Newport News and Virginia Department of Defense (DoD) contractors and subcontractors will soon be required to comply with the new Cybersecurity Maturity Model Certification (CMMC) 2.0 requirements. The CMMC program is intended to better enforce cybersecurity requirements across the defense industrial base (DIrB) to better protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).
Once implemented, DoD contract solicitations will indicate the required maturity level for the winning contractor. If a contractor does not have the appropriate certification in the DoD’s Supplier Performance Risk System (SPRS), then the contractor will be ineligible for contract award
This will be added to contracts where FCI only will be received or generated by the contractor. Level 1 will require organizations to annually self-assess and affirm their compliance with the 17 Level 1 practice requirements, which are composed of 59 assessment objectives.
This level requires a triennial third-party assessment and annual affirmation of compliance with 110 practice requirements, which are composed of 320 assessment objectives. Level 2 also expands the type of information system assets that are in scope for assessment, compared to Level 1.
This level requires an existing Level 2 certification, and contractors will be assessed by the DoD for compliance against an additional 24 practice requirements. Level 3 also expands the type of information system assets that are in scope for assessment, compared to Level 2.
By most estimates, organizations are likely to require 12-18 months to prepare for a Level 2 assessment. With the CMMC final rule likely taking effect during the first half of 2025, Virginia DoD contractors who wish to participate on new DoD contracts should start preparing as soon as possible.
Many Newport News DoD contractors need assistance performing initial assessments to uncover issues and establish corrective actions. Our team has almost 20 years of experience providing cybersecurity on major frameworks such as NIST SP 800-171, NIST SP 800-53, HIPAA, and others. As CMMC RPO, our team can help DoD prime and subcontractors with the following:
Security Compliance = Secure Client Base
Scott McAuliffe and Chris Moschella provide an overview of the CMMC requirements and share readiness strategies that can help you reduce noncompliance risk, regardless of where you are in your readiness process.
December 18th, 2024 Webinar Recording
All DoD contractors and subcontractors, and adjacent industries (e.g., cloud service providers (CSP) and External Service Providers (ESP) like MSPs, MSSPs) handling FCI, CUI, or SPD.
The only exemption to CMMC requirements is if the company exclusively provides commercial off-the-shelf (COTS) products. For example, a subcontractor provides software licensing to a prime contractor who provides IT services to the Government.
Companies cannot receive a CMMC waiver; however, the Service Acquisition Executive (SAE) or Component Acquisition Executive (CAE) can approve waivers of the CMMC assessment requirements for specific RFPs. Expect these waivers to be exceptionally rare.
| Level 1 | Level 2 | Level 3 |
| Only handle FCI | Handle CUI | Handle CUI |
| FAR 52.204-21 | NIST 800-171 | Select Controls in NIST 800-172 |
| 59 Assessment Objectives | 320 Assessment Objectives | 320 Assessment Objectives + 24 Additional Controls |
| Annual self-assessment | Triennial self-assessment (only applicable if CUI handled is outside the National Archives CUI Registry Defense Organization Index Grouping) | Triennial assessment
performed by government |
| Triennial assessment
performed by C3PAO |
||
| Annual Affirmation | Annual Affirmation | Annual Affirmation |
Identify the Type of Data You Handle – The required CMMC level depends on whether your organization processes Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) responsive to a DoD contract.
Review Your DoD Contracts & RFPs – Your contracts and request for proposals (RFP) may specify the required CMMC level. Pre-CMMC contracts may include requirements to implement the security requirements in NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, by including DFARS clause 252.204-7012, which indicates at least Level 2 requirements.
Review documents received – Do the documents you receive documents have CUI Markings in the Header or Footer? Do the documents received or produced fall into the National Archives CUI Registry Defense Organization Index Groupings. Contracts with DoD CUI will require at least a Level 2 Certification assessment performed by a C3PAO. Contracts with only non-DoD CUI will require Level 2 Self-Assessment.
Consult your prime contractor (if applicable) or DoD contact – check with the prime contractor or DoD contact on what CMMC level is required under the contract.
| When the ESP processes, stores, or transmits: | When utilizing an ESP that is: | |
| A CSP | Not a CSP (e.g., MSP, MSSP) | |
| CUI (with or without SPD) | The CSP shall meet the FedRAMP requirements in 48 CFR 252.204-7012 (FedRAMP Moderate or Higher Authorized or Equivalent). | The services provided by the ESP are in the OSA’s assessment scope and shall be assessed as part of the OSA’s assessment. |
| SPD (without CUI) | The services provided by the CSP are in the OSA’s assessment scope and shall be assessed as Security Protection Assets. | The services provided by the ESP are in the OSA’s assessment scope and shall be assessed as Security Protection Assets. |
| Neither CUI nor SPD | A service provider that does not process CUI or SPD does not meet the CMMC definition of an ESP. | A service provider that does not process CUI or SPD does not meet the CMMC definition of an ESP. |
MSPs and MSSPs that support many DoD contractors may find it more economical to obtain a CMMC assessment as a way to reduce the time spent supporting multiple customer assessments.
CMMC Level 1 and Level 2 Self-Assessment requirements will appear in new solicitations on the “effective date.” The CMMC requires two Federal rules to be final and effective for the rule to take effect. They are referred to as the Title 32 Rule and the Title 48 Rule. The Title 32 Rule, which sets out requirements for the CMMC program, is final and effective. The Title 48 Rule, which instructs DoD to include CMMC requirements in its contracting process, is not yet final. 60 days after it is published, it too will become effective. That date will be the “effective date.” One year after the effective date, Level 2 Certification requirements will appear, as required, in new solicitations. Two years after the effective date, Level 3 Certification requirements will appear, as required, in new solicitations.
Keiter provides CMMC readiness assessments and remediation services to DoD contractors across Newport News and the State of Virginia. If you are interested in learning how we can assist your organization, complete the form below and a team member will follow up promptly.
Virginia’s Department of Defense (DOD) contractors are critical components of the state’s role in national security and technological advancement. The state is home to a robust and diverse community of defense contractors, specializing in various fields such as aerospace, technology, cybersecurity, and advanced manufacturing.
These contractors collaborate closely with DOD agencies and military installations, including the Pentagon, Naval Station Norfolk, and Fort Belvoir. They are at the forefront of developing cutting-edge defense technologies and solutions, contributing significantly to the nation’s defense capabilities.
Virginia’s DOD contractors also significantly impact the state by creating jobs and fostering innovation. Their commitment to excellence and partnership with the military ensure that the United States remains a leader in military technology and readiness. Virginia’s defense contractors play a pivotal role in supporting national defense efforts while driving economic growth and technological advancement within the state.
We also provide CMMC services to Department of Defense Contractors in Alabama, Arizona, Colorado, Florida, Hawaii, Illinois, Mississippi, New Hampshire, Pennsylvania, New Jersey, Maine, Rhode Island, Massachusetts, New York, North Carolina, South Carolina, Texas, Vermont, the State of Washington, and Washington D.C.