What is CMMC 2.0?
CMMC 2.0 (Cybersecurity Maturity Model Certification) is the DoD's framework for assessing contractor cybersecurity practices. It replaces CMMC 1.0 with two maturity levels:
- Level 1: Basic cyber hygiene (14 NIST 800-171 practices)
- Level 2: Intermediate security practices (110 NIST 800-171 practices)
Assessment Timeline
- Gap analysis: 2-4 weeks
- Evidence collection: 4-8 weeks
- System Security Plan (SSP) development: 2-3 weeks
- Third-party assessment: 1-2 weeks
Key Controls to Implement
- Access control and multi-factor authentication
- Data protection and encryption
- Incident response procedures
- Security awareness training
- Audit and accountability logging
Cost Considerations
- Level 1: $5,000 - $15,000
- Level 2: $15,000 - $50,000+
Costs depend on current state, organization size, and complexity.