CMMC Compliance – Newport News (VA)
Newport News and Virginia Department of Defense (DoD) contractors and subcontractors will soon be required to comply with the new Cybersecurity Maturity Model Certification (CMMC) 2.0 requirements. The CMMC program is intended to better enforce cybersecurity requirements across the defense industrial base (DIrB) to better protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).
Three CMMC Maturity Levels (ML)
Once implemented, DoD contract solicitations will indicate the required maturity level for the winning contractor. If a contractor does not have the appropriate certification in the DoD’s Supplier Performance Risk System (SPRS), then the contractor will be ineligible for contract award.
CMMC Level 1 will be added to contracts where FCI only will be received or generated by the contractor. Level 1 will require organizations to annually self-assess and affirm their compliance with the 17 Level 1 practice requirements, which are composed of 59 assessment objectives.
CMMC Level 2 requires a triennial third-party assessment and annual affirmation of compliance with 110 practice requirements, which are composed of 320 assessment objectives. Level 2 also expands the type of information system assets that are in scope for assessment, compared to Level 1.
CMMC Level 3 requires an existing Level 2 certification, and contractors will be assessed by the DoD for compliance against an additional 24 practice requirements. Level 3 also expands the type of information system assets that are in scope for assessment, compared to Level 2.
Readiness Preparation
By most estimates, organizations are likely to require 12-18 months to prepare for a Level 2 assessment. With the CMMC final rule likely taking effect during the first half of 2025, Virginia DoD contractors who wish to participate on new DoD contracts should start preparing as soon as possible.
Virginia Top DoD Spending Locations
Virginia CMMC Services
Many Newport News DoD contractors need assistance performing initial assessments to uncover issues and establish corrective actions. Our team has almost 20 years of experience providing cybersecurity on major frameworks such as NIST SP 800-171, NIST SP 800-53, HIPAA, and others. As CMMC RPO, our team can help DoD prime and subcontractors with the following:
- Readiness Assessments and Gap Analyses Against the CMMC Framework
- Assistance with Remediating Gaps Identified during Readiness Assessment
- Assistance with NIST SIP 800-171 Self-Assessment that is recorded in Supplier Performance Risk System
