The Cybersecurity Maturity Model Certification (CMMC) was created to enhance the cybersecurity posture of companies participating in US government supply chains. As of December 31, 2017, defense and government suppliers had to comply with NIST 800-171. Starting in 2020 with the introduction of the CMMC FAR clause, the DoD is gradually transitioning federal contract information to include CMMC instead of NIST 800-171.
There are two significant differences between NIST 800-171 and CMMC:
The Cybersecurity Maturity Model Certification (CMMC) is a unified cybersecurity standard created to increase the security posture of companies operating in government supply chains. Version 1.0 was released in January 2020, and a minor update to Version 1.02 in March 2020. CMMC 2.0 was announced in November 2021.
Once CMMC 2.0 rulemaking is complete, the Department of Defense can begin to include CMMC requirements in RFPs.
By October 1, 2025, all new DoD contracts will require CMMC.
You can learn more about CMMC at these government sites:
Depending on the CMMC level to which you must comply, you may need to work with an accredited and independent third-party organization to perform a CMMC assessment. Or you may be able to self-attest to CMMC compliance.
The CMMC framework contains three maturity levels. The CMMC practices provide a range of mitigation across the levels, starting with basic safeguarding and basic cybersecurity at Level 1, moving to the broad protection of CUI at Level 2, and culminating with reducing the risk from Advanced Persistent Threats (APT) at Level 3.
DoD contracts stipulate to which level (1, 2, or 3) a supplier must meet.
Self-assessments are performed annually. Outside assessments are performed every 3 years.
A subcontractor working for a prime contractor may not necessarily need to meet the same level as the prime. For example, to win a contract, first-tier DoD contractors may need to be at Level 2, but a supplier to a prime may only need to be at Level 1 if that supplier will never receive or touch information that needs to be protected.
Many small businesses will only need to meet Level 1.
There are three different ways to become CMMC compliant, depending on the level you need to meet:
The major distinction in CMMC certification is whether you are protecting Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).
The first step in the CMMC compliance process is to determine the level of CMMC you want to meet (based on future contracts on which you plan to bid and internal business goals).
Level 1 CMMC companies and Level 2 CMMC companies that are eligible for self-attestation undergo the following process to achieve CMMC compliance.
Corserva can assess your compliance to the 17 controls and guide you in submitting your assessment results to the government.
The self-assessment is performed annually to stay in compliance with CMMC.
Level 2 CMMC companies requiring a C3PAO assessment undergo the following process to achieve CMMC compliance.
The certification will last for three years, at which point companies will be able to renew their certification.
Suppliers working under multiple contracts may comply with NIST 800-171 on some contracts and CMMC on others. Level 2 of CMMC is equivalent to NIST 800-171.
No existing contracts will have CMMC requirements inserted into them. The potential for CMMC requirements is only with new future contracts.
The certification to win a contract will be needed at the time of the award.
You should think of NIST 800-171 as the foundation for CMMC.
There are 14 families of requirements in NIST 800-171, and across the 14 families are a total of 110 individual requirements.
The CMMC model comprises 14 domains that align with the families specified in NIST SP 800-171.
NIST 800-171 was about compliance, whereas CMMC is about reducing risk in DoD supply chains. What hasn't changed is the goal: to protect information.
As a CMMC-AB Registered Provider Organization™ (RPO) listed in the CMMC-AB Marketplace, Corserva can help prepare companies for a CMMC assessment or self-attest.
Corserva offers an easy process for your organization to comply with CMMC. Request a quote today to protect your government contracts and prevent cyber threats.