CMMC 2.0 Compliance 101: Essential Insights for Businesses

In essence, the Cybersecurity Maturity Model Certification (CMMC) is an initiative by the Department of Defense (DoD) aimed at safeguarding sensitive but unclassified information from unauthorized access. CMMC 2.0 is pivotal for national security, responding to the rise in sophisticated cyber threats that result in a staggering $600 billion loss to the defense sector annually. 

For nearly a decade, firms have been mandated to adhere to cybersecurity standards under DFARS 7012, which allowed for self-assessment and self-attestation. The pivotal change brought by CMMC 2.0, under DFARS 7021, is that a considerable number of Defense Industrial Base (DIB) organizations will now be compelled to undergo an external evaluation by a CMMC Third Party Assessment Organization (C3PAO). Entities still eligible for self-assessment will encounter heightened scrutiny, requiring an executive to annually attest that their organizations comply with NIST SP 800-171 or other relevant standards based on the type of information handled. 

In this article, we will explore the most frequently asked questions about CMMC 2.0 and the associated regulations and compliance requirements starting to take effect for DIB organizations. 

Frequently Asked Questions About CMMC 2.0 Compliance 

1. What does CMMC mean? What is CMMC? 

CMMC stands for Cybersecurity Maturity Model Certification, a streamlined cybersecurity program initiated by the Department of Defense. Its aim is to protect Controlled Unclassified Information (CUI) that DIB organizations store, process, or transmit. This framework was designed to ensure that all personnel working on DoD contracts operate in a secure environment that shields CUI from unauthorized access aimed at theft or misuse. 

2. What does it mean to be CMMC 2.0 compliant? 

Achieving CMMC 2.0 compliance means that a DIB organization has fulfilled the requisite cybersecurity standards based on its maturity level. For Maturity Level 1, which encompasses protection for Federal Contract Information (FCI), there are 15 practices allowing self-assessment. Maturity Level 2 includes 110 practices aligned with NIST SP 800-171 r2 controls. While some firms that do not handle sensitive CUI may self-assess, the majority will necessitate an external assessment by a C3PAO. Maturity Level 3 comprises 134 practices, including an additional 24 controls from NIST SP 800-172, and requires assessment by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). Organizations must validate their practices to maintain DoD contracts, evade penalties, and safeguard sensitive data. 

3. What CMMC 2.0 level must I achieve? 

The CMMC 2.0 level required for your DIB firm depends on the contract solicitations you plan to pursue, as each contract sets a specific Maturity Level (ML). The nature of the information your organization manages also influences this—a distinction exists between Federal Contract Information (FCI) and Controlled Unclassified Information (CUI), with the latter demanding greater security. The three levels are: 

Level 1 (Foundational) 

This initial level primarily targets companies dealing only with FCI, which must implement basic cybersecurity measures based on FAR 52.204-21. These measures help safeguard contractors’ information and restrict access to authorized individuals only. 

Level 2 (Advanced) 

Organizations engaging with CUI must achieve this minimum level of compliance. The requirements align with NIST SP 800-171 r2 controls, consisting of 14 levels and 110 controls, which are vital for protecting the CUI managed by the DIB. 

Level 3 (Expert) 

This is the highest security level designated for DIB organizations working closely with the DoD. Its controls and requirements target Advanced Persistent Threats (APTs). The DoD has stated that this level will consist of the 110 controls in NIST SP 800-171 alongside additional controls from NIST SP 800-172. 

4. How do I obtain CMMC 2.0 certification? 

Begin by familiarizing yourself with the CMMC 2.0 requirements that apply to your organization. Create a System Security Plan (SSP) and develop internal policies for secure CUI handling. A self-assessment is sufficient for Maturity Level 1 (ML1), mostly applicable to firms handling only FCI. 

For Maturity Level 2 (ML2) and beyond, if your organization manages more sensitive CUI, you may need an external assessment by a C3PAO. After either self-assessing or getting assessed by a third party, submit your score to the DoD’s Supplier Performance Risk System (SPRS). Address any identified gaps with a Plan of Action and Milestones (POA&M). C3PAO certifications remain valid for three years, but companies must reaffirm compliance annually. ML1 self-assessments are also required yearly. 

5. Who requires CMMC 2.0 certification? 

Organizations within the DIB sector that engage with DoD contracts or subcontractors must adhere to CMMC 2.0 controls. The required level of compliance varies based on several factors as discussed earlier. Non-compliance can result in contract losses, cancellation of agreements, or even government-imposed penalties. 

6. How is CMMC 2.0 connected to cybersecurity? 

The CMMC 2.0 framework largely focuses on cybersecurity, with most rules emphasizing stringent security around digital materials during storage, transmission, and collaborative use. Furthermore, there are controls on physical security and organizational training. The CMMC 2.0 compliance framework is designed to enforce the security measures the DoD mandates of its contractors and subcontractors. 

