Oracle announced a comprehensive set of customized tools and documentation to help defense contractors comply with the new Department of Defense (DoD) Cybersecurity Maturity Model Certification (CMMC) when they launch services on Oracle Cloud Infrastructure (OCI). As of October 15, 2024, defense contractors must be compliant with CMMC Level 1, 2, and/or 3 over a phased implementation period.
Achieving these standards can be difficult, especially for small and medium-sized businesses. The new OCI Core Landing Zone automation template and CMMC-specific documentation can significantly ease this process, helping save months of manual work mapping controls and setting up compliance-ready cloud architecture.
“GE Aerospace uses Oracle US Government Cloud to deliver CMMC Level 2 readiness on a modernized supply chain,” said Shravan Devulapalli, cybersecurity technologist, GE Aerospace. “Our modernization project was delivered on time and on budget with performance that exceeded the on-premises solution it replaced.”
Achieving CMMC compliance
The CMMC Program enables the DoD to verify that defense prime contractors and subcontractors have implemented security safeguards for Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). To achieve CMMC certification, businesses must comply with controls that are aligned to the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171.
The OCI Core Landing Zone includes baseline configurations and rules delivered using a standardized Infrastructure-as-Code (IAC) template designed to help meet CMMC requirements. Based on Terraform, OCI Core Landing Zones allow customers to perform one-click, best-practice deployments of a preconfigured set of cloud native services. Customers can answer a few simple questions about their needs, launch the OCI Core Landing Zone templates, and have an architecture set up that is designed to automatically meet many CMMC controls.
Oracle US Government Cloud has also achieved FedRAMP High JAB P-ATO status, and its services meet NIST SP 800-171 control requirements.
“CMMC is more than a secure implementation in the cloud. It is documentation that authoritatively matches that implementation to the CMMC controls,” said Rand Waldron, vice president, Oracle. “Oracle has gone further to help defense contractors by providing comprehensive guidance to explain how Oracle Cloud Infrastructure helps achieve compliance with CMMC requirements. Oracle provides both an informational guide and controls checklist for CMMC Levels 1 and 2 compliance.”
The OCI Landing Zone and associated technical documentation are provided at no additional charge under a customer’s contract. Cloud services used to stand up OCI Core Landing Zone in a customer’s tenancy will be billed in accordance with the customer’s contract. OCI Core Landing Zone templates are available within the OCI Console and through GitHub. For more information, check out the CMMC Level 1 and Level 2 informational guides.
Oracle US Government Cloud services are priced at the same, consistent global pricing as Oracle’s commercial public cloud regions and meet DISA Impact Levels 2, 4, and FedRAMP High authorization standards. Oracle US Government Cloud is available in the US East (Ashburn, VA), and US West (Phoenix, AZ) regions.
