What It Is

Cybersecurity Maturity Model Certification (CMMC) is a DoD certification program verifying cybersecurity protections for Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) in the Defense Industrial Base (DIB). It uses a tiered, risk-based model with three cumulative levels drawn from FAR 52.204-21, NIST SP 800-171 Rev 2 (110 controls), and NIST SP 800-172 (24 enhanced) across 14 domains like Access Control and Incident Response.

Key Components

• **Level 115-17 basic FCI safeguards, annual self-assessments.
• **Level 2110 CUI controls, self or C3PAO assessments every 3 years.
• **Level 3Adds 24 APT defenses, DIBCAC assessments post-Level 2. Built on NIST frameworks with POA&Ms limited to 180 days, reported via SPRS/eMASS.

Why Organizations Use It

Mandated by DoD contracts via DFARS flow-down, it ensures eligibility, reduces breach risks ($57B+ annual losses), builds supply chain trust, and provides competitive edges like resilient operations and lower insurance.

Implementation Overview

Phased approach: scope enclaves, gap analysis, remediate controls, assess, sustain via monitoring. Targets DIB contractors (300K+ firms, SMEs to primes); requires SSP, evidence artifacts, annual affirmations. Typical for US defense sector.

What It Is

REACH (Regulation (EC) No 1907/2006) is a directly applicable EU regulation on the Registration, Evaluation, Authorisation and Restriction of Chemicals. Its primary purpose is to ensure a high level of protection for human health and the environment from chemical risks while promoting innovation. It shifts responsibility to industry for generating and managing chemical safety data across the supply chain.

Key Components

• Four core pillars: Registration (>1 tonne/year), Evaluation (dossier checks, substance scrutiny), Authorisation (SVHCs on Annex XIV), Restriction (Annex XVII bans/limits).
• 17 technical annexes defining data requirements, SDS rules, exemptions.
• Built on risk-based assessments, tonnage bands, and supply-chain communication.
• No certification; compliance via ECHA dossier submissions and national enforcement.

Why Organizations Use It

• Mandatory for EU market access (manufacturers/importers).
• Mitigates fines, market bans, recalls; enables substitution and ESG alignment.
• Builds supply-chain transparency, reduces risks, enhances competitiveness.

Implementation Overview

• Phased: gap analysis, substance inventory, dossiers/CSRs, monitoring.
• Applies to chemicals/mixtures/articles sectors EU-wide; cross-functional effort.
• Continuous via ECHA tools; national audits enforce 'effective, proportionate, dissuasive' penalties. (178 words)