DATASHEET

Archer CMMC Management®

Use case for IT & Security Risk Management

Cybersecurity Maturity Model Certification (CMMC) is a new initiative of the U.S. Departmentof Defense (DoD), designed to enforce and maintain contractor and subcontractor cybersecurity
compliance across the federal defense industrial base. Its primary objective is to protect
controlled unclassified information (CUI) – defined as any information the U.S. government
creates or possesses or another entity creates or possesses on its behalf – within the U.S.
defense industrial vendor base. This can include infrastructure, export controls, financial,intelligence, legal information, and other unclassified data.
CMMC requires that any commercial organization doing business with the DoD be certified bya third-party CMMC assessor to validate that they meet the appropriate CMMC specifications.
The DoD has defined five levels of CMMC certification, ranging from basic cyber hygiene toadvanced cybersecurity maturity; each level has its own set of supporting practices and processes.
To meet the requirements for a specific level, a contractor must first meet the practices andprocesses of the levels that precede it. The Defense Counter Intelligence Agency estimatesthat in the next five years as many as 3 million organizations will seek certification.

The Archer CMMC Management Advantage
Preparing for a CMMC assessment is a new and significant challenge for organizations seeking
certification. To meet the challenges of CMMC certification, Archer CMMC Management enables
organizations to identify, document, and manage the appropriate CMMC practices and processes
required for improved cybersecurity hygiene for storage and management of CUI data.
Archer CMMC Management focuses on pre-assessment activities such as defining scoped
boundaries, system components, policies, and procedures; allocating the appropriate
assessment processes, assessment practices, and assessment objectives across the different
components of the system; identifying deficiencies, remediating POA&Ms; and creating theappropriate system security plan (SSP) documentation. Archer CMMC Management alleviates
many of the challenges of managing and engaging in preparatory pre-assessment work.

Features• Pre-CMMC assessment plan development with clearly defined boundaries, systems, and components in scope for certification assessments.
• Compliance mapping and security requirement instantiation at the appropriate level for new CMMC certification assessments.
• Automatic mapping of relevant Assessment Objectives to each of your subsystems, ensuring proper alignment for assessments across all		 the subsystems within your boundary scope.
• Evidence documentation (e.g., artifacts, comments, screenshots) at the Practices and Processes top level as well as the individual 				 Assessment Objective level across each subsystem for assessment defensibility.
• Identification, documentation, management, and resolution of deficiencies across security requirements.
• Streamlined compliance reporting capabilities.
• Real-time status dashboarding.

Benefits• Maintain a view of current CMMC gaps,		 documentation, and action plans in a		 central risk and compliance solution.
• Provide real-time visibility into status		 and prioritization of any deficiency and		 its remediation progress.
• Automate follow-up and remediation		 processes to speed resolution of identified		 CMMC deficiencies.
• Maintain your certification environment		 and resolve new security requirement		 deficiencies as they arise.

About Archer
Archer is a leading provider of integrated risk management (IRM) solutions that enable customers to improve strategic decision-making
and operational resilience with a modern technology platform that supports qualitative and quantitative analysis driven by both businessand IT impacts. As true pioneers in GRC software, Archer remains solely dedicated to helping customers manage risk and compliancedomains, from traditional operational risk to emerging issues such as ESG. With over 20 years in the risk management industry, theArcher customer base represents one of the largest pure risk management communities globally, with more than 1,200 customers
including more than 50% of the Fortune 500.
Visit www.ArcherIRM.com.

@ArcherIRM

Archer Integrated Risk Management©2023 Archer Technologies LLC. All rights reserved. Archer and the Archer logo are registered trademarks or trademarks of ArcherTechnologies LLC in the United States and other countries. All other trademarks are the property of their respective owners. Archerbelieves the information in this document is accurate. The information is subject to change without notice. 10/23 Data Sheet.