What It Is

Cybersecurity Maturity Model Certification (CMMC) 2.0 is a DoD certification framework verifying cybersecurity practices for the Defense Industrial Base (DIB). It protects Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) via three cumulative levels: Level 1 (basic FCI safeguards), Level 2 (NIST SP 800-171 for CUI), and Level 3 (NIST SP 800-172 enhancements against APTs). Risk-based scoping to enclaves or enterprise drives implementation.

Key Components

• 14 domains (e.g., Access Control, Incident Response) with 17 Level 1, 110 Level 2, and 134 Level 3 practices.
• Built on FAR 52.204-21, NIST SP 800-171 Rev 2, and NIST SP 800-172.
• Certification via self-assessment (Level 1/2), C3PAO (Level 2), or DIBCAC (Level 3), reported to SPRS/eMASS; limited POA&Ms (180 days).

Why Organizations Use It

Mandated for DoD contracts, ensuring eligibility and flow-down compliance. Reduces breach risks, enhances resilience, and provides competitive bidding advantage. Builds supply-chain trust and operational maturity.

Implementation Overview

Phased: scoping, gap analysis, remediation, assessment, sustainment. Targets DIB contractors/subcontractors; complex for SMEs via enclaves. Requires SSP, evidence artifacts, annual affirmations (12 months typical).

What It Is

ISO 31000:2018, Risk management — Guidelines is an international standard providing non-certifiable guidance for enterprise-wide risk management. Its primary purpose is to help organizations systematically manage uncertainty affecting objectives, applicable to any size, sector, or type. It uses a principles-based, iterative approach emphasizing leadership integration and value creation/protection.

Key Components

• **Three pillars8 principles (e.g., integrated, customized, dynamic), framework (leadership, design, implementation, evaluation, improvement), and process (communication, scope/context/criteria, assessment, treatment, monitoring/review, recording/reporting).
• No fixed controls; flexible, PDCA-aligned structure.
• Non-certifiable guidelines, not requirements.

Why Organizations Use It

• Enhances decision-making, resilience, and opportunity capture.
• Builds stakeholder trust, supports governance.
• Strategic benefits: better resource allocation, reduced losses.
• No legal mandate but aligns with regulations, boosts reputation.

Implementation Overview

• Phased: leadership alignment, gap analysis, pilot, rollout, monitoring.
• Involves policy, training, tools, culture change.
• Universal applicability; no certification, internal audits suffice. (178 words)