While observing the CMMC framework, coupled with our overarching goals and ideas, I found a lot of the goals I set for myself coming to fruition. My desire to obtain the necessary skills to develop and implement policies began to become noticed as I found myself comfortable with picking apart the framework and theorizing possible solutions to achieve compliance. For example, I recognized HR as the leading authority within Access Control, something I would not have initially resulted in prior to my time with LightGrid. Our time with CMMC is still in its infant stages, however, we have a clear goal in mind with achieving compliance.
Our approach to CMMC implementation continues to involve the dissecting of already in place policies at LightGrid, coupled with our desire to implement new policies to ensure CMMC compliance. In doing so, our process involved largely the understanding of these policies, including what they are positively doing for LightGrid as well as the negative aspects of the previously implemented policies. Limitations presented from failing policies or simply policies that never were fully implemented need to be augmented to the point of success while also drafting new policies to cover new mandated techniques. The differing factor between simply re-analyzing existing policies versus documenting new policy development remained that the complexity of the policies were formed not by the controls in place but by the pre-determined gates laid out by the required guidelines. For this reason, we have found difficulty in adapting and are currently in a period of theorizing possible solutions to future problems.
While future problems remain a core focus, the CMMC team also relies heavily on feedback between one another, further strengthening individual confidence as well as the strength of policies we are developing. A newly designed peer review system is in place to oversee each other’s work as a way to organize meeting discussion and further advancement of ideas and strategies. To further advance our implementation of CMMC, the peer review system has also been altered to adapt to the Media Disposal category. This adaptation incorporates a peer review system in order to analyze documentation for any accidental CUI information. In reflecting on my time as a member of the CMMC team, I fully can say with certainty that my communication with a team-based setting has grown to a point initially unforeseen. Everything from how I communicate my ideas to how I present new strategies or advice to presented ideas from other team members is an exhilarating discovery, as I have now a newly discovered self-goal of further advancing myself in a field I was initially unaware of.