The framework of CMMC is limited to Department of Defense contractors only. Regardless of size, all 300,000+ members of the DIB need to become CMMC-certified, according to the CMMC accreditation body (CMMC-AB), which administers the plan on behalf of the DoD.
The release of CMMC 2.0, aimed to simplify implementation and working with an advisory partner within the 3 levels is still the best method to guarantee quick, trouble-free preparation to meet the necessary Level for handling DoD data.
Prior to CMMC, the DoD required all contractors and subcontractors to be NIST SP 800-171 compliant and self-certify on their adherence to these rules. Although the new framework includes these requirements, additional cybersecurity standards will also be baked into the new cybersecurity model, including NIST SP 800-53, ISO 270001 and ISO 27032. Meeting these standards – and being certified by an accredited certification assessor – is a requirement to continue fulfilling or bidding on DoD contracts.
The CMMC 2.0 framework now has three levels:
- Level 1 Foundational: Applies to companies that focus on the protection of FCI. It will be based on the 17 controls found in FAR 52.204-21, Basic Safeguarding of Covered Contractor.
- Level 2 Advanced: Builds upon Level 1 requirements and introduces additional practices to enhance cybersecurity maturity based on the 110 controls from NIST SP 800-171. This Level has additional requirements to ensure the protection of the two types of CUI data– prioritized and non-prioritized.
- Level 3 Expert: Adopts an additional subset of the 35 enhanced controls from NISTSP800-172 to protect CUI from advanced persistent threats (APT).
Meet Compliance Needs
Our trusted experts can help by reviewing your system security plan and preparing artifacts for examination by the Third Party Assessor Organization (C3PAO). Get accredited and win government contracts requiring CMMC cybersecurity compliance.
Improve Security Maturity
Acquire greater visibility into the data assets you are responsible for securing, and uplift your security posture to sleep soundly at night. Rapidly mitigate the impact of a security incident with a comprehensive incident response plan.
Build Your Trust Story
With more and more clients – both public and private sector – demanding robust security controls, being able to tell a compelling story about your risk management, compliance, and security program, is key to winning work.
Balance Risk, Cost and Service
Quite obviously, security has a cost. Implemented without an effective plan, you can easily spend more than you need to, and achieve less real security than you want to. We can help you balance risk, cost, and service delivery to ensure maximum return on investment.
