10 months ago

‍https://www.cisa.gov/resources-tools/resources/cybersecurity-maturity-model-certification-20-program is a cyber program and security framework used by the https://dodcio.defense.gov/CMMC/About/ to measure firms’ cybersecurity maturity. CMMC compliance demands that DOD contractors pass an external CMMC assessment carried out by an approved CMMC Third Party Assessment Organization (C3PAO) for all but the lowest level of CMMC certification.

Hence the necessary imposition of minimum cybersecurity standards on DoD subcontractors to maintain security across all service providers’ information systems.

The CMMC levels of certification are as follows: Not required — Organizations that only handle information that is approved for public release do not require CMMC certification.

CMMC Level 2 — Advanced Cyber Hygiene Practice CMMC Level 3 — The Expert Practice level is the minimum level for organizations handling CUI.