Alright, folks, let’s talk about IT documentation. I know what you’re thinking – it’s not the most thrilling topic on the planet. But, when it comes to gearing up for a CMMC Pre-Assessment, it’s a crucial piece of the puzzle. And trust me, it’s not as challenging as you might think.

Why does it Matter?

You see, the assessment process involves examining documents, interviewing people, and evidence of their use, and testing systems. So, the first thing you need to do is to get your IT documentation in order. Quality and consistency are the name of the game here, ensuring that your organization follows uniform processes and procedures, which ultimately lead to better outcomes and demonstrate your commitment to cybersecurity.

Getting Started

As you embark on this journey towards a certification assessment with a C3PAO, the first step is to look in the mirror with an internal gap assessment or pre-assessment. Most companies hire third party expertise, so that they know what they are looking for and what will or will not be likely to pass when it is a C3PAO that is doing the looking.

Keep in mind that your primary goal is to make a list of what you have and organize it in one place. This simple task will make it a breeze for you to spot any gaps and address them in your documentation.

To kick things off, follow these steps:

1. Ask everyone in the organization to send you any IT documentation they have. This includes plans, policies, procedures, and any supporting documents like lists, diagrams, and logs.
2. As you collect these documents, separate them into two groups: working documents (plans, policies, and procedures), and reference documents (lists, diagrams, logs). Then categorize them. Policies all together. Procedures all together, etc., etc. This will help you better understand the structure and content of your organization’s documentation.
3. Be sure to ask your colleagues to let you know who is in charge of each document. This information will be invaluable for creating a RACI (Responsible, Accountable, Consulted, and Informed) matrix. It will also be used to ensure that the assessor team, as well as your organization’s management team, know who to go to with questions.

In a nutshell, organizing your IT documentation for a CMMC Pre-Assessment doesn’t have to be an uphill battle. By focusing on quality and consistency and taking the time to create a comprehensive list of what you have, you’ll be well on your way to identifying any gaps and getting your organization ready for the documentation aspect of the assessment process. And hey, you might even have a little fun along the way!

June 6th, 2023