CMMC 2.0: the new and improved Department of Defense cybersecurity standard for businesses of all sizes. Especially if you’re a small or mid–sized business, CMMC 2.0 is great news. This update makes the barrier to entry for DoD contract work much easier to get past, all while drastically improving your business cybersecurity and making you more attractive for potential government contracts and potential customers.
So, what’s changed with CMMC 2.0, and how does it affect your business? Let’s dive in!
What Are the Key Differences Between CMMC and CMMC 2.0?
As a brief recap: CMMC is the acronym for the Cybersecurity Maturity Model Certification, a framework that helps businesses who want to work with the DoD have the right cybersecurity. To work with the DoD, you have to be able to protect and defend Controlled Unclassified Information (CUI).
CMMC aligned closely with NIST SP 800-171, a list of 110 security controls, but CMMC added 20 more controls on top of the 110 created by NIST. The cybersecurity audit was pass-or-fail, so you either made it or you didn’t. A little overwhelming, right? And essentially out of reach for small businesses that don’t have the time or resources to implement every single security measure.
But CMMC 2.0 introduced a much easier path to compliance by encouraging a security-first approach. Instead of focusing on checklist compliance, the new update dropped the 20 extra measures and focuses on a business’s cybersecurity maturity, using categories like governance, risk management, and security control implementation to measure your company’s overall cybersecurity performance.
Plans of Actions & Milestones (POA&M)
The Plan of Action and Milestone framework essentially allowed businesses to show the DoD their plans for compliance. When you create a POA&M, you’ll identify what actions you’ll do to meet security controls, who will be responsible for those actions, and the date by which you’ll complete those actions.
You’ll also outline milestones that you’ll achieve along the way, to show that you have a detailed plan in place to meet CMMC compliance and that you’re making steady progress toward those goals. Some might see CMMC 2.0 as a way to bypass security controls but the DoD has put measures in place to avoid this.
There are time limits for POA&Ms, normally about 180 days, and certain high-security jobs won’t allow them—you’ll have to be fully compliant with the 110 NIST controls if you want to have your name in the running for those projects.
These changes are huge for all businesses but for SMBs especially. You still have to put in the work, but CMMC 2.0 makes it easier, more flexible, and more focused on actual security rather than putting your business through the wringer to prove that you’re secure enough for DoD contract work.
Recap of the Main Differences in CMMC 2.0
1. CMMC 2.0 focuses more on cybersecurity maturity than checklist compliance
2. Dropped the 20 extra controls on top of the 110 security measures set by NIST SP 800-171
3. Plan of Action and Milestone (POA&M) framework allows businesses to show plans for compliance
4. POA&Ms have time limits and certain contract jobs won’t allow them
5. More flexible and focused on actual security over proving security through excessive testing
If you’re looking to work with the DoD, CMMC 2.0 is a great new update for your business. With its focus on cybersecurity maturity over strict compliance, its use of POA&Ms as a tool for demonstrating progress, and its flexibility in allowing businesses to meet security controls at their own pace, CMMC 2.0 is a perfect way to help your business reach new clients.
A Clear Path to CMMC 2.0 Compliance with K2 Tech
Looking to access all the perks of contracting with the DoD? K2 Tech is here to help you navigate through the CMMC 2.0 framework and achieve compliance. Our team of experts can help you create a POA&M, assess your current security controls, and work with you to implement the necessary changes to achieve full CMMC compliance. Schedule a consultation to find out if CMMC 2.0 will work for your business!
