Understanding DFARS and CMMC Cybersecurity Compliance

In 2019, the DoD released what became known as the Cybersecurity Maturity Model Certification (CMMC) to ensure that all parties involved in the government supply chain maintain adequate, standardized cybersecurity protocols. Subpart 204.75 was added in 2020 to include policies, procedures, and contract clauses.

The purpose of DFARS and CMMC is to enhance cybersecurity requirements for contractors and other entities that do business with the DoD.

DFARS defines the requirements outlined in the National Institute of Standards and Technology’s (NIST) Special Publication (SP) 800-171. These requirements protect Controlled Unclassified Information (CUI) flowing from the federal government to private and public contractors from falling prey to cyber threats.

What are CMMC Requirements?

CMMC certification requirements depend on the certification level.

Here is a short explanation of the certification levels, with each level building upon the previous level’s requirements. For example, to complete Level 2, you will need to have completed all the requirements of Level 1 plus additional requirements.
Level 1 Basic Cyber Hygiene DoD service providers who prefer to pass an examination at this level should implement 7 controls of NIST 800-171 Rev. 1.
Level 2 Intermediate Cyber Hygiene Here, DoD specialists should execute yet another 48 controls of NIST 800-171 Rev. 1 as well as seven new "Other" controls.
Level 3 Good Cyber Hygiene To accomplish Level 3 certification, you must implement the last 45 controls of NIST 800-171 Rev. 1 and 13 new "Other" controls.
Level 4 Proactive Cybersecurity Along with controls from levels 1 through 3, 11 additional controls of NIST 800-171 Rev. 2 plus 15 new "Other" controls are required.
Level 5 Advanced/ Progressive Cybersecurity  For the maximum level, DoD specialists must carry out the last four controls in NIST 800-171 Rev. 2 together with 11 new "Other" controls.

 

Evaluating the Latest Updates: CMMC 2.0

In November of 2021, the DoD updated its program and requirements to CMMC 2.0 with the following goals:

  • Safeguard sensitive information to enable and protect the warfighter
  • Dynamically enhance DIB cybersecurity to meet evolving threats
  • Ensure accountability while minimizing barriers to compliance with DoD requirements
  • Contribute towards instilling a collaborative culture of cybersecurity and cyber resilience
  • Maintain public trust through high professional and ethical standards


The CMMC Model 2.0 will enhance and reduce the certification levels from five to three as follows:

Level 1 Foundational DoD service providers who prefer to pass an examination at this level should execute 17 model practices along with an annual self-assessment.
Level 2 Advanced DoD service providers must execute 110 model practices aligned with NIST SP 800-171. Triennial third-party assessments are required for critical national security information, and select programs require an annual self-assessment.
Level 3 Expert DoD service providers must execute over 110 model practices based on NIST SP 800-172, along with triennial government-led assessments.