CMMC Assessment Readiness

CMMC 2.0, or the Cybersecurity Maturity Model Certification 2.0, is a contract requirement for Defense Industrial Base (DIB) contractors to do business with the Department of Defense (DoD). Compliance is measured by achieving appropriate certification at one of three levels, every three years; and by affirming compliance with the requirements in the off years between assessments. The requirements vary from level to level increasing in rigor from Level 1 to Level 3

 Department of Defense (DoD) contractors and subcontractors that will process, store, or transmit Federal Contact Information (FCI) or Federally Controlled Unclassified Information (CUI). CMMC requirements apply will apply to all DoD solicitations and contracts requiremend defense contractors and subcontractors to process, store, or transmit FCI or CUI. Any entity within the DoD supply chain, including subcontractors and those receiving derived funding, must adhere to one of the three maturity levels established by CMMC 2.0 once it becomes effective. Your specific contractual obligations will determine your maturity level.

CMMC will be rolled out in a four (4) phased implementation plan:

• Phase 1 begins on the effective date of the CMMC revision to DFARS 252.204-7021
  • Includes CMMC Level 1 Self-Assessments
  • Includes CMMC Level 2 Self-Assessments
  • May include CMMC Level 2 Certification Assessments in place of CMMC Level 2 Self-Assessments
• Phase 2 begins six months after the start of Phase 1
  • Includes CMMC Level 2 Certification Assessments for all applicable DoD solicitations and contracts
    • The DoD may delay the inclusion of CMMC Level 2 Certification Assessments to an option period instead of as a condition of contract award
  • May include CMMC Level 3 Certification Assessments
• Phase 3 begins one calendar year after the start date of Phase 2
  • Includes CMMC Level 2 Certification Assessments for all applicable DoD solicitations and contracts and as a condition to exercise an option period on contract award prior to the effective date
  • Includes CMMC Level 3 Certification Assessments as a condition of contract award
    • The DoD may delay the inclusion of CMMC Level 3 Certification Assessments to an option period instead of a condition of contract award
• Phase 4 (Full Implementation) begins one calendar year after the state date of Phase 3

The DoD will include the CMMC Program requirement in all applicable solicitations and contracts, including option periodds on contracts awarded prior to the beginning of Phase 4.

Preparation for CMMC involves understanding the requirements for the specific level you’re aiming to achieve, conducting an initial assessment of your current cybersecurity posture, and then implementing necessary changes or improvements. It’s often beneficial to seek guidance from a CMMC Registered Provider Organization (RPO) such as Summit Security Group.

Yes, certifications and assertions are requirements to particibate in DoD contacts. If an organization does business with the DOB, either as a contractor or subcontractor, or plans to do business with the DIB CMMC is a necessity.