The original CMMC (version 1.0) was based on several cybersecurity guidelines, most prominently NIST 800-171. With the announcement of CMMC version 2.0 in early November 2021, however, the alignment between the frameworks and the NIST document has changed a bit. Fortunately, this change seems to be for the better, or at least more intuitive, for assessors and contractors. 

Here, we’ll discuss how the new CMMC 2.0 assessment levels align with NIST 800-171 and how this can help contractors more readily meet their security obligations once the new framework goes into effect. 

Read More

The Department of Defense has recently released plans for CMMC 2.0, the revised standards for compliance and security in the DoD supply chain. Many contractors working with DoD agencies were already gearing up for CMMC 1.0, and now are left wondering what is next for them and their business.

The important thing to remember is that CMMC 1.0 hasn’t gone away, and as such it’s possible to continue on your current compliance path, based on any RFP requirements and streamline your path to CMMC 2.0 compliance.

Read More

CMMC has become a strict, rigorous set of regulations for contractors working with the Defense Department. It is a clear map of maturity and capabilities; its implementation of NIST 800-171 controls; and its call for complete compliance before certification make CMMC audits challenging for many unprepared businesses. Unlike other frameworks, CMMC doesn’t allow documents like a Plan of Action and Milestones (POA&M) to stand in for actual compliance. 

CMMC 2.0 seems to change that. Here, we will discuss a POA&M and what it means within the CMMC framework. 

Read More