The Comprehensive Guide to CMMC 2.0 Compliance
Applicable to all DoD contractors and subcontractors, CMMC is a set of standards that have evolved from its initial release in January 2020 (Version 1.0) to the more refined CMMC 2.0 in November 2021.
Dive into this CMMC 2.0 guide to understand exactly what CMMC compliance entails and the three CMMC different levels, the key requirements to get CMMC certified, and learn some practical steps and best tools for running CMMC assessments and passing audits with ease.
What is the CMMC Framework?
Initiated by the U.S. government, the Cybersecurity Maturity Model Certification (CMMC), is a crucial framework for organizations seeking contracts with the Department of Defense (DoD).
Introduced in early 2020, and evolving into CMMC 2.0 in November 2021, this framework creates a structured approach to enhancing data security in defense contracting.
CMMC 2.0 reduces the original five levels to three, aligning closely with NIST standards for managing Controlled Unclassified Information (CUI). This comprehensive framework extends beyond mere compliance; it's a strategic commitment to safeguarding sensitive information in line with the Defense Federal Acquisition Regulation Supplement (DFARS) requirements.
Whether you handle CUI or Federal Contract Information (FCI), adhering to CMMC standards is essential. At its core, the framework signifies a unified, accountable approach, ensuring all contractors and subcontractors meet the high-security standards expected in DoD contracts both when bidding and renewing their agreements.
It’s important to note that CMMC isn’t a one-and-done deal. It's a living, breathing framework that evolves with emerging threats and tech advancements.
So, strap in and get ready to dive deep into the world of cybersecurity maturity with CMMC. You’ll learn everything there is to know about this essential framework and you’ll understand exactly who needs to achieve compliance and the most streamlined way to do it.
Who Needs to Get CMMC Certified?
In the ever-evolving landscape of digital security, understanding who must achieve cybersecurity readiness is essential. If you're in the business of providing goods or services to the Department of Defense (DoD), then being CMMC certified isn’t just a nice-to-have; it’s a must-have.
The Scope of CMMC Certification
- Direct DoD Contractors: If your organization is directly involved in bidding on or renewing DoD contracts, then you need to get a CMMC certification. This includes a wide array of companies, from those offering physical products to software and service providers.
- Subcontractors for DoD Contractors: Are you a cog in the larger DoD contracting machine? Subcontractors working with primary DoD contractors also fall under the umbrella of needing CMMC certification. This ensures a secure supply chain, which is crucial in defense contexts.
- Compliance with DFARS and NIST Standards: If your organization needs to comply with DFARS 252-7012 and NIST 800-171, CMMC certification is your pathway to ensuring you meet these requirements.
- Security Providers and Assessors: It’s also essential to check if your information security provider is an approved CMMC independent assessor, as this can impact your path to certification.
Future Impact of CMMC 2.0
- Rising Standards: When CMMC 2.0 is fully implemented, all contractors working with the DoD will have to meet at least CMMC Level 2 to be eligible for new contracts. If you were previously at Level 1, it's time to level up your cybersecurity game.
- Estimated Impact: The DoD recently estimated that around 76,000 companies, including over 56,000 small businesses, would need to acquire CMMC Level 2 certification.
- Inclusion in RFPs and Contracts: CMMC requirements are expected to be integrated into RFPs and subsequent contracts, making CMMC 2.0 compliance a prerequisite for any company looking to engage with the DoD.
So, whether you’re a main contractor or a subcontractor, if your work orbits around the DoD, the CMMC certification is your ticket to not just compliance, but to contributing to a more secure defense ecosystem and a guarantee for your organization's continued eligibility for defense contracts.
At the very least, a Level 1 certification is essential, but with evolving regulations, aiming for Level 2 might soon become the new standard.
With CMMC 2.0 rulemaking nearing completion, these requirements will soon be a concrete part of the contracting process so it's crucial for all concerned parties to stay informed and prepared for these changes.
CMMC 2.0 Certification Timeline
The journey towards getting a CMMC certification has seen its share of shifts and adjustments. If you’re an organization seeking compliance, you must understand this evolving timeline.
Here is an overview of the main events since the CMMC program was first launched.
The DoD first unveiled the CMMC program in June 2019, with CMMC 1.0 released in February 2020. After receiving over 850 comments on its interim rule, the DoD restructured the program into CMMC 2.0 in November 2021.
