Preparing for CMMC Level 2 Certification with AWS: A Guide for Domestic Defense Companies

• AWS GovCloud (US) is not mandatory; CMMC Level 2 certification preparation is possible using FedRAMP-certified commercial US regions
• AWS reference architecture and SRE provided to meet the 110 security requirements of NIST SP 800-171 Rev. 2
• AWS Security Assurance Services (SAS) provides preparation support and evidence management from the perspective of C3PAO assessments
• Presents examples of dedicated Enclave configuration for CUI protection and a permission separation structure based on four accounts

CMMC Level 2 Certification Preparation Environment Configuration

• Resource configuration checks and evidence collection using the AWS Config CMMC 2.0 Level 2 Conformance Pack
• Code-based repeatable deployment of multi-account-based environments using Landing Zone Accelerator on AWS (LZA)
• CUI data flow control and access restriction utilizing WorkSpaces, FSx, S3, KMS, etc.
• C3PAO assessment evidence must be retained for 6 years from the CMMC Status Date

AWS Security Assurance Services (SAS) Support Scope

• Support for identifying CUI data flows and establishing a clearly justified CMMC assessment scope
• Support for mapping CMMC requirements to AWS services and customer configuration components
• Provision of verification of security control implementation status, gap analysis reports, and improvement task lists
• Support for compliance engineering and automation utilizing IaC and Policy as Code