What It Is

Cybersecurity Maturity Model Certification (CMMC) 2.0 is a U.S. Department of Defense (DoD) certification framework verifying cybersecurity protections for Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) in the Defense Industrial Base (DIB). It uses a tiered, risk-based model with three cumulative levels: Level 1 for basic FCI safeguards, Level 2 for CUI via NIST SP 800-171, and Level 3 for APT defenses adding NIST SP 800-172 selections.

Key Components

• 14 domains (e.g., Access Control, Incident Response) with 17 Level 1, 110 Level 2, and 134 Level 3 practices.
• Built on FAR 52.204-21, NIST SP 800-171 Rev 2, and NIST SP 800-172.
• Assessment model: self-assessments (Level 1/2 select), C3PAO (Level 2), DIBCAC (Level 3); SPRS/eMASS reporting; limited POA&Ms.

Why Organizations Use It

Mandatory for DoD contractors/subcontractors handling FCI/CUI to ensure contract eligibility, reduce supply chain risks, and gain competitive advantage. Enhances resilience, lowers breach costs, builds prime trust, and aligns with NIST frameworks.

Implementation Overview

Phased approach: scoping, gap analysis, remediation, assessment preparation, certification, sustainment. Applies to all DIB sizes via enclaves; requires SSPs, evidence collection, annual affirmations, triennial recertification. (178 words)

What It Is

C-TPAT (Customs-Trade Partnership Against Terrorism) is a voluntary public-private framework administered by U.S. Customs and Border Protection (CBP). Its primary purpose is to enhance international supply chain security against terrorism and crime, from origin to U.S. ports. It employs a risk-based approach with tailored Minimum Security Criteria (MSC) for roles like importers, carriers, and brokers.

Key Components

• 12 core **MSC domainsrisk assessment, business partners, physical access, personnel security, conveyance security, IT/cybersecurity, training, and more.
• Best Practices Framework (2021) for exceeding MSCs.
• Security Profile submission via CBP portal.
• Tiered certification model with validations by Supply Chain Security Specialists.

Why Organizations Use It

• **Trade facilitationreduced inspections, FAST lanes, priority recovery.
• **Risk mitigationsecures partners, prevents incidents.
• Builds stakeholder trust, enables MRAs globally.
• Strategic edge in competitive bidding.

Implementation Overview

• Phased: gap analysis, remediation, training, validation.
• Cross-functional teams; 6-12 months typical.
• Applies to importers/exporters/carriers globally.
• CBP-led validations/revalidations required.