The CMMC rule is expected to be reviewed and published by the end of 2023. Following this, a 60-day public comment period is projected to start.
The finalization of the CMMC rule and its appearance in DoD contracts is anticipated between February and April 2025, depending on whether it's an interim final rule or a proposed rule.
The DoD plans a phased approach for CMMC requirements in solicitations. Initially, offerors will conduct a self-assessment and provide a positive affirmation of compliance. The subsequent phase, which requires either self-assessments or third-party certifications, will be dependent on the CUI type and certification level.
Third-party CMMC certifications, necessary for some Level 2 and all Level 3 programs, will be valid for three years. However, contractors are required to annually affirm their compliance. The CMMC certificates and assessment data will be stored in the CMMC Enterprise Mission Assurance Support Services (eMASS) database and posted to the Supplier Performance Risk System (SPRS).
Self-assessments, required annually for Level 1 and some Level 2 programs, must be affirmed by a senior company official. For Level 1, the results and annual affirmation must be submitted via SPRS, necessitating companies to create an account and access the platform if they haven't already.
During this transitional period, DoD encourages organizations in the Defense Industrial Base (DIB) sector to enhance their cybersecurity posture. Some organizations may find it helpful to conduct a self-assessment against NIST 800-171 to identify gaps and begin making plans to address them.
Staying updated on these timelines and requirements is crucial for any organization looking to engage in DoD contracts under the CMMC 2.0 framework. The focus should be on continuous improvement and readiness for when these requirements become a mandatory part of contract awards.
CMMC Levels: Understanding the Different Levels of CMMC Maturity
The CMMC framework, especially in its 2.0 iteration, is designed to bolster the cybersecurity infrastructure of entities working with the Department of Defense (DoD). Understanding the various levels of this framework and how they compare to the levels of the 1.0 version is essential for CMMC compliance and, ultimately, for maintaining or obtaining DoD contracts.
This revisited framework signifies an evolution from its predecessor, simplifying the structure from five levels to three. This streamlining aligns with well-known NIST cybersecurity standards, aiming to make the compliance process more accessible and manageable for organizations of various sizes and capacities. As cybersecurity threats evolve, so too do the requirements and expectations within the CMMC framework.
CMMC Level 1: Foundational Cyber Hygiene
CMMC 2.0 retains the foundational level of CMMC 1.0, which covers basic cyber hygiene practices. This level focuses on safeguarding Federal Contract Information (FCI) and involves 17 security controls. It's essential for entities that may not handle Controlled Unclassified Information (CUI) but still require a basic level of cybersecurity awareness and implementation.
This level requires an annual self-assessment.
CMMC Level 2: Advanced Cyber Hygiene
This level is a significant step up, requiring organizations to document and perform processes to guide and achieve CMMC Level 2 maturity. Previously corresponding to Level 3 in CMMC 1.0, it includes all 14 domains and 110 security controls from NIST 800-171, sans the 20 Level 3 practices and processes unique to CMMC 1.02.
Assessment requirements for compliance vary based on the criticality of the CUI data to national security but in general, it needs to be assessed by an authorized third party every three years.
This level is aimed at DoD contractors and subcontractors handling CUI.
Level 3: Expert Cyber Hygiene
At this apex level, the focus is on mitigating advanced persistent threats (APTs).
Organizations must establish, maintain, and resource a plan managing the activities for implementing their cybersecurity practices.
The practices at this level are good cyber hygiene practices, encompassing all security requirements from NIST SP 800-171 and an additional subset of NIST SP 800-172 controls. It's intended for companies dealing with CUI for high-priority DoD programs.
Each level of CMMC maturity caters to different types of information and threats, with escalating requirements for documentation, process implementation, and security control. Understanding where your organization fits within these levels is crucial for ensuring compliance, securing DoD contracts, and contributing to a robust national cybersecurity infrastructure.
Want to accelerate your CMMC compliance process?
With Apptega’s CMMC compliance software, you can use streamlined questionnaires, integrations to your sources of truth, and framework crosswalking to run through CMMC assessments and audits like a breeze.
