What It Is

Cybersecurity Maturity Model Certification (CMMC) 2.0 is a U.S. Department of Defense (DoD) certification program ensuring cybersecurity protections for the Defense Industrial Base (DIB). It verifies safeguards for Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) via three tiered levels: Level 1 (basic FCI safeguarding), Level 2 (NIST SP 800-171 for CUI), and Level 3 (NIST SP 800-172 enhancements against APTs). The model employs risk-based scoping, mapping to FAR 52.204-21 and NIST standards.

Key Components

• 14 domains like Access Control and Incident Response with 17 (Level 1), 110 (Level 2), and 134 (Level 3) practices.
• Cumulative structure requiring lower-level compliance.
• Assessment scopes via self-assessments, C3PAO, or DIBCAC.
• Limited POA&Ms closing in 180 days, reported to SPRS/eMASS.

Why Organizations Use It

Mandatory for DoD contractors to secure contracts, reducing ineligibility risks. Enhances supply chain trust, operational resilience, and competitive bidding. Mitigates breaches, lowers costs, and builds prime/subcontractor confidence.

Implementation Overview

Phased approach: governance, scoping/gap analysis, remediation, assessment preparation, certification, sustainment. Targets DIB primes/subcontractors handling FCI/CUI. Requires SSP development, evidence artifacts, annual affirmations, triennial recertification.

What It Is

ENERGY STAR is a voluntary U.S. government program administered by the EPA with DOE technical support. It certifies energy-efficient products, homes, commercial buildings, and industrial plants. Primary purpose: drive market transformation for energy savings and emissions reductions via trusted labeling. Key approach: category-specific performance thresholds above federal minima, verified independently.

Key Components

• Performance thresholds (e.g., 15%+ efficiency for appliances, 75+ score for buildings)
• Standardized DOE test procedures
• Third-party certification by EPA-recognized labs/CBs
• Ongoing verification testing (5-20% models annually)
• Brand governance (mark usage rules) Built on voluntary partnership model; certification renewable annually for buildings.

Why Organizations Use It

• Massive savings (5T kWh, $500B costs avoided since 1992)
• Incentives/rebates, procurement advantages
• Aligns with benchmarking laws
• Builds reputation (90% consumer recognition)
• Reduces risks, enhances ESG.

Implementation Overview

Phased: assess/gap analysis, test/certify, deploy, monitor/verify. Suits manufacturers, owners across sizes/industries, U.S.-focused. Involves Portfolio Manager benchmarking, lab testing, third-party audits.