The DoD requires contractors and subcontractors to meet certain cybersecurity standards and announced the release of CMMC 2.0 as the new standardized program in November 2021. With the expected inclusion of CMMC 2.0 in contracts starting in 2025 it means that organizations must not only comply with these standards but also demonstrate their compliance effectively by getting certified at the appropriate level before a contract is awarded.
CMMC is designed to enforce protection of federal contract information (FCI) and controlled unclassified information (CUI) in alignment with DoD’s information security requirements, while keeping the supply chain running safely. The National Institute of Standards and Technology (NIST) Special Publications (SP) 800-171 and 800-172 serve as the basis for these protection measures.
CMMC is codified as part of the Defense Federal Acquisition Regulation Supplement (DFARS) within the Code of Federal Regulations. The CMMC program is overseen by the Office of the Under Secretary of Defense for Acquisitions and Sustainment. The DoD has designated an independent non-profit organization, the Cyber AB, to manage the certification and accreditation process, which is at the core of CMMC. The DoD and the Cyber AB work together to implement the CMMC program from end to end.
The new CMMC 2.0 program has three levels of compliance:
- Level 1 (Foundational): Applies to organizations that focus on the protection of FCI. It includes 17 practices based on FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems.
- Level 2 (Advanced): Builds upon Level 1 requirements to include 110 practices based on NIST SP 800-171, introducing additional practices to increase security maturity. This level has additional requirements to ensure the protection of the two types of CUI data – prioritized and non-prioritized.
- Level 3 (Expert): Builds upon Level 2 requirements to introduce an additional subset of practices based on NIST SP 800-172, intended to protect CUI from advanced persistent threats (APTs).
Meet Compliance Needs
Our trusted experts can help you gather requirements, identify security weaknesses and corrective actions, and prepare artifacts for examination by the Certified Third-Party Assessment Organization (C3PAO). Be ready to win government contracts requiring CMMC certification.
Increase Security Maturity
Achieve greater visibility into the data assets you are responsible for securing and uplift your security posture to sleep soundly at night. Rapidly mitigate the impact of a security incident with a comprehensive incident response plan.
Build Your Trust Story
With more and more clients – both public and private sector – demanding robust security controls, being able to tell a compelling story about your risk management, compliance, and security programs is key to winning contracts.
Balance Risk, Cost, and Service
Security has a cost. Implemented without an effective plan, you can easily spend more than you need to and achieve less effective security than you want to. We can help you balance risk, cost, and service delivery to ensure maximum return on investments.
