SOLUTION BRIEF (TRIPWIRE)

CMMC Compliance with Tripwire

How Tripwire Enterprise Keeps CUI Safe for the DoD
The U.S. Department of Defense (DoD) is implementing the Cybersecurity

HIGHLIGHTS

Maturity Model Certification (CMMC) program to standardize the level ofcybersecurity implemented throughout its 300,000 suppliers. In practice, thismeans that every member of the Defense Industrial Base (DIB) will be required
to pass an audit in order to win DoD contracts. Compliance for a small numberof contracts began in 2020, and phases in to the entire DIB over the next five years.

How the CMMC Is Structured

The way CMMC is structured is fairly straightforward. At the highest levels are 17domains. These are functional areas such as access control or physical security.
Within each domain, there are processes, capabilities and best practices.
Processes can be thought of as the regularly occurring events or plans needed
to maintain security. Processes are usually stated very generally, such as:“Establish, maintain and resource a plan that includes Access Control.” These
processes are broadly stated to allow for the variances that naturally exist indifferent organizations.
Capabilities are more functional. They describe a specific action that needs tobe taken or a goal that must be achieved. One example is: “Perform auditing.”
Practices are a group of specific actions. Taken collectively, they allow anorganization to create a capability. An example practice would be: “Control

According to the U.S.
Department of Defense, “TheCMMC is intended to serve asa verification mechanism toensure appropriate levels ofcybersecurity practices andprocesses are in place to ensure
basic cyber hygiene as well asprotect controlled unclassified
information (CUI) that resides
on the Department’s industry
partners’ networks.1”
Fortra's Tripwire® Enterprisegives you out-of-the-box
compliance testing for the mostdemanding portions of CMMC
(Levels 3–5).

posted or processed on publicly accessible information systems.” This is one of
the 24 practices that make up the access control capability.

Who Must Comply and What Will it Cost?

Bid solicitations will indicate whether a contract requires compliance withCMMC. As the CMMC Audit Bureau (the body responsible for certifyingauditors) ramps up the auditing infrastructure, the number of contracts
subject to CMMC will increase. By 2026, all new contracts are expected toinclude CMMC compliance2.
While a bidder and its subcontractors will be required to demonstrate complianceprior to the bid being awarded, bidders will not be required to be compliant inorder to make a bid. The winning bidder will be able to expense certain costs ofcompliance to help mitigate the impact of CMMC on small suppliers.

Fortra.com

Page 1Fortra Solution Brief

Fortra's Tripwire® Enterprise offers out-of-the-box support for

CMMC Compliance with Tripwire

many of the CMMC requirements for Level 3–5 compliance.

The 17 Domains of the CMMC

The data it generates can be used to demonstrate1.

compliance to meet auditors’ requirements.

CMMC Levels

CMMC is designed to scale based on the sensitivity of thedata that is handled by a contractor. As the data becomes
more sensitive, the number and difficulty of practices
required increases. Because of this, CMMC is organized
into five levels. For example, at Level 1, a contractor is only
required to comply with 17 practices, whereas a Level 5contractor must comply with 171 practices (the 15 practicesof Level 5, plus all of the lower level practices).
Also, the level of cybersecurity maturity attained bycontractors must increase with the sensitivity of the data
handled. At Level 1, contractors must demonstrate that they
have changed the default passwords on wireless accesspoints, but they don’t have to have written policies orAccess Control (AC)

2. Access Management (AM)
3. Awareness and Training (AT)
4. Audit and Accountability (AU)5. Configuration Management (CM)
6. Identification and Authentication (IA)7. Incident Response (IR)8. Maintenance (MA)9. Media Protection (MP)10. Personnel Security (PS)
11. Physical Protection (PE)
12. Recovery (RE)
13. Risk Management (RM)
14. Security Assessment (CA)15. Situational Awareness (SA)16. Systems and Communications Protection (SC)17. Systems and Information Integrity (SI)controls that monitor the access points’ passwords.
As the CMMC level increases, contractors are expected
to operationalize processes. At the highest CMMC levels,PROCESSES

contractors are expected to actively tune their cybersecurity
tools and processes to respond to a changing threatlandscape. The image below depicts this expectation ofincreasing maturity.

