The goal of Cybersecurity Maturity Model Certification (CMMC) program is to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) that is shared with and handled by the DoD contractors and subcontractors. DoD first announced the CMMC program in June 2019, released version 1.0 of the CMMC model document in February 2020, and published an interim rule in September 2020. In response to the 850+ comments it received on the interim rule, DoD restructured the program into “CMMC 2.0” in November 2021. The picture below depicts both the CMMC 1.0 and 2.0 model.
The current schedule would have the CMMC 2.0 proposed rule released in 2023 and become effective in 2024. However DoD has issued a memo in July 2022 emphasizing to Contracting Officers the need to enforce DFARS 252.204.7012 which requires defense contractors to implement NIST SP 800-171, an intensive cybersecurity requirement. In addition, we are seeing interest from Primes requiring SPRS score (a form of NIST SP 800-171 assessment) when selecting SMB partners for their projects. Thus while the CMMC certification requirement is a year away, the compliance requirement is already here. Most SMB are unprepared and risk losing their award. They also have very limited budget and staff time to achieve compliance.
Majority of the DIB SMB will require Level 2 certification with 110 cybersecurity control requirements aligned with NIST SP 800-171. This is an onerous undertaking for a SMB that requires professional help and time. Organizations seeking certification are well advised to start as soon as possible.
We at CMMC ICU have specifically designed a solution for DIB SMB. It could be quickly implemented at a disruptively low price. Our solution is money-back guaranteed. Please visit our solution page for more details.