CMMC has become such an important part of business for any company that works with or wants to work with government contracts. Naturally, one question on many contractors’ or subcontractor’s minds is “Who Needs CMMC Certifications?”
Read on to learn more about who is required to obtain a CMMC certification, which level they need, and how CMMC is about to change forever.
What is a CMMC Certification?
The cybersecurity maturity model certification (CMMC) was developed by the Department of Defense (DoD) in 2019 to establish a set of regulations and standards contractors must meet when handling sensitive government information. This became necessary due to a high volume of attacks on government contractors who became targets of hackers who desired government data without having to break a government defense.
The goal of CMMC is to protect crucial government information, including controlled unclassified information (CUI) and federal contract information (FCI) that contractors need to complete work.
CMMC 2.0
CMMC 2.0 was introduced in 2021 with the goal of streamlining and simplifying the certification regulations, making them more affordable and easier to maintain for businesses.
Here are a few of the major changes from CMMC 1.0 to 2.0:
- Levels reduced from 5 to 3
- Change in control amounts for each level
- Change in assessment processes for each level, including allowing self-assessments
Who Needs to Become CMMC Certified?
In short, contractors and subcontractors working with or on behalf of the Department of Defense are required to have some form of CMMC certification. Which level is required of them is determined by the contract and on if the company will be handling CUI or just FCI.
Organizations that only produce commercial off-the-shelf products are not required to meet any level of CMMC regulations.
If handling FCI—information that is not public and is generated by the government—a business is required to achieve level 1. If working with CUI—unclassified but highly sensitive information—levels 2 or 3 are required depending on the contract and information.
CMMC was formerly divided into 5 separate levels, each requiring more or less cybersecurity controls to achieve. In CMMC 2.0, those levels have been condensed into 3 but many of the qualifications have been carried over and categorized into a similar tier.
Here is a look at each tier, how it compared to CMMC 1.0, and what it takes for businesses to qualify for that particular certification.
CMMC 2.0 Levels
Level 1: Foundational Cybersecurity (Former CMMC 1.0 level 1)—Level 1 of CMMC 2.0 applies to companies that will only be handling FCI. There are 17 controls that cover some basic, foundational cybersecurity best practices designed to safeguard FCI and other less-sensitive information. Assessment for level 1 is done internally and must be completed every year.
Level 2: Advanced Cybersecurity (Formerly CMMC 1.0 levels 2-3)—Level 2 certification in CMMC 2.0 is required for company’s that will be working with CUI. These requirements are in complete alignment with NIST (National Institute of Standards and Technology) SP 800-171 and is made up of 110 cybersecurity practices. Assessment for level 2 is a mixture of third-party assessment and self-assessment, depending on handled information, that occurs every three years.
Level 3: Expert Cybersecurity (Formerly CMMC 1.0 levels 4-5)—The highest level of CMMC certification is focused on protecting CUI within the DoD’s high-priority programs. This level is focused on defending against persistent threats and has 110+ controls, including some from NIST SP 800-172. For level 3, a government-led assessment must occur every 3 years.
