We are excited to announce the release of the new version of our CMMC 2.0/NIST SP 800-171 Self-Assessment Tool. This version includes automated FAR and Above and SPRS scoring and much more!
The FAR and Above Program provides a risk-based, phased approach to achieving the requirements in NIST SP 800-171.
Government representatives have stated that complying with CMMC 2.0 Level 2 shouldn’t cost contractors or the government anything, because contractors have been attesting to the government that they are doing these things for years. This article explores why this is correct only for a small minority (17 out of 110) of the controls in CMMC 2.0 Level 2.
Imagine the following scenario: As part of Project Road Runner, a new initiative, the United States Army, a portion of (more…)
The DoD CIO’s office held a town hall on 2022-FEB-10. They discussed a variety of topics including CMMC 2.0. Several take-aways came out of the session that are critical for DoD contractors, especially those handling CUI.
NIST SP 800-171 can be overwhelming for contractors. In this article, we present a prioritized approach to implementing the 110 controls of 800-171.
The US Department of Defense updated their main website (OUSD A&S – Cybersecurity Maturity Model Certification (CMMC) (osd.mil)) to include (more…)
With CMMC 2.0, DoD removed process maturity as an assessed requirement. Some commentators are suggesting that NIST 800-171’s “NFO” controls inherently require policies. We explore the requirement in this article.
DoD submitted but quickly withdrew an “advanced notice of proposed rulemaking” entitled “Cybersecurity Maturity Model Certification 2.0 Updates and Way Forward”.
CMMC depends upon Authorized C3PAOs. DCMA’s DIBCAC team plays a crucial role in the C3PAO authorization process. However, the DIBCAC teams’ calendars were already full prior to CMMC. In this article, co-authored with Kyle Lai, Carter Schoenberg, Tony Buenger, and Derek White, we discuss whether the current system is likely to clear the CMMC C3PAO backlog in a timely manner and explore a few alternatives.