Understanding CMMC 2.0 Cybersecurity Requirements for Working with Government Agencies

Cybersecurity has quickly become a top threat after well-publicized attacks against U.S. targets — such as the Colonial Pipeline, jeopardizing one of the U.S.’ most prolific gas lines and pushing the topic of national cybersecurity to the forefront — including at the highest levels of government. In fact, the Senate unanimously passed the Strengthening American Cybersecurity Act of 2022 in March, an effort to bolster the U.S. defense against cyber threats.

Introducing CMMC

As part of its efforts to protect against cyber threats, the U.S. Department of Defense (DoD) has also created the Cybersecurity Maturity Model Certification (CMMC). This certification model is designed to ensure that organizations working with the DoD are adhering to the cybersecurity standards necessary to protect vital information.

On the heels of CMMC, the DoD released CMMC 2.0. This update aims to ensure that contractors are using the tools and processes necessary to negate cyber threats and stand up to the challenges of modern cybersecurity risks. CMMC 2.0 also represents a massive amount of business and opportunity, as it is currently estimated that more than 300,000 contractors need to meet the requirements of CMMC 2.0. While the requirement is now only in place for contractors working with the DoD, it is expected that all contractors working with federal agencies will need to meet CMMC 2.0 standards soon.

While there are currently five levels of certification for CMMC, CMMC 2.0 will put into place three tiers: foundational (level 1), advanced (level 2), and expert (level 3).

CMMC 2.0 and the Channel

CMMC 2.0 primarily represents an opportunity for channel partners. While working with federal agencies has always provided opportunities for channel partners, defense contracts can be particularly lucrative. With CMMC 2.0 requirements in place for the DoD, channel partners who can meet these requirements position themselves to win valuable government contracts.

Even beyond the business opportunity that can come with adhering to CMMC 2.0, channel partners proactively pursuing security certifications will inherently become more fortified against cyber threats and learn valuable procedures for lowering risk. Even companies that don’t require CMMC 2.0 will likely be encouraged by channel partners that take cyber threats seriously and are actively working to defend against them.

How to Obtain CMMC 2.0 Certification

Becoming CMMC 2.0 certified requires going through several steps. The first is to determine the level needed, which depends on the type of information being handled.

Next, a CMMC gap analysis needs to be conducted to pinpoint shortcomings and identify what steps are necessary to eliminate them. Then you must create a System Security Plan (SSP) — essentially a summary of all your security policies, practices, and tools that will help you adhere to CMMC 2.0. This is what proves you will meet the security standards necessary to work with federal agencies.

Finally, you will engage with either a third-party or government assessor to audit your SSP, review your documents, and interview your team to make sure requirements are being met. If the audit reveals all required processes, tools, and procedures are in place, then you will receive your certification.