What It Is

Cybersecurity Maturity Model Certification (CMMC) 2.0 is a DoD certification program verifying cybersecurity protections for Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) across the Defense Industrial Base (DIB). It employs a tiered, cumulative model with three levels, drawing from FAR 52.204-21, NIST SP 800-171 Rev 2, and NIST SP 800-172 for risk-aligned assurance.

Key Components

• **LevelsLevel 1 (17 basic FAR practices), Level 2 (110 NIST 800-171 controls), Level 3 (+24 NIST 800-172 enhancements).
• 14 domains (e.g., Access Control, Incident Response) with practices assessed via interview, examine, test.
• Built on NIST frameworks; certification valid 3 years with annual affirmations in SPRS/eMASS; limited POA&Ms (180-day closure).

Why Organizations Use It

• Mandatory for DoD contracts, ensuring eligibility and flow-down compliance.
• Mitigates IP theft, supply chain risks; boosts resilience, reduces incidents.
• Provides competitive edge, primes prefer certified subs; builds stakeholder trust.

Implementation Overview

• **PhasedGovernance, scoping/gaps, remediation, assessment (self/C3PAO/DIBCAC), sustainment.
• Applies to all DIB firms handling FCI/CUI; enclave scoping aids SMEs.
• Key: SSP development, evidence collection; triennial audits for Levels 2/3.

What It Is

NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, is a U.S. government framework providing security requirements for safeguarding CUI confidentiality. It targets nonfederal entities like contractors, using a control-based approach tailored from NIST SP 800-53 Moderate baseline, focusing on systems processing, storing, or transmitting CUI.

Key Components

• 17 families in Rev 3 (97 requirements), expanded from 14 in Rev 2, including new areas like Planning (PL), Supply Chain Risk Management (SR).
• Core elements: SSP, POA&M, assessment procedures via SP 800-171A.
• Built on FIPS 200 and SP 800-53; supports tailoring and ODPs.
• Compliance via self-assessment or third-party (e.g., CMMC Level 2).

Why Organizations Use It

• Mandatory for federal contractors via DFARS 252.204-7012.
• Reduces breach risk, ensures contract eligibility, builds supply chain trust.
• Strategic benefits: market access, resilience, FedRAMP equivalence.

Implementation Overview

Phased: scoping CUI enclave, gap analysis, control deployment (MFA, SIEM), documentation. Applies to contractors handling CUI; audits via examine/interview/test. (178 words)