Do I Need a Certified Third-Party Assessment Organization (C3PAO) Under CMMC 2.0?

CMMC 2.0

The DoD recently released its framework for the next model in CMMC compliance and audits–CMMC 2.0. This revision is expected to streamline the compliance process and trim some of the extraneous requirements from the framework, helping contractors in the DoD supply chain better meet their requirements without introducing unnecessary challenges or redundancies. 

One of the more important aspects of CMMC certification is the inclusion of third-party audits. With the introduction of CMMC 2.0, these requirements have changed to make certification easier for contractors without sacrificing security. 

Read More

What is CMMC 2.0 and, Why Is the Defense Department Changing Requirements?

cmmc 2.0 featured

The Cybersecurity Maturity Model Certification (CMMC) framework is a relatively new, yet still partially implemented, set of cybersecurity regulations targeting DoD agencies and contractors. The DoD specifically built the rules to address the IT infrastructure and security practices needed to handle Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). After a lengthy period of review, the DoD has, as of November 2021, released an updated version of CMMC, known colloquially as CMMC 2.0.

What is CMMC 2.0? We’ll cover some of the more significant changes here, what this means for DoD contractors, and how you can prepare for the change.

Read More

What is NIST SP 800-171 and What Role Does it Play in Defense Contracting Compliance?

NIST 800-171 featured

The document library of the NIST website can be daunting and seemingly endless in terms of the various frameworks, controls and requirements that it provides. The 800 series, in particular, while important and, in many cases, necessary, is also hard to penetrate if you don’t already have some knowledge of what it contains. This can provide a challenge for organizations working with the DoD supply chain, especially those handling classified or sensitive material. 

In this article, we’ll cover one of these publications: NIST 800-171. This document defines security for a specific form of government information that many contractors under the executive or defense departments: CUI. While important on its own, this document also informs several important security frameworks, namely CMMC.

 

Read More