https:\/\/www.hsdl.org\/?view&did=808776<\/a><\/p>\n\n\n\nTherefore, the DoD put measures in place so that government contractors possess the means to responsibly safeguard any data sourced from DIB servers and databases.<\/p>\n\n\n\n
Before CMMC, government contractors had to show cyber compliance through a self-assessment with NIST SP 800-171. With CMMC, the DoD took control of the parameters, expectations, and qualifications needed to comply with CMMC standards. If you want your organization to achieve CMMC compliance, you will likely have to make significant modifications to your cybersecurity policies, security plans, risk management, and more to achieve CMMC.<\/p>\n\n\n\n
CMMC vs. NIST 800-171<\/h2>\n\n\n\n CMMC and NIST SP 800-171 are very similar mainly because CMMC was built based on the NIST framework. Both frameworks aim to protect controlled unclassified information and require good cybersecurity hygiene. Let\u2019s take a closer look at why they are different and why you still need to address CMMC even if you are NIST compliant.<\/p>\n\n\n\nCriteria<\/strong><\/td>CMMC<\/strong><\/td>NIST<\/strong><\/td><\/tr>Scope<\/td> Assesses the maturity of a company\u2019s cybersecurity processes and practices<\/td> Assesses the cybersecurity controls of a company<\/td><\/tr> Compliance<\/td> Five levels of compliance<\/td> One level of compliance<\/td><\/tr> Certification<\/td> Requires a third-party audit to certify your organization<\/td> Works with self-attestation – no third-party audit required<\/td><\/tr> Security Domains<\/td> Covers 17 domains<\/td> Covers 14 domains<\/td><\/tr> Obligation<\/td> Contractors are contractually required to comply<\/td> Based on recommended security practices<\/td><\/tr> Purpose<\/td> Aims to reduce the risk in DoD supply chain<\/td> Adopts cybersecurity best practices<\/td><\/tr><\/tbody><\/table>Comparison of CMMC and NIST 800-171<\/figcaption><\/figure>\n\n\n\nSince every organization that deals with DoD must be CMMC certified by a third-party auditor, simply being NIST 800-171 compliant is not sufficient. However, NIST 800-171 is the foundation to earn your CMMC certification and hence that\u2019s the first step to get CMMC certified. <\/p>\n\n\n\n
Determine your Level of Compliance<\/h2>\n\n\n\n The CMMC introduced a sophisticated hierarchy of certification levels, determining which qualified DoD-identified contractors have access to what type of Controlled Unclassified Information or Federal Contract Information (FCI). With each level, numbered 1 through 5, the contractor in question must prove their ability to handle all associated practices and processes required by each level, as well as having a full assessment of the company\u2019s maturity processes.<\/p>\n\n\n\n
The expectations of performance for each level of compliance are as follows:<\/p>\n\n\n\n
\nLevel 1 \u2013 Basic Cyber Hygiene<\/strong>: CMMC Level 1 is the most basic of standards regarding compliance. Your company has proven to exercise base safeguards, but is not expected to be responsible for CUI or FCI. Contractors at this level must demonstrate the basic controls of the NIST 800-171.<\/li>\n\n\n\nLevel 2 \u2013 Intermediate Cyber Hygiene:<\/strong> The next level up includes companies who have demonstrated a greater degree of cybersecurity protections within their organization. To pass this level, the audit must conclude that your company implements an increased level of security controls, including new ones required by CMMC. Process maturity includes standard operating procedures, policies, and plans.<\/li>\n\n\n\nLevel 3 \u2013 Good Cyber Hygiene: <\/strong>The NIST 800-171 previously ensured all companies would qualify for this level of compliance. Your company demonstrates an acceptable capability of cybersecurity protections, elevating your process maturity and ensuring you implement a greater number of controls.<\/li>\n\n\n\nLevel 4 \u2013 Proactive Cybersecurity: <\/strong>Everything from here on out goes beyond what NIST 800-171 would qualify you for alone. This level demonstrates a proactive, powerful cybersecurity program that encompasses the majority of controls from both NIST 800-171 and CMMC, plus a dedicated process maturity level showing that all activities are reviewed and relegated to management based on effectiveness.<\/li>\n\n\n\nLevel 5 \u2013 Advanced Proactive Cybersecurity:<\/strong> Only the most well-established contractors can achieve this level of CMMC compliance. Your company must prove that you can repel advanced cyberattacks, as well as actively improve your infrastructure processes and policies. With Domain Technology Group\u2019s assistance, you\u2019ll be able to achieve your desired compliance level. If you\u2019re interested in a partnership, visit our contact page so we can get started.<\/li>\n<\/ul>\n\n\n\nYou will not be allowed to self-certify and you must be audited by a third-party assessment organization (C3PAO), or an accredited individual assessor to achieve compliance. The C3PAO or independent assessor will evaluate your company\u2019s security environment to determine if the CMMC requirements have been met for that specific level.<\/p>\n\n\n\n
