Cybersecurity Maturity Model Certification (CMMC)

The Cybersecurity Maturity Model Certification (CMMC) is a framework for assessing a contractor's information security protections. The CMMC program was developed to establish a consistent, comprehensive framework intended to enhance cybersecurity for the U.S. defense industrial base. The contractual requirements related to the CMMC program are incorporated into the Defense Federal Acquisition Regulation Supplement (DFARS) through this final rule.

Your business needs to comply with CMMC if it seeks to receive DoD contract awards that require a specific CMMC level. The CMMC requirements apply to contractor information systems that will process, store, or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).

Compliance is crucial because it serves to:

• Enhance Protection: Implement cybersecurity requirements to enhance the protection of unclassified information within the DoD supply chain.

• Ensure Eligibility: Contractors must have a current CMMC status at the required level (or higher) at the time of award to be eligible for a contract, task order, or delivery order.

• Verify Security: Provide increased assurance to the DoD that contractors can adequately protect sensitive unclassified information at a level commensurate with the risk.

• Support National Security: Secure contractor information systems against adversaries, protecting the Government’s information related to valuable defense technologies and helping the Defense Industrial Base (DIB) protect its own intellectual property.

The CMMC requirements are found across two main areas of federal regulation:

1. CMMC Program Policy: The CMMC program requirements, which detail the framework and technical standards, are codified at 32 CFR part 170.

2. Contractual Requirements: The Defense Federal Acquisition Regulation Supplement (DFARS) implements the contractual requirements.

This final rule amends 48 CFR Parts 204, 212, 217, and 252 to prescribe policies and procedures for including CMMC level requirements in DoD contracts.

The CMMC requirements apply to offerors and contractors whose unclassified contractor information systems will be used in the performance of the contract to process, store, or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).

The requirements apply to contracts, task orders, and delivery orders, including those using FAR part 12 procedures for commercial products and services.

Exclusion: The rule does not apply to awards solely for the acquisition of commercially available off-the-shelf (COTS) items, as defined at FAR 2.101.

Subcontractors: CMMC requirements must be flowed down to subcontractors and other contractual instruments if they will contain a requirement to process, store, or transmit FCI or CUI.

CMMC 2.0 has three levels, depending on how much sensitive information a company handles:

• Level 1: 15 security controls (FAR 52.204-21), self-assessment required annually along with an annual affirmation.

• Level 2: 110 security controls (NIST SP 800-171 r2). Requires an annual affirmation and either a C3PAO or self-assessment every three years, depending on the sensitivity of data handled in the contract. Organizations handling ‘prioritized CUI’ will require a C3PAO assessment, while those with ‘non-prioritized CUI’ may be eligible for self-assessment.

• Level 3: 134 security controls (110 from NIST 800-171 r2 and 24 from 800-172) requires a DIBCAC assessment every three years.

The CMMC 2.0 rule is now officially in effect, as published in Title 32 of the Code of Federal Regulations (32 CFR Part 170). The CMMC requirements are implemented using a phased approach over three years:

1. Phase 1 (Initial Three Years): Until November 9, 2028, the CMMC requirement will be included if the program office or requiring activity determines that the contractor is required to have a specific CMMC level.

2. Phase 2 (Starting Year Four): On or after November 10, 2028, the requirement will be included if the program office or requiring activity determines that the contractor will be required to use contractor information systems to process, store, or transmit FCI or CUI.

Regardless of the phase, compliance is required at the time of award.

The determination of the required assessment method is made by the program office or requiring activity and will be identified by the contracting officer in the solicitation using the specific CMMC level terminology.

• Self-Assessment: Required for CMMC Level 1 (Self). Self-assessment is permitted for CMMC Level 2 (Self), but specific categories of CUI may necessitate a C3PAO assessment. A self-assessment status (Final Level 1 or Final Level 2) must be renewed annually with an affirmation of continuous compliance.

• Third-Party or Government Assessment: Required for CMMC Level 2 (C3PAO) (Certified Third-Party Assessment Organization) and CMMC Level 3 (DIBCAC) (Defense Industrial Base Cybersecurity Assessment Center).

If a solicitation includes a CMMC requirement, failure to comply with that requirement results in ineligibility for award:

• Ineligibility for Award: Contracting officers shall not award a contract, task order, or delivery order if the offeror does not have a current CMMC status entered in the Supplier Performance Risk System (SPRS) at the level required by the solicitation (or higher).

• Contract Maintenance Failure: Contracting officers shall also not exercise an option or extend the period of performance on an existing contract unless the contractor has a current CMMC status in SPRS at the required level.

• Subcontractor Risk: Prior to awarding a subcontract, the prime contractor must ensure the subcontractor has a current CMMC certificate or status appropriate for the information being flowed down.

Preparation for CMMC compliance involves administrative and continuous compliance requirements:

1. Identify Information Systems: Determine the contractor information systems that will process, store, or transmit FCI or CUI during contract performance.

2. Complete Assessment: Conduct the required self-assessment or obtain a third-party assessment to meet the minimum required score for the CMMC level.

3. Use SPRS and CMMC UIDs:

    ◦ Enter the results of current self-assessments (Level 1 or Level 2) into the Supplier Performance Risk System (SPRS).

    ◦ Obtain a CMMC Unique Identifier (CMMC UID), which is assigned in SPRS/eMASS to each CMMC assessment scope.

    ◦ Provide the CMMC UID(s) to the contracting officer with the proposal.

4. Affirm Continuous Compliance: Ensure an affirming official (see 32 CFR 170.4) completes an affirmation of continuous compliance in SPRS annually.

5. Manage POA&Ms (if applicable): If achieving a Conditional CMMC Status (Levels 2 or 3), successfully close out a valid Plan of Action and Milestones (POA&M) within 180 days to achieve Final CMMC Status.

Navigating CMMC compliance can be confusing, but Natsar is here to guide you every step of the way. We provide:

• CMMC pre-assessments to help you prepare before bidding on contracts or applying for renewals on existing contracts

• Gap analysis and remediation planning to close security gaps

• Assistance with self-assessments to ensure you meet Level 1 or Level 2 requirements

• Support for third-party assessments so you can pass your C3PAO review with confidence

To get expert help with CMMC compliance, contact Natsar today. We’ll help you understand the requirements and ensure your business is prepared for success in the DoD contracting space.