CMMC Compliance Cleveland & Beyond
Prepare for CMMC Certification with a Clear Path Forward
Kloud9 offers the expert guidance DoD contractors need to meet CMMC requirements without the stress.
20+ years in business
Engineers with 25+ years in IT
24/7 remote and on-site technical support availability
Complex migration expertise
Deep experience in CMMC compliance
Overview
On November 4, 2021, the DoD announced CMMC 2.0, the latest iteration of its new Cybersecurity & Compliance Framework for its contractors, and also the Defense Industrial Base (DIB) which introduced significant changes to the CMMC program it had started rolling out with the pilot contracts in early 2021. Feedback from the industry and small businesses was given consideration to make these changes.
There are notable changes in these four areas:
1. CMMC 2.0 Levels
To simplify the requirements, the different CMMC Certification Levels were reduced from five down to three. Levels 2 and 4 from CMMC 1.02 were eliminated. Similar to the earlier version, CMMC 2.0 Level 1 is limited to the handling of Federal Contract Information (FCI) while CMMC 2.0 Level 2 (former Level 3) allows the handling of FCI and Controlled Unclassified Information (CUI). The new CMMC 2.0 Level 3 combines the old Levels 4 and 5, and will only apply to a small set of companies. For more in-depth information, see our CMMC 2.0 Compliance Levels page.
2. CMMC 2.0 Control Requirements
Overall, the control requirements have been scaled back to or close to the 110 controls in NIST SP 800-171.
CMMC 2.0 Level 1 Controls – Foundational Level
No changes have been made as compared to CMMC 1.02. 17 processes need to be implemented to fulfill this Foundational Level 1.
CMMC 2.0 Level 1 Controls – Foundational Level
The Control requirements were scaled back to the 110 controls of NIST SP 800-171 which were a requirement under DFARS 252.204-7012 (since 1.1.2018) and DFARS -7019 (since 11/30/2020) already. The planned additional 20 controls unique to CMMC 1.02 were eliminated.
The bottom line is that under CMMC 2.0, this “Advanced” level will be equivalent to the NIST SP 800-171. The requirements regarding documentation (policies, procedures, etc.) are not explicitly mentioned any longer which might lead some to conclude that no documentation is needed any longer. However, a solid documentation was always required for a NIST SP 800-171 implementation as well so this doesn’t represent a change.
CMMC 2.0 Level 3 Controls – Expert Level
In addition to the requirements from Level 2, CMMC 2.0 Level 3 will be based on a subset of NIST SP 800-172 requirements. This “Expert” level is currently under development.
3. CMMC 2.0 Assessment Requirements
Probably the most controversial revision is regarding the changes to the assessment requirements. Only contractors of Level 3 and part of Level 2 will have to become certified. Those in Level 1 and the remainder of Level 2 will be allowed to perform self-assessments.
CMMC 2.0 Level 1 Assessments
Contractors that will handle FCI exclusively (Level 1) will no longer be required to become certified. Instead, they must provide an annual Level 1 self-assessment with an additional annual affirmation from a senior company official that the company is meeting requirements. The score of the self-assessment should be submitted to the Supplier Performance Risk System (SPRS) as well.
CMMC 2.0 Level 1 Assessments
This “Advanced” Level allows for managing CUI and is unique in the sense that the organizations required to achieve this compliance level are divided into two subsets — resulting in two different assessment requirements. The criterion that is used to categorize contractors into one of the subsets is if the information they handle is “critical to national security” or not. This will need to be clarified further by the DoD.
Level 2 – Subset 1:
Contractors that handle information that is NOT deemed critical to national security. These organizations can perform the annual self-assessments as the companies in Level 1.
Level 2 – Subset 2:
Contractors managing information deemed critical to national security. These companies will have to be certified and will be assessed by a Third-Party Assessment Organization (C3PAOs) which will be accredited by the CMMC-AB.
CMMC 3.0 Level 1 Assessments
Organizations in the “Expert” level will have to become certified. At this level, the certification assessment will be performed by government officials.
4. CMMC 2.0 PoA&M requirements
The initial version, CMMC 1.02, did not allow for any open items in the Plan of Actions and Milestones (PoA&M) document. The DoD currently softened its stance and intends to allow companies to receive contract awards with a Plan of Actions and Milestones (POA&M) in place to complete CMMC requirements. However, only low-risk items are allowed to be as open items on the list, and there is a 180-day period in which the contractor will have to remediate the issue and become compliant. Another additional requirement is the minimum assessment scores. All the highest weighted NIST SP 800-171 controls will have to be implemented without exceptions at contract award.
Timeline
All these changes impact the CMMC implementation timeline and rollout which had started in early 2021 and will end on October 31, 2025, as mentioned in DFARS 252.204-7021. Currently, CMMC 2.0 is in the rulemaking process which is expected to take 9-24 months.
The DoD stated that it will not include CMMC requirements in contracts until this process has been finalized. CMMC will be part of new DoD contract requirements once completed. Considering that the implementation of CMMC requirements can take several months, the time to start the journey towards CMMC compliance is now.
Waivers
The DoD is considering CMMC waivers but made it clear that these would be issued on a very limited basis for select mission-critical instances and require approval from senior DoD leadership. The waivers have a limited duration and need to be supported by mitigation strategies to reduce the risk to the CUI handled by the contractor.
Build stronger protection across your entire technology environment
Kloud9’s services are designed to work with your existing tools, infrastructure, and business goals. Whether you need day-to-day IT support or managed services, cybersecurity, compliance, cloud, and AI guidance, we help streamline and protect the systems your organization depends on.
IT Solutions
Get the day-to-day support services, strategic guidance, and technical expertise your business needs to keep users productive, systems reliable, and business operations moving.
CyberSecurity
Protect your people, data, network, and cloud environments with layered security services that identify potential threats, reduce risk, and maintain customer trust.
Compliance
Address regulatory requirements with practical guidance, documentation support, and tailored solutions that help your business close gaps and stay compliant.
Cloud
Modernize your technology with secure, scalable cloud solutions that support remote work, simplify infrastructure, and help your team function more efficiently.
Not sure where to begin your CMMC journey?
You don’t have to tackle complex federal regulations alone. Read our CMMC Quick Overview to learn more about the requirements, or reach out to our team today to start building a compliant, resilient infrastructure.
Talk to our compliance experts