To streamline CMMC compliance and replace the existing system that wasn’t usable, Avnet searched for a dedicated CMMC management system that offered turnkey functionality.

“It had to be something that we could set up and use without a high level of effort or resources to even get it working,” she said. “We also needed to customize it for our processes in a way that was intuitive for our users that only use the tools a few times each year. They have to be able to complete their assessment processes or document reviews without having to retrain every time.”

Simplifying CMMC 2.0 Reporting for 20 Departments

After evaluating multiple products, Avnet selected the Onspring CMMC Management solution. This enables the company to monitor its status against CMMC 2.0 levels that map directly to NIST SP 800-171r2 and NIST SP 800-172 frameworks. Avnet continuously monitors its CMMC control implementation and the Onspring solution offers a simple process for the control owners to submit information within their area of responsibility.

“We have had a great deal of positive feedback about the Onspring tool and how easy it is to use,” VanNostrand said. “Using a questionnaire built in the CMMC module, users review their dashboard, answer questions, and have the capability to upload evidence, which comes to our GRC team to review. It provides a means to ingest all their information in a much more organized fashion. We can then evaluate the evidence against CMMC requirements to manage our overall compliance with our regulatory obligations.”

With this simple process, Onspring allows users from 20 different Avnet departments to contribute to the CMMC assessment and certification process, including:

• Platform services
• IT systems administration
• Sales
• HR
• Physical security
• Vendor risk management
• Identity services

Resolving Unmet CMMC 2.0 Objectives

Once staff from these functional areas have answered questions and uploaded evidence, Onspring collates this and displays which objectives have been partially or fully met or unmet. For the latter, Onspring initiates a POA&M process to identify what needs to be adjusted, who’s responsible for it, and enables tracking of remediation efforts to close any gaps. The system uses Department of Defense (DoD) methodology to automatically calculate an updated SPRS (Supplier Performance Risk System) score each time a new objective or control standard is met.

“Onspring consolidates our information into one dashboard that we can reference to see where a CMMC practice is missing information or how we need to improve a process,” VanNostrand said. “It gives us one central command space where we can visualize all of our CMMC requirements and evaluate our compliance. The Onspring CMMC module improves our efficiency as we go through our processes.”