CMMC by Domain<\/h2>\n\n\n\n The CMMC model consists of 17 different domains of which some are also relevant for SAP systems. CMMC has three additional domains on top of NIST 800 171 which are Asset Management (AM), Recovery (RE), and Situational Awareness (SA). The below list provides an overview of the 17 domains with its 43 capabilities:<\/p>\n\n\n\n
\nAccess Control (AC)\n\nEstablish system access requirements<\/li>\n\n\n\n Control internal system access<\/li>\n\n\n\n Control remote system access<\/li>\n\n\n\n Limit data access to authorized users and processes<\/li>\n<\/ul>\n<\/li>\n\n\n\n Asset Management (AM)\n\nIdentify and document assets<\/li>\n\n\n\n Manage asset inventory<\/li>\n<\/ul>\n<\/li>\n\n\n\n Audit and Accountability (AU)\n\nDefine audit requirements<\/li>\n\n\n\n Perform auditing<\/li>\n\n\n\n Identify and protect audit information<\/li>\n\n\n\n Review and manage audit logs<\/li>\n<\/ul>\n<\/li>\n\n\n\n Awareness and Training (AT)\n\nConduct security awareness activities<\/li>\n\n\n\n Conduct training<\/li>\n<\/ul>\n<\/li>\n\n\n\n Configuration Management (CM)\n\nEstablish configuration baselines<\/li>\n\n\n\n Perform configuration and change management<\/li>\n<\/ul>\n<\/li>\n\n\n\n Identification and Authentication (IA)\n\nGrant access to authenticated entities<\/li>\n<\/ul>\n<\/li>\n\n\n\n Incident Response (IR)\n\nPlan incident response<\/li>\n\n\n\n Detect and report events<\/li>\n\n\n\n Develop and implement a response to a declared incident<\/li>\n\n\n\n Perform post incident reviews<\/li>\n\n\n\n Test incident response<\/li>\n<\/ul>\n<\/li>\n\n\n\n Maintenance (MA)\n\nManage maintenance<\/li>\n<\/ul>\n<\/li>\n\n\n\n Media Protection (MP)\n\nIdentify and mark media<\/li>\n\n\n\n Protect and control media<\/li>\n\n\n\n Sanitize media<\/li>\n\n\n\n Protect media during transport<\/li>\n<\/ul>\n<\/li>\n\n\n\n Personnel Security (PS)\n\nScreen personnel<\/li>\n\n\n\n Protect CUI during personnel actions<\/li>\n<\/ul>\n<\/li>\n\n\n\n Physical Protection (PE)\n\nLimit physical access<\/li>\n<\/ul>\n<\/li>\n\n\n\n Recovery (RE)\n\nManage backups<\/li>\n\n\n\n Manage information security continuity<\/li>\n<\/ul>\n<\/li>\n\n\n\n Risk Management (RM)\n\nIdentify and evaluate risk<\/li>\n\n\n\n Manage risk<\/li>\n\n\n\n Manage supply chain risk<\/li>\n<\/ul>\n<\/li>\n\n\n\n Security Assessment (CA)\n\nDevelop and manage a system security plan<\/li>\n\n\n\n Define and manage controls<\/li>\n\n\n\n Perform code reviews<\/li>\n<\/ul>\n<\/li>\n\n\n\n Situational Awareness (SA)\n\nImplement threat monitoring<\/li>\n<\/ul>\n<\/li>\n\n\n\n System and Communications Protection (SC)\n\nDefine security requirements for systems and communications<\/li>\n\n\n\n Control communications at system boundaries<\/li>\n<\/ul>\n<\/li>\n\n\n\n System and Information Integrity (SI)\n\nIdentify and manage information system flaws<\/li>\n\n\n\n Identify malicious content<\/li>\n\n\n\n Perform network and system monitoring<\/li>\n\n\n\n Implement advanced email protections<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\nNot all domains and capabilities are directly affecting your SAP systems. However, several of them, for example, Access Controls and Configuration Management, are key topics when it comes to protecting your SAP systems. Access Controls includes topics like segregation of duties (SoD), monitoring SAP security configuration, elevated access management for administrative users, and many more.<\/p>\n\n\n\n
CMMC Compliance with Xiting\u2019s Security Solutions<\/h2>\n\n\n\n As a DoD contractor or an organization that wants to become one, it\u2019s important to understand what are the steps to CMMC compliance. Xiting\u2019s security solutions and security services allow you to achieve this more efficiently with automation tools. One of the first steps is to assess your information security processes in SAP and beyond. Let\u2019s take a closer look at what needs to be done.<\/p>\n\n\n\n
