What It Is

Cybersecurity Maturity Model Certification (CMMC) 2.0 is a DoD certification framework verifying cybersecurity protections for Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) in the Defense Industrial Base (DIB). It uses a tiered, risk-based model with three levels: Level 1 for basic FCI safeguards, Level 2 for CUI via NIST SP 800-171, and Level 3 for APT defenses adding NIST SP 800-172.

Key Components

• 14 domains (e.g., Access Control, Incident Response) with 17 practices (Level 1), 110 (Level 2), plus 24 enhanced (Level 3).
• Built on FAR 52.204-21, NIST SP 800-171 Rev 2, and NIST SP 800-172.
• Certification via self-assessments (Level 1/2), C3PAO (Level 2), or DIBCAC (Level 3), with POA&Ms limited to 180 days and SPRS/eMASS reporting.

Why Organizations Use It

Mandated for DoD contractors/subcontractors handling FCI/CUI, ensuring contract eligibility. Reduces breach risks, enhances supply chain trust, and provides competitive bidding advantages. Builds operational resilience and aligns with broader NIST frameworks.

Implementation Overview

Phased approach: scoping, gap analysis, remediation, assessment preparation, certification, sustainment. Applies to all DIB sizes, from SMEs to primes. Requires SSPs, evidence collection, annual affirmations; timelines 12-18 months for Level 2.

What It Is

Authorized Economic Operator (AEO) is a voluntary certification program established under the World Customs Organization (WCO) SAFE Framework of Standards. It designates compliant, low-risk businesses involved in international goods movement as trusted partners. The primary purpose is to secure supply chains while facilitating trade via risk-based customs controls and partnerships. Key approach includes self-assessment via harmonized SAQ (Criteria A-M), rigorous validation, and ongoing monitoring.

Key Components

• Four pillars: customs compliance, records/internal controls, financial solvency, supply chain security.
• 13 SAQ criteria groups covering training, data security, cargo/premises/personnel security, partners, crisis management, continuous improvement.
• Built on SAFE Framework; compliance model features initial validation, periodic re-validation, mutual recognition.

Why Organizations Use It

• Facilitation benefits: reduced inspections, priority clearance, cost savings (e.g., avoided exams).
• MRAs enable cross-border advantages.
• Enhances risk management, reputation, tender competitiveness; voluntary but strategic for trade efficiency.

Implementation Overview

• Phased: gap analysis, SOPs design, training, digital evidence/IT integration, mock audits.
• Cross-functional project for supply chain actors; 6-12 months typical; requires site audits, continuous governance.