How is CMMC 2.0 Different from CMMC 1.0

May 1, 2023 | Blog

STREAMLINED. FLEXIBLE. SECURE.

To safeguard sensitive national security information, the Department of Defense (DoD) launched CMMC 2.0, a comprehensive framework to protect the defense industrial base from increasingly frequent and complex cyberattacks.

With its streamlined requirements, CMMC 2.0:

History:- In September 2020, the DoD published an interim rule to the DFARS in the Federal Register (DFARS Case 2019-D041), which implemented the DoD’s initial vision for the CMMC program (“CMMC 1.0”) and outlined the basic features of the framework (tiered model, required assessments, and implementation through contracts). The interim rule became effective on November 30, 2020, establishing a five-year phase-in period.

In March 2021, the Department initiated an internal review of CMMC’s implementation, informed by more than 850 public comments in response to the interim DFARS rule. This comprehensive, programmatic assessment engaged cybersecurity and acquisition leaders within DoD to refine policy and program implementation.

In November 2021, the Department announced “CMMC 2.0,” an updated program structure and requirements designed to achieve the primary goals of the internal review:

  • Safeguard sensitive information to enable and protect the warfighter
  • Dynamically enhance DIB cybersecurity to meet evolving threats
  • Ensure accountability while minimizing barriers to compliance with DoD requirements
  • Contribute towards instilling a collaborative culture of cybersecurity and cyber resilience
  • Maintain public trust through high professional and ethical standards

1) Streamlined Model:-

  • Focused on the most critical requirements:
  • Streamlines the model from 5 to 3 compliance levels
  • Aligned with widely accepted standards: Uses National Institute of Standards and Technology (NIST) cybersecurity standards

2) Reliable Assessments

  • Reduced assessment costs: Allows all companies at Level 1 (Foundational), and a subset of companies at Level 2 (Advanced) to demonstrate compliance through self-assessment
  • Higher accountability: Increases oversight of professional and ethical standards of third-party assessors

3) Flexible Implementation

  • Spirit of collaboration: Allows companies, under certain limited circumstances, to make Plans of Action & Milestones (POA&Ms) to achieve certification
  • Added flexibility and speed: Allows waivers to CMMC requirements under certain limited circumstances

So When do the Changes take effect?

The changes reflected in CMMC 2.0 will be implemented through the rulemaking process. Companies will be required to comply once the forthcoming rules go into effect. The Department intends to pursue rulemaking both in Part 32 of the Code of Federal Regulations (C.F.R.) as well as in the Defense Federal Acquisition Regulation Supplement (DFARS) in Part 48 of the C.F.R. Both rules will have a public comment period. Stakeholder input is critical to meeting the objectives of the CMMC program, and the Department will actively seek opportunities to engage stakeholders as it drives towards full implementation.

While these rulemaking efforts are ongoing, the Department intends to suspend the current CMMC Piloting efforts and will not approve inclusion of a CMMC requirement in any DoD solicitation.

The DoD is exploring opportunities to provide incentives for contractors who voluntarily obtain a CMMC certification in the interim period. Additional information will be provided as it becomes available.

Action you can take

We are also launching a pre-assessment readiness tool to help get you started. Reach out to us at 301-576-1122 or https://cmmcassessmentreadiness.com/ to learn more.

You can also schedule a 15-minutes CMMC consultation with our cybersecurity solution specialist with the link below
https://calendly.com/femidada1

FREE IT Optimization Plan

Are you completely fed up with chronic computer problems and escalating IT costs? Do you worry that your backups and IT security are lacking? Do you have a sneaking suspicion that your current IT guy doesn’t have a handle on things? Our free IT optimization plan will reveal gaps and oversights in your computer network and show you how to eliminate all your IT problems and never pay for unnecessary IT expenses again.

Complete this form below to get started. We will contact you to discuss next steps to getting your free IT Optimization Plan.

OTHER RELATED ARTICLES

What Is Bad IT Support Costing Your Business?

What Is Bad IT Support Costing Your Business?

In our technology-driven world, efficient IT support is not just a convenience—it’s a necessity for any successful business. Reliable IT services ensure seamless operations and protect sensitive data, ultimately safeguarding your productivity and bottom line. However, not all IT support is created equal. Settling for subpar services can have severe financial consequences, affecting everything from employee productivity to customer satisfaction. In this blog post, we delve into the hidden costs of inadequate IT support, including unresolved issues that can escalate into expensive security breaches, inefficient processes that waste time and money, and unexpected downtime that halts business operations and impacts your profits. We’ll also discuss how sloppy systems can open your business to significant security risks. Understanding these risks is crucial for any business owner committed to maintaining operational efficiency and protecting their company’s future.

Suspect Your Computer Has Been Hacked? Do These 5 Things Now!

Suspect Your Computer Has Been Hacked? Do These 5 Things Now!

“If you suspect your computer has been hacked, immediate action is key to safeguarding your data and privacy. This article outlines five crucial steps you must take right away to mitigate the damage and protect your digital life. From changing your passwords to isolating your network, these measures are essential for anyone facing potential cyber threats. Don’t wait until it’s too late—learn what to do if you think your computer’s security has been compromised.”