The Role of Third-Party Assessment Organizations in CMMC
Navigating the waters of CMMC certification can be complex, but third-party assessment organizations (C3PAOs) are the lighthouses guiding companies through this process. Overseen by the DoD’s Accreditation Body (CMMC-AB) since 2020, CMMC C3PAOs are pivotal in assessing and reporting a company's cybersecurity maturity, helping them become CMMC compliant and improve their overall cybersecurity posture.
Eligibility and Process of C3PAOs
To become a C3PAO, an organization must undergo a rigorous vetting and accreditation process by the CMMC-AB. This process ensures that the organization has the necessary competence and integrity to conduct CMMC assessments.
While there is no specific requirement for being a Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) or an ISO accredited body, C3PAOs are expected to have qualified personnel such as CMMC-AB Certified Assessors (CAs) and Certified Professionals (CPs). These individuals must have in-depth knowledge of the CMMC standards and the capability to perform effective assessments.
The Role of C3PAOs in CMMC Compliance
C3PAOs are essential in helping organizations identify gaps in their cybersecurity practices and develop plans to address these issues. Their assessments provide an objective evaluation of a company's cybersecurity posture, ensuring that it aligns with the CMMC requirements.
By engaging with a C3PAO, organizations can gain access to expert advice on cybersecurity tools, techniques, and best practices, thereby enhancing their overall security infrastructure and managing risk more effectively.
The Impact of C3PAOs on CMMC Compliance
Collaborating with a C3PAO can significantly benefit organizations aiming for CMMC compliance. These experts in cybersecurity bring a wealth of experience and knowledge, assisting in the efficient implementation of CMMC requirements.
Utilizing the services of a C3PAO not only helps in achieving compliance but also demonstrates a strong commitment to maintaining a robust cybersecurity posture. This dedication can increase trust among customers and partners, potentially leading to new business opportunities and improved reputational standing. Additionally, if a C3PAO utilizes modern cybersecurity compliance software like Apptega, you’ll ensure not only an ongoing compliance with CMMC, but also a fast and efficient process in doing so.
In summary, C3PAOs are integral to the CMMC ecosystem, providing expertise and support critical for organizations navigating the complexities of CMMC certification and compliance. Their involvement ensures that companies are not just compliant but also equipped to face the evolving challenges in cybersecurity.
How to Fast-Track CMMC Assessments
Starting the process to get your CMMC certification can be challenging endeavor, but with the right tools and strategies, you can make your life much easier.
If you’re getting ready for a CMMC assessment, the first things you may be considering are the process costs and timeline.
Regarding costs, they will vary based on your CMMC certification level and other factors such as the complexity of the work you do and your contractual obligations. While CMMC 1.0 did not allow self-assessments for CMMC certification, CMMC 2.0 permits self-assessments for level 1 certification, and in some instances for level 2.
When it comes to the time it takes to complete an assessment, there are multiple things that can accelerate or slow down your process, such as whether you work with a MSSP or not, whether you or your MSSP are leveraging existing cybersecurity compliance software to streamline the process or not, etc.
Apptega’s cybersecurity and compliance software offers an efficient and cost-effective way to fast-track CMMC assessments. Let’s go over what a CMMC assessment can look like with Apptega.
Leveraging Apptega for Streamlined CMMC Compliance
With the CMMC framework evolving and the imminent application of CMMC regulations, a tool like Apptega can be an invaluable resource for DoD contractors and security service providers working with them.
The platform's capabilities are tailored to simplify and accelerate the CMMC certification process, ensuring compliance with minimal overhead.
Key Apptega Features for Efficient CMMC Assessments
- Customizable Assessment Templates: Apptega provides questionnaire-based templates for each CMMC level, which can be easily tailored to meet the specific needs of your organization or clients.
- Collaboration and Integrations: With collaboration options and out-of-the-box integrations with your tech stack, Apptega allows multiple users to concurrently update their respective sections and makes evidence collection and task management fast and simple.
- Automated Reports and Remediation Plans: The platform generates automated reports, including Plans of Action and Milestones (POA&Ms) and System Security Plans (SSPs). This automation streamlines the process of identifying compliance gaps and formulating effective remediation strategies.
- Continuous Compliance Management: Beyond initial assessments, Apptega has all the tools you need to build your program for ongoing compliance management. The Assessment Manager tool evaluates compliance and audit-readiness, identifying gaps and producing status reports. These assessments can be used stand-alone or integrated into a broader cybersecurity program for continuous remediation and reporting.
