The U.S. Department of Defense (DoD) created the Cybersecurity Maturity Model Certification (CMMC) to improve the cybersecurity readiness of the Defense Industrial Base (DIB). Key points include:
- CMMC Audits and Certification: All prime contractors and subcontractors in the supply chain must undergo CMMC audits and obtain certification.
- Impact on Supply Chain: Companies in the supply chain must make significant adjustments to meet CMMC requirements.
- DoD’s Goal: The DoD implements CMMC to ensure a consistent level of cybersecurity preparedness across the DIB, protecting the federal government from emerging cyber threats.
CMMC Levels: The CMMC model has three levels, each representing a higher standard of cyber hygiene.
3 CMMC Levels
The CMMC model consists of three levels, each representing a higher standard of cyber hygiene:
Level 1: Foundational Cyber Hygiene Standard
Level 2: Advanced Cyber Hygiene Standard
Level 3: Expert Practice
CMMC vs. NIST
The key difference between CMMC and NIST:
- NIST 800-171: A set of guidelines developed by the National Institute of Standards and Technology (NIST) to help businesses protect their systems and data.
- CMMC: A certification program developed by the DoD that ensures cybersecurity for contractors and outlines the pathway to achieving NIST compliance.