Cybersecurity Maturity Model Certification (CMMC):
What it is and what it means for the Defense Industrial Base
CMMC: HOW DID WE GET HERE?
Organizations that work with the Department of Defense (DoD), known as Defense Industrial Base (DIB), are now well aware of the cybersecurity mandates that have been sweeping across the defense industry over the past several years. In 2015, The U.S. Department of Defense published the Defense Acquisition Federal Regulation Supplement, known as DFARS, which mandates that private DoD Contractors adopt cybersecurity standards according to the NIST SP 800-171 cybersecurity framework. This is all part of a government-led effort to protect the U.S. defense supply chain from foreign and domestic cyber threats and reduce the overall security risk of the sector.
On January 31, 2020, the DoD announced the Cybersecurity Maturity Model Certification (CMMC). This new framework is to ensure their contractors and suppliers have appropriate cybersecurity frameworks in place to protect data such as Controlled Unclassified Information (CUI), Federal Contact Information (FCI), and other information. In September 2020, the DoD published an interim rule to the Defense Federal Acquisition Regulation Supplement (DFARS), which implemented the DoD’s initial vision for the CMMC program (“CMMC 1.0”) and outlined the basic features of the framework (tiered model, required assessments, and implementation through contracts). This interim rule became effective on November 30, 2020, and was meant to phase in over the next five years.
However, in March 2021, prompted by over 850 public comments, the Department initiated an internal review of CMMC’s implementation. This comprehensive assessment urged the DoD to refine the policy and program. In November 2021, the Department announced “CMMC 2.0,” an updated program designed to achieve these primary goals:
- Safeguard sensitive information to enable and protect the warfighter
- Dynamically enhance DIB cybersecurity to meet evolving threats
- Ensure accountability while minimizing barriers to compliance with DoD requirements
- Contribute towards instilling a collaborative culture of cybersecurity and cyber resilience
- Maintain public trust through high professional and ethical standards
Many DoD contractors and subcontractors will have to complete the CMMC assessment prior to bidding on work in the coming months. Understanding the current state of your cybersecurity program and how it measures up against the CMMC framework is the critical first step in this process.
CMMC 1.0 > CMMC 2.0: WHAT CHANGED?
Reduction of Certification Levels
CMMC 2.0 reduces the framework from five certification levels to three. The levels will be renamed to Level 1, Foundational (previously Level 1); Level 2, Advanced (previously Level 3); and Level 3, Expert (previously Level 5).
Self-Assessments and Government-Led Assessments
The most dramatic shift planned for CMMC 2.0 is removal of the requirement that all certification assessments be performed by third-party organizations, dubbed CMMC Third-Party Assessment Organizations (C3PAOs).
Under the updated framework, Level 1 certification and certain nonprioritized acquisitions assigned Level 2 will require only an annual self-assessment and accompanying contractor affirmation in the Supplier Performance Risk System (SPRS). Prioritized acquisitions assigned Level 2 will require a C3PAO assessment every three years. All certifications at Level 3 will require a government (rather than C3PAO) assessment every three years.
Limited POAMs
Under certain circumstances, CMMC 2.0 will allow contractors to implement time-limited Plans of Action and Milestones (POAMs) in order to achieve full certification. DoD will specify an absolute number of cybersecurity requirements that must be achieved prior to contract award, as well as a small set of critical requirements that must always be achieved prior to award and which may not appear in a contractor’s POAM. The allowance for a POAM, even if limited, is a significant change from the prior model, which required that contractors achieve the full applicable CMMC level certification to even be eligible to submit a proposal for any defense contracts.
Limited Waivers
Under certain limited circumstances for select mission critical acquisitions, CMMC 2.0 will allow contractors to obtain waivers of CMMC requirements. Waivers must be approved by DoD senior leadership and will be time-limited. Again, even with limitations, a CMMC waiver process is a large shift from the previous model, where certification was a “go/no-go” criterion for bidding on defense contracts.
Streamlined Practices
CMMC 2.0 draws only from the National Institute of Standards and Technology Special Publication (NIST SP) 800-171 and NIST SP 800-172 to create its cybersecurity standards. It no longer contains any cybersecurity practices drafted specifically for the CMMC framework or practices pulled from various domestic and international cybersecurity standards.
Removal of Maturity Processes
CMMC 1.0 proposed to evaluate both cybersecurity processes and cybersecurity practices. Practices evaluated technical activities required for certification, whereas processes evaluated the extent of institutionalization of those practices. CMMC 2.0 eliminates the concept of maturity processes and contains only the cybersecurity practices themselves.
CMMC 2.0: THE THREE LEVELS
Level 1: Basic Cyber Hygiene (Foundational)
This is the most basic level of certification and consists of several practices that correspond directly to essential safety conditions outlined in the Federal Acquisition Regulation (FAR).
Level One consists of 17 basic cybersecurity practices such as implementing Access Control as well as Identity and Authentication.
Other practices include:
- Asset Management (AM)
- Audit and Accountability (AA)
- Awareness and Training (AT)
- Configuration Management (CM)
- Incident Response (IR)
- Maintenance (MA)
- Media Protection (MP)
- Personnel Security (PS)
- Physical Protection (PP)
- Recovery (RE)
- Risk Management (RM)
- Security Assessment (SAS)
- Situational Awareness (SA)
- System and Communications Protections (SCP)
- System and Information Integrity (SII)
The primary aim is to protect federal contract information, and it is mandatory for anyone looking to obtain a DoD contract.
Level 2: Intermediate Cyber Hygiene (Advanced)
Level 2 requires recorded policies for each of the 17 practices covered by the certification and documentation for completing each practice's policies.
It is a more extensive set of security practices - 55 in addition to the 17 in Level 1 - that are a subset of the NIST SP 800-171 requirements, which protect controlled unclassified information in the IT of government contractors and subtractors.
The goal is to create a basic sense of cybersecurity for any organization that has Controlled Unclassified Information (CUI), which requires a higher level of security than an organization with only Federal Contact Information (FCI).
Level 3: Good Cyber Hygiene (Expert)
The final level mandates organizations establish and maintain a plan to implement the requirements of CMMC.
Level 3 includes all the practices included in Levels 1 and 2, the requirements stated in NIST SP 800-171 as well as NIST SP 800-172; and an additional 58 practices.
As a result of the alignment of CMMC to NIST standards, the Department’s requirements will continue to evolve as changes are made to the underlying NIST SP 800-171 and NIST SP 800-172 requirements.
Want more information?
Powered by Soteria Technology Solutions