CMMC 2.0 is coming – are you ready?

CMMC is a cybersecurity framework regulating manufacturing contractors serving in the Defence Industrial Base (Defence Industrial Base), an extensive list of DoD supply chain partners. Any contractor or subcontractor that processes, sends, shares, or receives controlled unclassified information (CUI) or federal contract information (FCI) must demonstrate compliance with CMMC.

The transition from CMMC 1.0 to CMMC 2.0 reflects a streamlining and refinement of the framework and CMMC requirements to make CMMC compliance more efficient and practical for defence contractors in the defence industrial base (DIB). CMMC requirement changes include:

1. Fewer CMMC Maturity Levels
CMMC 1.0 featured five levels, ranging from basic cyber hygiene (Level 1) to advanced/progressive (Level 5). By contrast, CMMC 2.0 requires defence contractors to now meet one of only three maturity levels: Level 1 (Foundational), Level 2 (Advanced), and Level 3 (Expert).

2. Alignment with NIST Standards
CMMC 2.0 places a stronger emphasis on aligning certification requirements with existing NIST standards (NIST SP 800-171 for Level 2 and NIST SP 800-172 for Level 3). This alignment aims to reduce complexity and enhance consistency with well-established frameworks.

3. Self-Assessments
Under CMMC 2.0, companies responsible for handling Federal Contract Information (FCI) at Level 1 are only required to perform annual self-assessments rather than requiring third-party certification from a certified third-party assessor organization (C3PAO). Note: CMMC Level 2 compliance requires a mix of self-assessments and third-party assessments depending on the type of information being handled.

4. Elimination of Certain Practices and Processes
The CMMC 2.0 framework is missing the maturity processes that were part of levels in CMMC 1.0 and instead focuses purely on cybersecurity practices, simplifying CMMC requirements.

As of November 10th, DoD contracting officers require Level 2 self-assessments in new contracts. This puts a lot of pressure on defence partners in maintaining and submitting new bids with the DoD – but Kite and Kiteworks are here to simplify your path to compliance.