CMMC assessments can be fast and affordable the right approach and tools. Apptega’s specialized features offer a pathway to simplify and expedite the CMMC certification process, making it more less burdensome for organizations and MSSPs of all sizes.
For a detailed explanation on how DoD contractors and CMMC RPOs are using Apptega to streamline CMMC assessments, watch this 5-minute demo video:
The Definitive CMMC Compliance Checklist
One way to make your CMMC compliance journey less overwhelming is by having a streamlined CMMC checklist with all the steps you need to take to achieve compliance. Creating such a list is a time-consuming task, so we’ve done all the heavy-lifting for you.
Here are the 11 steps you need to follow to get your CMMC certification:
(Note: At the bottom of the section, you’ll find a link to download this checklist, so you can print it and hang it on your fridge to make sure you don’t miss a thing.)
1. Understand your CMMC Requirements
Before you kick off your CMMC assessment process for yourself or a client, understand the existing contract with the DoD to determine which of the three levels apply.
Remember that the controlled unclassified information (CUI) an organization processes, transmits, or stores affects your requirements and the investments necessary to protect that information. Prime Contractors are not only required to follow CMMC but also to ensure their subcontractors adhere to protocol. Subcontractors, on the other hand, must follow any requirements dictated by their Prime.
2. Assign Roles and Responsibilities
Whether you’re an MSSP handling CMMC compliance for a company or you’re starting the process internally, having a main point of contact who owns the project is key for success.
That person would be responsible for partnering with internal stakeholders (IT professionals, HR, legal and financial personnel, and anyone handling DoD data) to collect evidence and manage any tasks that may be necessary. They’ll also need to gather all the resources and policies to bring the project to live.
If you’re an MSSP, it will be your role to work with that person on a gap analysis to understand where your customer is and a roadmap to help meet their goals.
3. Map All CUI
Do you know where and how CUI is being used, shared, and stored? If only a certain part of the organization handles CUI, you may be able to take an enclave approach.
Note that the size of your enclave can determine the cost and complexity of achieving CMMC compliance. The fewer endpoints you need to secure and the fewer people you need to train on CMMC compliance protocols, the better. As a starting point, make sure you limit access to CUI to those team members who really need it by the nature of their work.
4. Run a CMMC Gap Analysis
If you haven’t already, you can greatly accelerate your process by working with a CMMC RPO to help you run a CMMC assessment and help remediate any outstanding gaps.
Either you or your third party should also leverage compliance automation software like Apptega to easily breeze through simplified templates to assess compliance with the CMMC framework and automate the collection of evidence.
A tool like this will also allow you to get real-time visibility and control of your CMMC compliance assessment process with intuitive reports and dashboards.
Lastly, if you need to bring in an accredited C3PAO for audits, your process will be ultra-streamlined after the initial assessment as you’ll be able to link existing relevant evidence to your audit and easily collect anything that’s missing.
5. Create a System Security Plan (SSP)
Outline your strategy for staying within CMMC compliance and update it regularly.
This document will explain how you meet the 110 NIST 800-171 controls through policies, procedures and training. It will be used as a way to map your compliance journey for both the assessor and yourself.
6. Create a Plan of Action and Milestones (POA&M)
Your gap analysis has likely uncovered some controls that you’re not meeting. Document corrective steps for any compliance gaps, laying out the technologies or processes that you’ll need to use to remediate those gaps and your remediation timeline.
7. Prepare for Your CMMC Assessment
Ensure all relevant documentation is ready and compliance gaps are addressed
8. Conduct a CMMC Assessment
Be prepared for an audit by a C3PAO, where the auditor will request evidence for each CMMC requirement and may conduct interviews with key personnel responsible for implementing and maintaining specific controls.
If you didn’t do so at the beginning of the process, now it’s a great time to assign a primary point of contact for the 3PAO's requests, who will manage other employees in gathering necessary evidence. This role ensures minimal delays and efficient coordination during the audit process.
Auditors often check the type of data across all systems, assess overall cybersecurity posture, and verify that controls are operating effectively. When you or your security provider work with security compliance technology that automates audits, this process can be done much more efficiently.
9. Receive Your CMMC Report
Once the audit is over, the C3PAO will create a report detailing their findings. If you pass the CMMC audit, you’ll get a certification that will be valid for three years.