7. When will CMMC 2.0 be implemented? 

CMMC 2.0 is likely to appear in DoD contract solicitations after the finalization of the second CMMC rule, CFR 48—expected around Q2 2025. However, it will take an additional three years before all new and renewed DoD contracts are required to comply with CMMC 2.0. The rollout will be phased, gradually increasing the number of contracts affected. Although full implementation will not occur instantly, it’s essential for businesses dependent on DoD contracts to begin preparing now, as the certification process can take months or longer. 

8. What are the consequences of not complying with CMMC 2.0? 

Failing to adhere to CMMC 2.0 can lead to severe repercussions for businesses relying on DoD contracts, including losing existing contracts and ineligibility for future opportunities. Moreover, legal risks under the False Claims Act could arise if compliance is misrepresented. Company executives must attest to the accuracy of reported SPRS scores, making both the organization and the individuals liable to prosecution by the Department of Justice for any misstatements. Non-compliance can also tarnish a company’s reputation, jeopardizing potential future contracts. 

9. Is GCC High required for CMMC 2.0? What is GCC High? 

GCC High is a Microsoft cloud service tier tailored to meet robust security and compliance standards for handling sensitive government information, including CUI and ITAR data. Although CMMC does not specifically mandate GCC High, numerous contractors dealing with sensitive CUI utilize it to satisfy security criteria for cloud services. 

However, organizations relying on External Service Providers (ESPs), such as Cloud Service Providers (CSPs) or Managed Service Providers (MSPs), must ensure that these providers hold the proper CMMC and/or FedRAMP accreditations to assist in fulfilling CMMC practices. Companies should meticulously assess their cloud and service vendors to confirm alignment with CMMC compliance standards. 

10. How many controls are included in CMMC? 

For Maturity Level 2, there are 110 practices that organizations must meet to continue engaging in DoD contracts. These controls encompass a broad spectrum of security measures essential for compliance. 

11. Is CMMC 2.0 complete? 

While progress toward finalizing CMMC 2.0 is ongoing, it has not yet been entirely completed. The process involves two critical rules: CFR 32 and CFR 48. CFR 32 has been published as a final rule and will take effect on December 16, 2024. CFR 48 recently concluded its public comment period and remains under review. Once the DoD revises CFR 48, it will be submitted for approval by the Office of Management and Budget (OMB) and eventually published in the Federal Register. It’s anticipated that this rule will become official 60 days later, likely in Q2 2025. Only after both rules are enacted will CMMC feature in DoD contract solicitations. Thus, it’s imperative for DIB organizations to begin preparing for compliance promptly. 

12. Is CMMC mandatory? 

The short answer is yes. While CMMC has not been officially enforced until now, existing DFARS 7012 mandates that companies self-assess and attest to compliance with NIST SP 800-171  for years. With CMMC 2.0’s introduction, DIB organizations will now face stricter compliance measures through mandated third-party assessments by C3PAOs. Any entity handling Controlled Unclassified Information (CUI) must submit their assessment to the DoD and obtain certification for three years to secure or pursue DoD contracts. Given the similarities between DFARS 7012 and DFARS 7021, many companies should already be positioned to meet CMMC. 

13. How do CMMC and NIST SP 800-171 differ? 

CMMC expands on NIST SP 800-171, which is a security framework crafted by NIST that specifies 110 controls geared towards safeguarding Controlled Unclassified Information (CUI). Prior to DFARS 7012, companies were expected to self-evaluate and attest to their compliance with these controls; however, this method proved insufficient. CMMC Maturity Level 2 (ML2) aligns its standards with these 110 NIST controls but now mandates that most businesses undergo a third-party evaluation conducted by a CMMC Third Party Assessment Organization (C3PAO) to confirm that these controls are effectively implemented and maintained before accreditation is granted. 

CMMC 2.0 Is on the Horizon, Demanding DIB Business Compliance 

While the DoD is still finalizing CMMC 2.0, it’s clear that its implementation is imminent and currently in the final stages of approval as of this writing. By 2025, adherence will be compulsory, with proof of compliance becoming a prerequisite for DIB suppliers to retain or secure DoD contracts. The compliance process can be intricate and may take months, which is why companies should begin preparations without delay. 

Businesses don’t have to tackle this challenge alone or manage the entire process independently. Exostar’s CMMC Ready Suite offers a comprehensive array of software and services designed to assist you in navigating compliance and preparing for the assessment that will verify your readiness. To learn more about our CMMC Ready Suite and its offerings, visit our webpage and schedule a conversation with one of our representatives for additional details.