\nConduct readiness assessments & gap analysis of existing systems.\n\nIdentify where controlled unclassified information is stored and processed<\/li>\n\n\n\n Identify the level of compliance your organization requires.<\/li>\n\n\n\n Assess current operations and controls for compliance to:\n\nDFARS and NIST 171 controls review<\/li>\n\n\n\n CMMC 20 Additional controls (for Level 3)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n Create \/ update System Security Plan (SSP)\n\nDocument system boundaries and connections<\/li>\n\n\n\n Document how security requirements are implemented<\/li>\n<\/ul>\n<\/li>\n\n\n\n Create remediation plan (plans of action & milestones)\n\nDocument known deficiencies<\/li>\n<\/ul>\n<\/li>\n\n\n\n Implement required controls<\/li>\n\n\n\n Document and implement a plan to maintain compliance<\/li>\n\n\n\n Ongoing cybersecurity monitoring & reporting<\/li>\n<\/ol>\n\n\n\nXiting’s security solutions allow you to centrally analyze your SAP systems to understand where data is stored and processed. With its built-in central security monitoring, you cannot only document your security concept but also continuously monitor your entire landscape – on-premise and in the cloud. Xiting provides ready-to-use security concepts for ABAP systems, Java, SAP HANA, Solution Manager, SAP HCM as well as SAP Access Control (GRC). These ready-to-use concepts are dynamic documents that work with your system configuration and read your system configuration (centrally as well as decentralized) for all your connected systems. This allows you to define security requirements that you can continuously monitor. <\/p>\n\n\n\nWith the integration into your Security Information and Event Management (SIEM) systems (e.g. Splunk, ArcSight, IBM QRadar, Microsoft Azure Sentinel, etc.), you can achieve real-time monitoring. If you don\u2019t have a SIEM system, but you want to use real-time notifications, Xiting offers an Email Adapter that can send security notifications via email (and also text messages) to your stakeholders. <\/p>\n\n\n\nXiting delivers a CMMC concept that allows you to analyze our entire SAP system landscape. For example, AC 2.009 – limit unsuccessful logon attempts, is one of the capabilities in the Access Controls domain. In the below figure, you can see the concept along with the assessment in your system (in this example, it was a local check for one system). The concept documents how the capability is achieved and supports the effectiveness of the implementation through configuration checks.<\/p>\n\n\n\nExample of CMMC check for AC.2.009<\/figcaption><\/figure>\n\n\n\nDetailed Analysis of System Configuration<\/figcaption><\/figure>\n\n\n\nXiting Security Architect comes with over 100 different checks that are fully customizable and extensible to tackle your specific needs. You can run all these checks locally, or centrally against your entire landscape. The checks also consider system types so that certain checks are critical in production environments but non-critical in a development system.<\/p>\n\n\n\n
With the Security Architect, you can analyze your landscape ad-hoc, or schedule recurring checks. With the integration to your SIEM system or a simple email adapter, you can monitor your CMMC compliance in real-time and be actively informed if, for example, configuration changes.<\/p>\n\n\n\n
FAQs<\/h2>\n\n\n\nWhat is the CMMC Accreditation Body (CMMC-AB)?<\/strong><\/strong> The CMMC-AB (https:\/\/www.cmmcab.org\/) is an independent organization that will authorize and accredit CMMC Third Party Assessment Organizations (C3PAOs) and the CMMC Assessors and Instructors Certification Organization (CAICO) in accordance with DoD requirements.\u00a0<\/p> <\/div>
What\u2019s the difference between CMMC and NIST SP 800-171?<\/strong><\/strong> Unlike NIST SP 800-171, the CMMC model possesses five levels. The CMMC model is cumulative whereby each level consists of practices and processes as well as those specified in the lower levels. The CMMC model includes additional cybersecurity practices in addition to the security requirements specified in NIST SP 800-171.<\/p> <\/div>
Is CMMC the same as ISO standards?<\/strong><\/strong> CMMC will combine elements of various cybersecurity control and security standards such as NIST SP 800-171, NIST SP 800-53, ISO 27001, ISO 27032, AIA NAS9933, and others, into one unified standard for CUI cybersecurity.<\/p> <\/div>
Does CMMC also affect small businesses?<\/strong><\/strong> CMMC does not consider the size of an organization and it\u2019s applicable for small businesses to the largest global enterprises. The goal of CMMC is to be a cost-effective and affordable certification that can also be achieved by small businesses.<\/p> <\/div>
