Going from CMMC Level 2 to ISO 27001? Mapping the Controls is Easy; Swapping Mindsets Is Hard.

Going from CMMC Level 2 to ISO 27001? Mapping the Controls is Easy; Swapping Mindsets Is Hard.

If your company is working toward CMMC Level 2, you may have heard some version of this advice: As long as you’re implementing NIST SP 800-171, you might as well get ISO 27001 too. The standards cover much of the same ground, the argument goes, so ISO certification should be a piece of cake after CMMC.

It’s an appealing idea, and it’s partly true. For a defense contractor, ISO 27001 can open doors that CMMC can’t. Commercial aerospace customers and other buyers outside the DoD often ask for it during vendor due diligence, and allied and international partners treat it (not CMMC) as the recognized baseline. Plus, the technical controls in the two standards really do overlap substantially, so much of the security work you do for CMMC will count toward ISO 27001 as well.

That said, CMMC and ISO 27001 have fundamentally different goals and underlying assumptions, and it’s critical to understand those differences if you’re considering both certifications. A company that approaches ISO with a CMMC mindset can have every control implemented and still struggle in the audit.

We think there’s value in understanding exactly how the frameworks compare so organizations can make an informed decision about whether to pursue certification. Today, we walk through the overlap in technical controls and the four key mindset shifts that CMMC-focused teams need in order to pursue ISO 27001 successfully.

Where CMMC and ISO 27001 line up

The first piece of good news: NIST SP 800-171 and ISO 27001 Annex A cover much of the same territory. Both standards expect you to control how you access your systems, manage your configurations, protect your physical spaces, monitor for threats, and respond to incidents. As such, a company that implements the technical controls for CMMC will find that a large share of them carry over to ISO 27001 with little or no rework.

You also don’t have to work out exactly where that overlap falls on your own. NIST includes a mapping in Appendix D of SP 800-171 Rev 2, pairing each of the 110 requirements with their related controls in ISO/IEC 27001:2013 Annex A. That mapping will change format once CMMC adopts NIST SP 800-171 Rev 3, which drops the mapping tables and instead uses NIST’s online Cybersecurity and Privacy Reference Tool to translate the controls. Either way, though, the industry has done the heavy lifting here.

Where mapping doesn’t exist is the deeper principles, purposes, and structures behind the two standards. Without further ado, here are the key differences in timelines, scopes, and control approaches between CMMC and ISO 27001.

Mindset Shift 1: From a single assessment to an ongoing audit cycle

A CMMC Level 2 certification is built around one big event: A C3PAO assesses your environment against all 110 requirements at a single point in time, and each requirement is either met or not met based on the evidence you provide. Once you pass, your certification is valid for three years, with an annual affirmation that you’re still meeting the requirements.

ISO 27001 certification works differently from the start. The initial audit happens in two stages, with Stage 1 including a documentation review and detailed readiness check and Stage 2 evaluating whether your information security management system (ISMS) is implemented and working as intended. Once you’re certified, the certification body returns for surveillance audits in years two and three, followed by a full recertification audit before the three-year certificate expires.

If you’re coming from CMMC, you’re used to the major checkpoint happening once every three years, and you can finish building and documenting your program any time before the all-important assessment date. To pursue ISO 27001, you’ll have to shift to preparing for an annual audit and change your mindset around scheduling. ISO 27001 auditors need to see the ISMS in operation before Stage 2, including at least one internal audit and one management review on record, which means that your project timeline needs to account for a substantial operating period in between.

Mindset Shift 2: From just controls to controls plus a management system

CMMC and ISO 27001 share the same big-picture goal of keeping sensitive information secure, but they use different approaches to get there.

CMMC protects CUI across the defense industrial base by requiring every contractor that handles it to meet the same baseline of 110 security controls. Because the DoD has already determined which safeguards are necessary, a CMMC assessment focuses solely on whether those controls are implemented and working in your environment.

On the other hand, ISO 27001 is written for organizations of every size and industry, so it can’t prescribe a single baseline. Instead, it requires each organization to build a successful ISMS, a.k.a. a set of recurring business processes for running its security program. Those processes define which leaders are accountable, how risks are assessed and treated, what security objectives the organization is working toward, how performance is checked through internal audits, and how problems get corrected. All of this is in addition to the Annex A technical controls, which serve as a reference for the rest of the standard.

For CMMC-trained teams, that means your mission must shift from demonstrating that you’ve implemented your controls to demonstrating that your organization has a reliable way to decide, measure, and improve its own security.

Mindset Shift 3: From 110 controls to… whichever controls apply

Under CMMC Level 2, the list of requirements is set in stone. All 110 requirements in NIST SP 800-171 apply to your environment, and your job is to implement each one and provide supporting evidence. (There’s an exception for N/A controls when something doesn’t exist in your environment, such as wireless access controls in a facility with no wireless network, but you still have to justify that call to your assessor.)

With ISO 27001, Annex A lists 93 controls, but it isn’t a strict list of requirements. Instead, it’s a reference for the program you decide to implement. Ultimately, your risk assessment will identify the actual security issues your organization faces, your risk treatment plan will determine which controls you need to address them, and your Statement of Applicability (SoA) will document which Annex A controls you’ve chosen to implement and why.

CMMC-focused teams are used to treating every requirement as mandatory, so the natural instinct when moving to ISO 27001 might be to mark all 93 controls as applicable. But an SoA that includes everything is a red flag for ISO auditors, who are trained to trace each control back to the risk or requirement that justifies it. If the SoA and the risk assessment don’t line up, it suggests that the ISMS isn’t functioning like the carefully considered risk management system it’s supposed to be.

Bottom line? If you’re coming from CMMC, aim for a SoA that traces every included control back to a specific risk, legal requirement, or contractual obligation, and offers sound reasoning for every excluded control it leaves out.

Mindset Shift 4: From scoping around CUI to scoping around the business

In CMMC, your scope is the people, systems, and facilities that process, store, or transmit controlled unclassified information (CUI). Many defense contractors build enclaves for this reason, since drawing a tight boundary around CUI shrinks their scope and makes compliance more manageable.

In ISO 27001, your scope is determined not by your CUI data but by your organization’s priorities. Based on your business context and the expectations of your customers, regulators, and/or partners, your organization will define which business units, locations, processes, and systems your ISMS covers. Whatever scope you choose will appear on your certificate once you’ve passed your audit, so anyone evaluating your company will be able to see exactly what’s covered.

For CMMC teams, making your ISMS scope the same as your enclave boundary can backfire specifically because of that visibility. When a commercial aerospace customer or international partner reviews the scope on your statement and sees that it only covers a single enclave, your credibility may be undermined.

The necessary shift, then, is to go from asking “How small can we make our scope?” to “What do our customers and partners need this certificate to cover?” A narrower scope is easier to certify, but the right scope for ISO 27001 is the one that supports the reason you pursued certification in the first place.

Making the shift from CMMC to ISO 27001

The good news: If you’ve done the work for CMMC Level 2, you’re not starting over with ISO 27001. Your implemented controls, SSP, policies, and evidence give you a substantial head start, and your experience with a challenging assessment will prepare you for regular ISO audits.

That said, it’s important to treat your CMMC program as a library of assets to draw from as you build your ISMS, rather than a finished product that just needs some new labels. You’ll want to trace all the relevant CMMC controls to your ISO risk assessment, make sure your policies reflect your ISMS scope, and update your evidence to show your management system operating over time.

It’s also important to plan a realistic timeline. Since many of your controls will already be in place from your CMMC assessment, you’ll want to focus primarily on building the management system around them and giving it time to operate before your Stage 2 audit.