If you fail, the report will explain the reasons for non-compliance but won't provide specific remediation steps.
10. Implement Remediations
In case of failing your CMMC audit, you can rectify non-compliance issues within a 90-day period before reapplying for certification.
However, your goal should be to resolve potential issues even before the assessment, as the 90-day timeframe can be challenging for implementing new cybersecurity protocols
11. Watch for CMMC Updates
The CMMC framework is a living rule, subject to constant updates and changes, as seen with the evolution from CMMC 1.0 to 2.0. Therefore, it’s good practice to regularly monitor for updates in CMMC standards and requirements to ensure ongoing compliance.
How to Handle CMMC Compliance and Audits with the Right Tools
Using CMMC compliance tools like Apptega plays a pivotal role in achieving and maintaining CMMC compliance. The effectiveness of this kind of software lies in its ability to streamline and automate key aspects of the compliance process. The capabilities that make Apptega particularly valuable for organizations aiming to comply with CMMC standards — or the security providers helping them in doing so — include:
Centralized Risk Management: Apptega offers a consolidated view of an organization's security posture as it relates to CMMC or any other frameworks. This centralized dashboard is crucial for quick identification and management of risks, making it easier to demonstrate compliance to auditors and regulatory bodies.
Automated Compliance Monitoring: The platform allows for an ongoing monitoring of an organization's compliance status, so teams can quickly spot areas of non-compliance and act fast. This is essential for maintaining consistent adherence to CMMC standards.
Customizable CMMC Compliance Roadmap: Apptega allows organizations to develop tailored compliance roadmaps for frameworks like CMMC. These roadmaps are crucial for planning and tracking the steps required to achieve and maintain compliance, especially for organizations at different levels of CMMC maturity.
Enhanced Audit Readiness: With Apptega as your CMMC tool, you can maintain continual audit readiness. The platform ensures that all CMMC compliance-related documents and evidence are organized, up-to-date, and easily accessible, simplifying the audit process.
In summary, Apptega isn’t only a great partner in achieving CMMC compliance but also contributes to a stronger cybersecurity framework overall. Its features are designed to ensure that security providers and organizations can easily navigate the complexities of compliance, stay ahead of potential risks, and consistently meet DoD requirements.
This comprehensive approach not only makes compliance faster and more affordable but also fortifies the overall cybersecurity defense of any organization.
CMMC FAQs
A consultant certified by the CMMC-AB is required when a defense contractor must achieve a certain CMMC level for a Department of Defense contract and lacks the in-house expertise to assess, implement, and maintain the necessary cybersecurity practices and controls.
CMMC compliance involves meeting the Cybersecurity Maturity Model Certification standards, a set of cybersecurity requirements for defense contractors to protect sensitive defense information.
The Department of Defense issues CMMC guidelines. Additionally, an independent, nonprofit organization known as the CMMC Accreditation Body was established in early 2020.CMMC-AB establishes and oversees a community of assessors that deliver assessments to participating organizations against a defined set of controls/best practices within the Cybersecurity Maturity Model Certification (CMMC) Program. In support of DoD contractors seeking certification, CMMC-AB established accreditation processes for Registered Practitioners (RPs), Registered Provider Organizations (RPOs), Certified Assessors (CAs), and Certified Third-Party Assessment Organizations (C3PAOs).
The cost of CMMC Certification varies widely based on the company size, complexity, and required CMMC level, often ranging from a few thousand to several hundred thousand dollars. Using cybersecurity compliance software like Apptega is a great way to save costs — and time — in the process of getting CMMC certified.
The Department of Defense issues CMMC guidelines. Additionally, an independent, nonprofit organization known as the CMMC Accreditation Body was established in early 2020.CMMC-AB establishes and oversees a community of assessors that deliver assessments to participating organizations against a defined set of controls/best practices within the Cybersecurity Maturity Model Certification (CMMC) Program. In support of DoD contractors seeking certification, CMMC-AB established accreditation processes for Registered Practitioners (RPs), Registered Provider Organizations (RPOs), Certified Assessors (CAs), and Certified Third-Party Assessment Organizations (C3PAOs).
An organization, typically a DoD contractor, goes through a CMMC assessment certification process to receive a formal certification.