What is FedRAMP?<\/strong><\/strong> The Federal Risk and Authorization Management Program (FedRAMP) provides a standardized approach to security authorizations for Cloud Service Offerings.\u00a0<\/p> <\/div>
What is DFARS?<\/strong><\/strong> To bid on contracts in the past, companies in the defense industrial base (DIB) could self-certify their compliance with Defense Federal Acquisition Regulations (DFARS). Going forward, DFARS will not be sufficient to win DoD RFPs.<\/p> <\/div>
What are the RFP requirements to win a DoD bid?<\/strong><\/strong> All contractors will need to be CMMC-certified at the level specified in the RFP to win, participate in, or even bid on a contract. If you don\u2019t have the minimum CMMC level requests, your participation in the RFP will be rejected automatically.<\/p> <\/div> <\/div>\n\n\n\n
Wrap Up<\/h2>\n\n\n\n The CMMC certification is a challenging undertaking for organizations as it requires them to analyze the entire IT landscape, including their SAP systems. It has been estimated that 77% of all global business transactions come into contact with an SAP system at one time or another and therefore play an important role to achieve CMMC compliance. Xiting’s security solutions allow customers to analyze their SAP landscape and provide real-time documentation in the context of CMMC. With the integration to SIEM or the use of email alerts, you can safeguard your CMMC compliance in real-time and be proactively informed when changes impact your overall compliance.<\/p>\n","protected":false},"excerpt":{"rendered":"
CMMC stands for Cybersecurity Maturity Model Certification and is a verification mechanism of the Department of Defense (DoD) of the United States. The DoD uses CMMC to determine whether its vendors and contractors possess the resources, infrastructure, and preventative skills needed to work with Controlled Unclassified Information (CUI). CMMC provides increased assurance to the DoD […]<\/p>\n","protected":false},"author":7,"featured_media":16251,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"content-type":"","footnotes":""},"categories":[1835],"tags":[1449],"class_list":["post-16228","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-cmmc"],"acf":[],"yoast_head":"\n
CMMC Compliance in SAP | Xiting<\/title>\n<meta name=\"robots\" content=\"noindex, nofollow\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CMMC Compliance in SAP\" \/>\n<meta property=\"og:description\" content=\"CMMC stands for Cybersecurity Maturity Model Certification and is a verification mechanism of the Department of Defense (DoD) of the United States. The\" \/>\n<meta property=\"og:url\" content=\"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/\" \/>\n<meta property=\"og:site_name\" content=\"Xiting\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/XitingAG\" \/>\n<meta property=\"article:published_time\" content=\"2021-08-24T20:19:25+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-10-01T08:46:26+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/xiting.com\/wp-content\/uploads\/2021\/08\/cmmc_compliance.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"628\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Alessandro Banzer\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Alessandro Banzer\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"11 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/\"},\"author\":{\"name\":\"Alessandro Banzer\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/#\\\/schema\\\/person\\\/9f4b7239bdd4d109e5a45c9432779d5e\"},\"headline\":\"CMMC Compliance in SAP\",\"datePublished\":\"2021-08-24T20:19:25+00:00\",\"dateModified\":\"2025-10-01T08:46:26+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/\"},\"wordCount\":2241,\"publisher\":{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/xiting.com\\\/wp-content\\\/uploads\\\/2021\\\/08\\\/cmmc_compliance.png\",\"keywords\":[\"CMMC\"],\"articleSection\":[\"SAP Security\"],\"inLanguage\":\"en-US\"},{\"@type\":[\"WebPage\",\"FAQPage\"],\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/\",\"url\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/\",\"name\":\"CMMC Compliance in SAP | Xiting\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/xiting.com\\\/wp-content\\\/uploads\\\/2021\\\/08\\\/cmmc_compliance.png\",\"datePublished\":\"2021-08-24T20:19:25+00:00\",\"dateModified\":\"2025-10-01T08:46:26+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#breadcrumb\"},\"mainEntity\":[{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#faq-question-1629834323661\"},{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#faq-question-1629834334588\"},{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#faq-question-1629834353747\"},{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#faq-question-1629834365039\"},{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#faq-question-1629834373888\"},{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#faq-question-1629834387555\"},{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#faq-question-1629834406166\"}],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#primaryimage\",\"url\":\"https:\\\/\\\/xiting.com\\\/wp-content\\\/uploads\\\/2021\\\/08\\\/cmmc_compliance.png\",\"contentUrl\":\"https:\\\/\\\/xiting.com\\\/wp-content\\\/uploads\\\/2021\\\/08\\\/cmmc_compliance.png\",\"width\":1200,\"height\":628},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/xiting.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CMMC Compliance in SAP\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/xiting.com\\\/en\\\/\",\"name\":\"Xiting\",\"description\":\"Your Expert for SAP Security\",\"publisher\":{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/xiting.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/#organization\",\"name\":\"Xiting\",\"url\":\"https:\\\/\\\/xiting.com\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/xiting.com\\\/wp-content\\\/uploads\\\/2025\\\/08\\\/xiting-logo.png\",\"contentUrl\":\"https:\\\/\\\/xiting.com\\\/wp-content\\\/uploads\\\/2025\\\/08\\\/xiting-logo.png\",\"width\":960,\"height\":504,\"caption\":\"Xiting\"},\"image\":{\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/XitingAG\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/1345129\\\/\",\"https:\\\/\\\/www.instagram.com\\\/xiting.global\\\/\",\"https:\\\/\\\/www.crunchbase.com\\\/organization\\\/xiting\",\"https:\\\/\\\/www.youtube.com\\\/@Xiting\"],\"description\":\"Xiting wurde 2008 von erfahrenen SAP-Beratern in der Schweiz gegr\u00fcndet. Heute besch\u00e4ftigt das Unternehmen 140 Mitarbeitende an mehreren Standorten weltweit. Die SAP Security Consultants von Xiting bringen tiefes Fachwissen aus der Projektpraxis mit und betreuen \u00fcber 700 nationale und internationale Kunden \u2013 remote und vor Ort.\",\"email\":\"info@xiting.ch\",\"telephone\":\"+41 43422 8803\",\"legalName\":\"Xiting AG\",\"foundingDate\":\"2008-06-01\",\"numberOfEmployees\":{\"@type\":\"QuantitativeValue\",\"minValue\":\"51\",\"maxValue\":\"200\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/#\\\/schema\\\/person\\\/9f4b7239bdd4d109e5a45c9432779d5e\",\"name\":\"Alessandro Banzer\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/bd69cf75d8008518f801684fb686af7daad3e988b323551989d44fb47d82a240?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/bd69cf75d8008518f801684fb686af7daad3e988b323551989d44fb47d82a240?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/bd69cf75d8008518f801684fb686af7daad3e988b323551989d44fb47d82a240?s=96&d=mm&r=g\",\"caption\":\"Alessandro Banzer\"},\"description\":\"Alessandro has worked in the field of IT since 2004, specializing in SAP in 2009 and working on global SAP projects in various roles since that date. Alessandro is an active contributor and moderator in the Governance, Risk, and Compliance space on SAP SCN. Alessandro is in charge of Xiting's operations in the United States and a subject matter expert in SAP Access Control, SAP Cloud IAG, and SAP Security.\",\"url\":\"https:\\\/\\\/xiting.com\\\/en\\\/author\\\/admin\\\/\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#faq-question-1629834323661\",\"position\":1,\"url\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#faq-question-1629834323661\",\"name\":\"What is the CMMC Accreditation Body (CMMC-AB)?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"The CMMC-AB (https:\\\/\\\/www.cmmcab.org\\\/) is an independent organization that will authorize and accredit CMMC Third Party Assessment Organizations (C3PAOs) and the CMMC Assessors and Instructors Certification Organization (CAICO) in accordance with DoD requirements.\u00a0\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#faq-question-1629834334588\",\"position\":2,\"url\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#faq-question-1629834334588\",\"name\":\"What\u2019s the difference between CMMC and NIST SP 800-171?