CMMC 2.0 Compliance Starts Here

Developed by the US Department of Defense, this unified standard ensures defense contractors are protecting sensitive government data from cyber threats. The program provides the Department with increased assurance that contractors (and subcontractors) are meeting the cybersecurity requirements that apply to acquisition programs and systems that process controlled unclassified information.

In 2021, the DoD announced CMMC 2.0, which included the following key updates:

• Tiered Model: CMMC 2.0 has three levels (replacing the previous five-tier system in CMMC 1.02). Each of the three tiers varies based on the level of certification needed, ranging from Level 1 (Foundational), Level 2 (Advanced), and Level 3 (Expert).
• Assessment Requirement: Assessments allow the DoD to verify the implementation of clear cybersecurity standards.
• Implementation through Contracts: Upon full implementation, Once CMMC is fully implemented, identified contractors who manage sensitive and unclassified information will be required to achieve a particular CMMC level (see above) as a condition of winning the contract.

There are three levels of certification for CMMC--Foundational, Advanced, and Expert--each requiring compliance with an increased number of security practices as outlined by NIST SP 800-171 and NIST SP 800-172. MSPs interested in achieving full CMMC compliance can use a gap assessment to identify discrepancies between their current security posture and what's necessary to meet DoD requirements. Once vulnerabilities are identified, MSPs can take the steps needed to close any gaps quickly and effectively.

Get Ready for Your CMMC Audit

CMMC 2.0 requires DoD contractors to receive an audit and certification from a third-party auditor if they have sensitive, unclassified information in their systems.

ControlMap's SaaS automation platform streamlines this process, providing visibility to key stakeholders throughout the audit. It's a win/win.