CMMC 1.0 Vs. CMMC 2.0: Timeline & Key Differences

In 2023 the world reached nearly 4.5 million USD in losses due to data breaches, according to IBM. Judging from the fact that this cost only continues to increase, keeping your information safe is obviously pinnacle. Especially as a business owner.
So what does it take to protect your sensitive information? If you are a contractor or subcontractor working with information pertinent to national security, there is a guideline you must follow. This program is the Cybersecurity Maturity Model Certification (CMMC) 2.0.
CMMC 2.0 helps to provide structure to protect sensitive information online. It contains practices, standards, and processes which help keep this data safe. This benefits organizations of all kinds, especially within the public sector.
The U.S. The Department of Defense (DoD) created the CMMC framework. This was with the Defense Industrial Base (DIB) in mind due to the fact that the contractors of the DIB are the target of more complex and frequent cyberattacks.
By having this framework align with the DoD’s security requirements, controlled unclassified information (CUI) and federal contract information (FCI) stays secure. This is a huge step forward when it comes to the security during communication between contractors and the Department.
As well as keeping this sensitive information within acquisition programs and systems safe.
In September of 2020, the DoD published a new interim rule to the Defense Federal Acquisition Regulation Supplement (DFARS) in the Federal Register. DFARS Case 2019-D041 implemented the initial version of CMMC (CMMC 1.0).
The features of this program included:
* 5 tiered model.
* Required assessments.
* Implementation through contracts.
On November 30th of 2020, the DOD officially put this temporary rule into effect. This established a five-year phase-in period. Cybersecurity and acquisition leaders then took it upon themselves to sift through the implementation. They came across ways to refine these policies and better execute this program implementation. This updated program today is CMMC 2.0.
So now let’s get into the details of CMMC 2.0, otherwise known as its levels. The program contains three levels, which replaces the previous five-tier system:
* Level 1 (Foundational).
* Level 2 (Advanced).
* Level 3 (Expert).
The sensitivity of the data your organization provides decides on what level of compliance you must meet.
Between the previous version of CMMC (CMMC 1.02) and today’s version, there have been some notable changes. These changes helped refine and build on the original program requirements.
They are:
* Streamlines the previous model from 5 levels to 3. Focuses on the most critical compliance requirements.
* Utilizes the cybersecurity standards of the National Institute of Standards and Technology (NIST).
* Enables companies at level 1 to achieve compliance certification through self assessment. As well as certain subsets of level 2.
* Holds third-party assessors more accountable for their professional and ethical standards.
* Companies under specific circumstances can make Plans of Action & Milestones (POA&Ms) in order to achieve their certification.
* Under certain limited situations, this program allows the Government to waive inclusion of CMMC requirements.
By utilizing CMMC 2.0, businesses such as yours can install sturdy cybersecurity structures, all while mitigating any vulnerabilities and being able to better handle and respond to security breaches.
►Reach out to Etactics @ www.etactics.com​
►Subscribe: rb.gy/pso1fq​ to learn more tips and tricks in healthcare, health IT, and cybersecurity.
►Find us on LinkedIn: / etactics-inc
►Find us on Facebook: / ​
#CMMC #CybersecurityMaturityModelCertification