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Unlike NIST SP 800-171, the CMMC model possesses five levels. The CMMC model is cumulative whereby each level consists of practices and processes as well as those specified in the lower levels. The CMMC model includes additional cybersecurity practices in addition to the security requirements specified in NIST SP 800-171.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#faq-question-1629834353747\",\"position\":3,\"url\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#faq-question-1629834353747\",\"name\":\"Is CMMC the same as ISO standards?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"CMMC will combine elements of various cybersecurity control and security standards such as NIST SP 800-171, NIST SP 800-53, ISO 27001, ISO 27032, AIA NAS9933, and others, into one unified standard for CUI cybersecurity.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#faq-question-1629834365039\",\"position\":4,\"url\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#faq-question-1629834365039\",\"name\":\"Does CMMC also affect small businesses?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"CMMC does not consider the size of an organization and it\u2019s applicable for small businesses to the largest global enterprises. The goal of CMMC is to be a cost-effective and affordable certification that can also be achieved by small businesses.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#faq-question-1629834373888\",\"position\":5,\"url\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#faq-question-1629834373888\",\"name\":\"What is FedRAMP?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"The Federal Risk and Authorization Management Program (FedRAMP) provides a standardized approach to security authorizations for Cloud Service Offerings.\u00a0\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#faq-question-1629834387555\",\"position\":6,\"url\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#faq-question-1629834387555\",\"name\":\"What is DFARS?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"To bid on contracts in the past, companies in the defense industrial base (DIB) could self-certify their compliance with Defense Federal Acquisition Regulations (DFARS). Going forward, DFARS will not be sufficient to win DoD RFPs.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#faq-question-1629834406166\",\"position\":7,\"url\":\"https:\\\/\\\/xiting.com\\\/en\\\/cmmc-compliance-in-sap\\\/#faq-question-1629834406166\",\"name\":\"What are the RFP requirements to win a DoD bid?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"All contractors will need to be CMMC-certified at the level specified in the RFP to win, participate in, or even bid on a contract. If you don\u2019t have the minimum CMMC level requests, your participation in the RFP will be rejected automatically.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"CMMC Compliance in SAP | Xiting","robots":{"index":"noindex","follow":"nofollow"},"og_locale":"en_US","og_type":"article","og_title":"CMMC Compliance in SAP","og_description":"CMMC stands for Cybersecurity Maturity Model Certification and is a verification mechanism of the Department of Defense (DoD) of the United States. The","og_url":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/","og_site_name":"Xiting","article_publisher":"https:\/\/www.facebook.com\/XitingAG","article_published_time":"2021-08-24T20:19:25+00:00","article_modified_time":"2025-10-01T08:46:26+00:00","og_image":[{"width":1200,"height":628,"url":"https:\/\/xiting.com\/wp-content\/uploads\/2021\/08\/cmmc_compliance.png","type":"image\/png"}],"author":"Alessandro Banzer","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Alessandro Banzer","Est. reading time":"11 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#article","isPartOf":{"@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/"},"author":{"name":"Alessandro Banzer","@id":"https:\/\/xiting.com\/en\/#\/schema\/person\/9f4b7239bdd4d109e5a45c9432779d5e"},"headline":"CMMC Compliance in SAP","datePublished":"2021-08-24T20:19:25+00:00","dateModified":"2025-10-01T08:46:26+00:00","mainEntityOfPage":{"@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/"},"wordCount":2241,"publisher":{"@id":"https:\/\/xiting.com\/en\/#organization"},"image":{"@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#primaryimage"},"thumbnailUrl":"https:\/\/xiting.com\/wp-content\/uploads\/2021\/08\/cmmc_compliance.png","keywords":["CMMC"],"articleSection":["SAP Security"],"inLanguage":"en-US"},{"@type":["WebPage","FAQPage"],"@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/","url":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/","name":"CMMC Compliance in SAP | Xiting","isPartOf":{"@id":"https:\/\/xiting.