Tripwire Enterprise in aCMMC Deployment

Tripwire Enterprise’s role in CMMC is to monitor the network
for compliance to CMMC requirements and to provide theevidence that auditors can use to confirm compliance.
Specifically, it inspects devices on the network and verifies
that practices have been implemented and are being

PRACTICES

Level 1: Optimizing

Advance/Progressive

Level 2: Reviewed

Proactive

Level 3: Managed

Good Cyber Hygiene

Level 4: Documented

Intermediate Cyber Hygiene

Level 5: Performed

Basic Cyber Hygiene

CMMC model with five levels to measure cybersecurity maturity

properly maintained.

The Reporting Challenge

Tripwire Enterprise eliminates the reporting challenge ofCMMC by creating reports that demonstrate compliance
to auditors. For example, if network device passwords aresupposed to be changed every three months, Tripwire
regularly scans them and reports if their passwords wereindeed changed appropriately. If a password has not beenchanged according to policy, the variance is flagged in thePowerful Integrations

Tripwire Enterprise integrates with the following:• Systems of record, such as ServiceNow, Cherwell, Jiraand Remedy• Tripwire Event Sender, for exporting rich change data toSIEMs like QRadar and Splunk• Governance, Risk and Compliance (GRC) frameworks

report. A waiver or explanation is then required to explain
why the policy was not followed.
Fortra.com

Page 2Fortra Solution Brief

CMMC Compliance with Tripwire

These capabilities are critical for every contractor seeking• GRC tools are often used to consolidate and reportcertification for a number of reasons:on cybersecurity data like that provided by Tripwire
Enterprise. Integration shortens the time-to-value• Planned changes are often documented in a systemprovided by the GRC.

of record. But proving that only the expected changes
occurred is difficult without a tool like Tripwire Enterprise,
which confirms expected changes and reports on
unexpected ones.

the core value of file integrity monitoring (FIM) combined

operations center (SOC) as the single pane of glass
representing potential security incidents. Tripwire’schange data and security data often play a role inidentifying and mitigating security incidents.

No Processes• Select processes
are documented
where required

establishing a secure baseline configuration for your systemand tracking all changes against that baseline. That’s• Organizations often use a SIEM in their security

LEVEL 1PERFORMED

One of Tripwire Enterprise’s most fundamental capabilities iswith security configuration management (SCM). Tripwire
Enterprise ensures the integrity of your files and systems andkeeps a record of all changes. It then produces audit-readyreports to make proof of compliance easier.

LEVEL 3
MANAGEDLEVEL 2
DOCUMENTED

Three Processes

Two Processes• Each practiceis documented,including Level 1practices• A policy existsthat includes all
activities• Each practiceis documented,including lowerlevels• A policy exists thatcovers all activities• A plan exists,
is maintained,
and resourcedthat includes all
activities*

LEVEL 4
REVIEWED
Four Processes• Each practiceis documented,
including lower
levels• A policy exists thatcovers all activities• A plan existsthat includes allactivities• Activities arereviewed andmeasured foreffectiveness(results of thereview is sharedwith higher-level*Planning activities may include mission, goals, project plan, resoucing,management)
training needed, and involvement of relevant stakeholders

LEVEL 5OPTIMIZINGFive Processes• Each practiceis documented,including lowerlevels• A policy exists thatcovers all activities• A plan existsthat includes allactivities• Activities arereviewed andmeasured foreffectiveness• There is astandardized,
documented
approach acrossall applicableorganizational units

CMMC maturity process progression

SOURCES

1 https://www.acq.osd.mil/cmmc/faq.html
2 https://www.defense.gov/Explore/News/Article/Article/2071434/
dod-to-require-cybersecurity-certification-in-some-contract-bids/
3 https://www.acq.osd.mil/cmmc/docs/CMMC_v1.0_Public_Briefing_20200131_v2.pdf

About Fortra
Fortra is a cybersecurity company like no other. We’re creating a simpler, stronger future for ourcustomers. Our trusted experts and portfolio of integrated, scalable solutions bring balance andFortra.com

control to organizations around the world. We’re the positive changemakers and your relentless ally toprovide peace of mind through every step of your cybersecurity journey. Learn more at fortra.com.

© Fortra, LLC and its group of companies. All trademarks and registered trademarks are the property of their respective owners.

(fta-tw-sb-0123-r1-hm)