A Registered Practitioner (RP) provides assistance services to DoD contractors, conducting readiness assessments and preparing for the certification process. RPs are not permitted to conduct CMMC certification assessments.
An organization authorized to represent itself is familiar with the basic constructs of the CMMC Standard, to deliver non-certified CMMC consulting services. These services are intended to assist DoD contractors to conduct readiness assessments and prepare for the certification process. The RPO designation signifies that the organization has agreed to the CMMC-AB Code of Professional Conduct. An RPO must have at least one Registered Provider on staff.
An individual who has completed the background, training, and examination requirements as outlined by the CMMC-AB (at one of 3 levels) and to whom a certification has been issued. Assessors are not CMMC-AB employees.
An organization that is certified to conduct CMMC certification assessments of DoD contractors and provide consultative advice.
DoD contractors and subcontractors have been required to adhere to NIST 800-171 standards since 2018; however, there has not been a unified set of standards to ensure organizations meet those requirements. To unify accountability, the government created the Cybersecurity Maturity Model Certification (CMMC) program with the intent to include CMMC as part of the Defense Federal Acquisition Regulation Supplement (DFARS) so it can be used as a part of contract awarding requirements. It covers a range of cyber hygiene practices from foundational to advanced and finally expert, and outlines requirements for how organizations should handle and protect CUI.
To become CMMC-certified, your organization must successfully meet the requirements outlined in CMMC 2.0. While the rule making processes for CMMC are underway, those details have not yet been finalized, so check back soon for updates. We do know, however, that for the first time, organizations will be able to self-assess at level 1 and in some circumstances at level 2. Other parts of level 2 and level 3 will require certification from either a third-party certified assessor or the government. CMMC assessor-based certifications are valid for three years. The results of your CMMC assessment are not released to the public, nor is your CMMC certification level.
All contractors and subcontractors bidding on new contracts or contract renewals are subject to CMMC compliance. If you work with contractors and/or subcontractors for related DoD contract work, those contractors and subcontractors must also be CMMC-certified.
If your organization is not CMMC 2.0 certified at the level outlined in future RFI or RFPs, you may be disqualified from participating in that contract.
The three levels of CMMC 2.0 certification Level 1: Foundational, which includes 17 practices and enables an annual self-assessment for certification; Level 2: Advanced, which includes 110 practices and requires a third-party assessment for prioritized acquisitions every three years and self-assessment for non-prioritized acquisitions; and Level 3: Expert, which includes more than 110 practices and requires a government-led assessment every three years.
CUI stands for Controlled Unclassified Information. CUI encompasses protected but unclassified information that requires additional safeguarding, security, and dissemination controls.
FCI is federal contract information. FCI can include a range of information, for example, emails between DoD and contractors, policies and subcontracts, and other information shared through various communication channels.
The most current version of CMMC is version 2.0, which was released in November 2021.
Yes. There is a CMMC compliance framework and it is available in the Apptega cybersecurity and compliance management platform. With the platform, you can map the CMMC framework to other frameworks, such as NIST 800-171.
With CMMC 2.0, a third-party or government-led certification should last three years, whereas self-assessments for level 1 should be annual.
CMMC certification draws on many best practices outlined by NIST 800-171; however, certification processes for the two are not the same, and being compliant for one does not guarantee that you are compliant for the other.
With a framework crosswalking feature like the one Apptega offers, you can achieve compliance for both frameworks much easily by consolidating assessment at the control level.
No. CMMC certification and NIST 800-171 compliance are not the same. However, the two frameworks are complementary and you can map your CMMC framework to NIST 800-171. CMMC draws on many standards outlined by NIST 800-171, but NIST 800-171 also includes non-federal organization (NFO) controls.
CMMC does not explicitly require GCC High, but it may be necessary for contractors handling Controlled Unclassified Information (CUI) to meet certain CMMC levels.
To become a CMMC Assessor, one must complete required training, pass an exam, and be certified by the CMMC Accreditation Body. You can find more detailed info on the website of the CMMC Accreditation Body.
Still have a question?
Get in touch with us and we would be happy to help.
Ready to get started?
Request a no-risk 14-day free trial to see how you can create a sticky compliance-as-a-service offering with Apptega.
Direct from the experts
Check out the latest news, resources and commentary from the Apptega team and a roster of veteran security and compliance professionals.