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#primaryimage"},"image":{"@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#primaryimage"},"thumbnailUrl":"https:\/\/xiting.com\/wp-content\/uploads\/2021\/08\/cmmc_compliance.png","datePublished":"2021-08-24T20:19:25+00:00","dateModified":"2025-10-01T08:46:26+00:00","breadcrumb":{"@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#breadcrumb"},"mainEntity":[{"@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#faq-question-1629834323661"},{"@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#faq-question-1629834334588"},{"@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#faq-question-1629834353747"},{"@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#faq-question-1629834365039"},{"@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#faq-question-1629834373888"},{"@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#faq-question-1629834387555"},{"@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#faq-question-1629834406166"}],"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#primaryimage","url":"https:\/\/xiting.com\/wp-content\/uploads\/2021\/08\/cmmc_compliance.png","contentUrl":"https:\/\/xiting.com\/wp-content\/uploads\/2021\/08\/cmmc_compliance.png","width":1200,"height":628},{"@type":"BreadcrumbList","@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/xiting.com\/en\/"},{"@type":"ListItem","position":2,"name":"CMMC Compliance in SAP"}]},{"@type":"WebSite","@id":"https:\/\/xiting.com\/en\/#website","url":"https:\/\/xiting.com\/en\/","name":"Xiting","description":"Your Expert for SAP Security","publisher":{"@id":"https:\/\/xiting.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/xiting.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/xiting.com\/en\/#organization","name":"Xiting","url":"https:\/\/xiting.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiting.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/xiting.com\/wp-content\/uploads\/2025\/08\/xiting-logo.png","contentUrl":"https:\/\/xiting.com\/wp-content\/uploads\/2025\/08\/xiting-logo.png","width":960,"height":504,"caption":"Xiting"},"image":{"@id":"https:\/\/xiting.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/XitingAG","https:\/\/www.linkedin.com\/company\/1345129\/","https:\/\/www.instagram.com\/xiting.global\/","https:\/\/www.crunchbase.com\/organization\/xiting","https:\/\/www.youtube.com\/@Xiting"],"description":"Xiting wurde 2008 von erfahrenen SAP-Beratern in der Schweiz gegr\u00fcndet. Heute besch\u00e4ftigt das Unternehmen 140 Mitarbeitende an mehreren Standorten weltweit. Die SAP Security Consultants von Xiting bringen tiefes Fachwissen aus der Projektpraxis mit und betreuen \u00fcber 700 nationale und internationale Kunden \u2013 remote und vor Ort.","email":"info@xiting.ch","telephone":"+41 43422 8803","legalName":"Xiting AG","foundingDate":"2008-06-01","numberOfEmployees":{"@type":"QuantitativeValue","minValue":"51","maxValue":"200"}},{"@type":"Person","@id":"https:\/\/xiting.com\/en\/#\/schema\/person\/9f4b7239bdd4d109e5a45c9432779d5e","name":"Alessandro Banzer","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/bd69cf75d8008518f801684fb686af7daad3e988b323551989d44fb47d82a240?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/bd69cf75d8008518f801684fb686af7daad3e988b323551989d44fb47d82a240?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/bd69cf75d8008518f801684fb686af7daad3e988b323551989d44fb47d82a240?s=96&d=mm&r=g","caption":"Alessandro Banzer"},"description":"Alessandro has worked in the field of IT since 2004, specializing in SAP in 2009 and working on global SAP projects in various roles since that date. Alessandro is an active contributor and moderator in the Governance, Risk, and Compliance space on SAP SCN. Alessandro is in charge of Xiting's operations in the United States and a subject matter expert in SAP Access Control, SAP Cloud IAG, and SAP Security.","url":"https:\/\/xiting.com\/en\/author\/admin\/"},{"@type":"Question","@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#faq-question-1629834323661","position":1,"url":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#faq-question-1629834323661","name":"What is the CMMC Accreditation Body (CMMC-AB)?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"The CMMC-AB (https:\/\/www.cmmcab.org\/) is an independent organization that will authorize and accredit CMMC Third Party Assessment Organizations (C3PAOs) and the CMMC Assessors and Instructors Certification Organization (CAICO) in accordance with DoD requirements.