The DoD created CMMC to curtail the exfiltration and theft of sensitive defense information from contractor information systems. CMMC serves as a verification mechanism to ensure that Defense Industrial Base (DIB) companies implement adequate cybersecurity practices and processes to protect both Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) within their unclassified networks.

In November 2021, the DoD announced changes to the CMMC program to facilitate its rollout and to reduce its business and cost impact to small businesses. CMMC version 2.0 consists of the security requirements from NIST 800-171 Rev2 and a subset of requirements from NIST 800-172. Key elements of CMMC 2.0 include:

• Three CMMC Levels: Different levels of cybersecurity requirements based on the sensitivity of information received or handled.
  • Level 1: Basic safeguarding requirements for FCI
  • Level 2: Security requirements for CUI
  • Level 3: Security requirements for select categories of CUI
• Assessments: Three levels of assessment based on CMMC level and procurement priority.
  • Self-Assessment, Self-Attestation: For Level 1 and for non-prioritized Level 2 procurements
  • Independent Third Party (C3PAO) Assessment: For prioritized Level 2 procurements
  • C3PAO and Government Assessment: Level 3 assessments will be conducted to the Level 2 baseline by a C3PAO, the remaining requirements will be assessed by the DoD

• Limited Plans of Action and Milestones (POA&M): CMMC 2.0 allows POA&Ms to address certain non-critical practice requirements provided those POA&Ms are executed within 180 days of a contract award.
• Heightened enforcement at all levels: To ensure compliance with CMMC as defined in the assessment criteria and assessment process, DoD is increasing the rate of systematic and random audits and will prosecute egregious offenders under the False Claims Act.