If you’re a business owner who’s ever planning on doing work with the Department of Defense–then this blog is for you. The final CMMC rule hit the Federal Register last month, meaning it’s time to get compliant or miss out on a lot of contract money.
But how soon do you have to get it together? And what happens if you don’t? That’s exactly what we’re here to answer.
CMMC 2.0 Explained
For those who are less familiar, CMMC stands for Cybersecurity Maturity Model Certification. Essentially, it’s how the DoD ensures the information it gives out to contractors is protected, requiring certain cybersecurity measures, depending on the high-level information you are handling.
This new CMMC model was created to streamline what many called a complicated process. It paired down the levels of information into three main groupings, requiring different assessments at each level.
Level 1: This is the most basic level where contractors handle only Federal Contract Information (FCI), and requires basic cyber hygiene practices.
- Level 2: Required if you handle Controlled Unclassified Information (CUI). This will require a third-party assessment and more advanced cybersecurity measures.
- Level 3: For the companies handling the super-sensitive stuff. Advanced requirements for critical defense programs. If this is you, you probably already have a team for this.
When to Get Compliant
What is the biggest change for small businesses that are contracting? No more honor system. Third-party audits are coming, and they’re going to separate the prepared from the procrastinators real quick. That’s why it’s so important to prepare by asking yourself a few questions.
When does this take effect?
The new CMMC rule becomes effective on December 16, but contracts will not be entered until mid-2025. But you’re going to want to start putting these cybersecurity measures in place now, especially if you’re a small business serving as a subcontractor to a Prime because they can start requiring compliance now.How do I know which level I need?
Check your contracts or the contracts you want for mentions of CIU. If you see that, you should start taking measures immediately.How much is this going to cost?
We will be honest: It won’t be cheap. Technology upgrades can cost anywhere from $10,000 to $50,000, depending on your current setup. The third-party assessment will also cost a pretty penny. Ongoing maintenance, training, and documentation also require manpower and a portion of your profits, so buckle up and get ready for the investment.How do I prepare for these new third-party audits?
If you haven’t already done so, do an internal assessment. What are you missing? What do you have? What needs upgrades? Knowing the scope of what you need to do will be helpful in the long run. Then, fix the easy stuff first, and start documenting everything. This will help your assessments go more smoothly.
What Now?
The time to get cyber-compliant is now. While the DoD says this new rule will make it easier for small and medium-sized businesses, let’s be honest – this is still going to be a heavy lift for most of us.
But here’s the silver lining: you’re not the only one dealing with this. Every defense contractor is in the same boat, and those who get their act together first will have a serious competitive When
These requirements start hitting contracts next year, so you’ll either be ready to go or watch your competitors snap up those contracts.