\u00a0","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#faq-question-1629834334588","position":2,"url":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#faq-question-1629834334588","name":"What\u2019s the difference between CMMC and NIST SP 800-171?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"Unlike NIST SP 800-171, the CMMC model possesses five levels. The CMMC model is cumulative whereby each level consists of practices and processes as well as those specified in the lower levels. The CMMC model includes additional cybersecurity practices in addition to the security requirements specified in NIST SP 800-171.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#faq-question-1629834353747","position":3,"url":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#faq-question-1629834353747","name":"Is CMMC the same as ISO standards?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"CMMC will combine elements of various cybersecurity control and security standards such as NIST SP 800-171, NIST SP 800-53, ISO 27001, ISO 27032, AIA NAS9933, and others, into one unified standard for CUI cybersecurity.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#faq-question-1629834365039","position":4,"url":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#faq-question-1629834365039","name":"Does CMMC also affect small businesses?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"CMMC does not consider the size of an organization and it\u2019s applicable for small businesses to the largest global enterprises. The goal of CMMC is to be a cost-effective and affordable certification that can also be achieved by small businesses.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#faq-question-1629834373888","position":5,"url":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#faq-question-1629834373888","name":"What is FedRAMP?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"The Federal Risk and Authorization Management Program (FedRAMP) provides a standardized approach to security authorizations for Cloud Service Offerings.\u00a0","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#faq-question-1629834387555","position":6,"url":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#faq-question-1629834387555","name":"What is DFARS?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"To bid on contracts in the past, companies in the defense industrial base (DIB) could self-certify their compliance with Defense Federal Acquisition Regulations (DFARS). Going forward, DFARS will not be sufficient to win DoD RFPs.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#faq-question-1629834406166","position":7,"url":"https:\/\/xiting.com\/en\/cmmc-compliance-in-sap\/#faq-question-1629834406166","name":"What are the RFP requirements to win a DoD bid?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"All contractors will need to be CMMC-certified at the level specified in the RFP to win, participate in, or even bid on a contract. If you don\u2019t have the minimum CMMC level requests, your participation in the RFP will be rejected automatically.","inLanguage":"en-US"},"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/xiting.com\/en\/wp-json\/wp\/v2\/posts\/16228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/xiting.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/xiting.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/xiting.com\/en\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/xiting.com\/en\/wp-json\/wp\/v2\/comments?post=16228"}],"version-history":[{"count":0,"href":"https:\/\/xiting.com\/en\/wp-json\/wp\/v2\/posts\/16228\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/xiting.com\/en\/wp-json\/wp\/v2\/media\/16251"}],"wp:attachment":[{"href":"https:\/\/xiting.com\/en\/wp-json\/wp\/v2\/media?parent=16228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/xiting.com\/en\/wp-json\/wp\/v2\/categories?post=16228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/xiting.com\/en\/wp-json\/wp\/v2\/tags?post=16228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"https:\/\/www.xiting.de\/wp-content\/uploads\/2021\/09\/security-architect-configuration_en-1024x485.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.xiting.de\/wp-content\/uploads\/2021\/09\/siem-connector_en-1024x572.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.xiting.de\/wp-content\/uploads\/2021\/08\/xsp_cmmc_check-1024x529.png\")
![\"\"\/](\"https:\/\/lh5.googleusercontent.com\/Wu2FDlIny4_P1IYzpgsZZRQoCtsw0-5eB8J979X0KtcaAY7rfUs5OQhFkSNMgQlv1S18oUbd6t84pb8pGArZ1V0jUsa8Qbiv-kCjLZ9dZ2vT4YCTnY9EKllPokBJQ1P1uV3qvT0-=s0\")