What It Is

Cybersecurity Maturity Model Certification (CMMC) 2.0 is a DoD certification framework verifying cybersecurity practices in the Defense Industrial Base (DIB). It protects Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) via three cumulative levels: Level 1 (basic FCI safeguards), Level 2 (NIST SP 800-171 for CUI), and Level 3 (NIST SP 800-172 enhancements against APTs). Employs a tiered, evidence-based assessment methodology.

Key Components

• 14 domains (e.g., Access Control, Incident Response) with 17 Level 1, 110 Level 2, and 134 Level 3 practices.
• Built on FAR 52.204-21, NIST SP 800-171 Rev 2, and NIST SP 800-172.
• Certification model: self-assessments (Level 1/2), C3PAO (Level 2), DIBCAC (Level 3); 3-year validity with annual affirmations in SPRS/eMASS.

Why Organizations Use It

Mandated for DoD contractors/subcontractors handling FCI/CUI; ensures contract eligibility, reduces supply chain risks, enhances resilience, and provides competitive edge in bids. Builds stakeholder trust via verified maturity.

Implementation Overview

Phased approach: scoping, gap analysis, remediation, assessment preparation, certification, sustainment. Applies to all DIB sizes; requires SSPs, POA&Ms (180-day limits), continuous monitoring. Involves C3PAO/DIBCAC audits for higher levels.

What It Is

PMBOK® Guide (Project Management Body of Knowledge), published by the Project Management Institute (PMI), is a global standard and framework for project management. It provides principles, performance domains, and processes to deliver value across industries, emphasizing tailoring for predictive, agile, or hybrid approaches.

Key Components

• 12 principles (e.g., stewardship, value focus) and 8 performance domains (e.g., governance, stakeholders, risk) in recent editions.
• Legacy: 5 Process Groups and 10 Knowledge Areas with ~49 processes defined by ITTOs (Inputs, Tools & Techniques, Outputs).
• Tailoring models, artifacts, and models/methods; supports certifications like PMP®.

Why Organizations Use It

• Drives predictability, reduces overruns via standardized governance.
• Meets contractual, audit needs; enhances risk control and stakeholder trust.
• Boosts performance (3x higher in high performers per PMI research); enables competitive differentiation.

Implementation Overview

• Phased: assessment, tailoring, pilots, rollout, audits.
• Involves training, PMO setup, tools; suits all sizes/industries globally.
• No mandatory certification but aligns with voluntary PMP.