CMMCCybersecurity Maturity Model Certification

CMMC, or Cybersecurity Maturity Model Certification, is a framework created by the US Department of Defense (DoD) to ensure that companies and organizations that work with the DoD have appropriate cybersecurity controls and practices in place to protect sensitive information.

The CMMC framework consists of five levels of cybersecurity maturity, with Level 1 representing basic cybersecurity hygiene and Level 5 representing advanced cybersecurity practices. Each level has a set of specific security requirements and processes that must be met in order to achieve certification.

CMMC certification is required for all organizations that do business with the DoD, including contractors and subcontractors. The certification process involves a third-party assessment of the organization's cybersecurity practices and controls, and certification is required for organizations to bid on and win contracts with the DoD.

All organizations that do business or receive grants with the United States Department of Defense (DoD) need to obtain CMMC certification if they want to be eligible to bid on and win DoD contracts. This includes prime contractors, subcontractors, suppliers, and vendors.

The CMMC certification requirement will be phased in over time, with DoD contracts starting to require certification at different levels beginning in 2021. DoD contractors and subcontractors should check with their contracting officers to determine when their contracts will require CMMC certification and at what level.

Failing to be certified to the appropriate CMMC maturity level will disqualify an organization from being awarded defense contracts or research grants that include the CMMC requirement and could put DoD grant funding at risk for your institution.

In addition, non-compliance with the CMMC framework could also result in other consequences, such as increased cybersecurity risk, loss of customer trust, and potential legal and financial liabilities.

It's important to note that becoming CMMC compliant can be a complex and time-consuming process, depending on your organization's current cybersecurity practices and the level of certification required. Therefore, it's important to start planning and implementing the necessary changes as soon as possible to ensure that your organization is prepared to meet the CMMC requirements.

According to the DoD website, "The publication of materials relating to CMMC 2.0 reflects the Department’s strategic intent with respect to the CMMC program; however, CMMC 2.0 will not be a contractual requirement until the Department completes rulemaking to implement the program. The rulemaking process and timelines can take 9-24 months. CMMC 2.0 will become a contract requirement once rulemaking is completed."

CMMC 2.0 eliminates Level 2 (Intermediate) and Level 4 (Proactive) from CMMC 1.0. CMMC Model 2.0 has three levels that connect to existing federal requirements that are already in place:

• • Level 1: Foundational is aligned with FAR 52.204-21: Basic Safeguarding of Covered Contractor Information Systems (for companies with FCI only).
  • Level 2: Advanced is aligned with NIST SP 800-171: Protecting CUI in Nonfederal Systems, and also requires compliance with FAR 52.204-21 (for companies with CUI).
  • Level 3: Expert is aligned with NIST SP 800-172: Enhanced Security Requirements for Protecting Controlled Unclassified Information, and also requires compliance with FAR 52.204-21 and NIST SP 800-171 (for the highest priority programs with CUI).