level preparation resources from ISACA. The association also offers effective training resources that your internal teams can utilize to obtain the CCP credential, which offers a dual benefit: Employees who are CCPs will help your organization be better prepared on your CMMC journey, and they will also expand their personal skills for their own career growth.
Consistent, high-quality assessor training will reduce variability in the results of third-party assessments. Contractors will benefit from clearer compliance roadmaps, and the DOD will have greater confidence in the DIB’s cybersecurity efforts.
ISACA will also make it easier for your company to align CMMC with broader professional standards. The association offers natural pathways to layer CMMC credentials onto your existing certifications. This benefit will reduce redundant training costs and help develop a more skilled cybersecurity staff.
Be Proactive During ISACA Changeover
Security experts recommend that your organization be proactive as the ISACA changeover occurs. First, closely monitor the ISACA credentialing portal (isaca.org/credentialing/cmmc) to access updated training schedules, exam availability, and transition FAQs. Your current CCP holders can continue working with their credentials, but new applicants will have to follow the ISACA route.
Second, organizations with upcoming CMMC assessments should contact C3PAOs promptly and confirm that their assessors are up-to-date with ISACA-issued credentials.
Work with a CMMC Expert
Companies who are proactive in identifying and taking advantage of ISACA-aligned training and early C3PA0 engagement will turn their compliance efforts from a disorganized scramble into a smooth and orderly process. By following this route, your company will have a competitive advantage for winning new DOD contracts over the many government contractors who are delaying CMMC compliance. By working with an experienced CMMC partner and understanding the impact of the transition to ISACA leadership, your organization will be able to effectively achieve and maintain CMMC compliance.
