CMMC 2.0: Are You Ready?
July 6, 2022 | Nolan Johnson, I-Connect007Estimated reading time: 3 minutes
Nolan Johnson discusses with Ryan Bonner of DEFCERT exactly where and how EMS companies should aim for CMMC certification. Organizations, he says, “need to avoid false dichotomies where they assume that either CMMC is a go or it’s not happening at all. All the government mandated reviews to keep CMMC moving forward, resulting in new contract clauses, are already underway. The rule making is scheduled; it will happen.
Nolan Johnson: Ryan, what’s the status of CMMC 2.0?
Ryan Bonner: The aspects of CMMC 2.0 that those contractors can act on now, even while we wait on other components, are the model itself and the assessment guide. Those are the two documents that are most appropriate for contractors. Because those two items are in place, there is a path forward for CMMC, even while secondary aspects of CMMC, like the C3PAOs assessment process or the eventual contract clauses that will drive adoption, are under the surface, if you will, and are going through rule making.
Johnson: There is something tangible that we can proceed with in anticipation of everything else coming into place.
Bonner: Absolutely. Many organizations don’t realize that the shift to CMMC 2.0 was the outcome of a review by the Government Accountability Office. I believe it was congressionally mandated as well under the National Defense Authorization Act. That process has already been completed.
The big change coming out of that review process was to shrink the model back to only the requirements described in the original parent document, NIST 800-171. That creates a situation where now the CMMC model under 2.0 is identical to the requirements and assessment content that’s in both NIST 800-171 and NIST 800-171A (the document used to assess 800-171). Those are identical. They’re in lockstep. There’s no appreciable difference between the two.
Johnson: If my company has already completed NIST 800-171, what does this mean regarding CMMC?
Bonner: You should be aware of two ways you might be assessed or graded against what you’ve already done. If you have already worked on 800-171, or even completed your implementation, you have two pathways. The first is being assessed by the government or the defense contract management agency that’s done through their DIBCAC (Defense Industrial Base Cybersecurity Assessment Center) teams. But the DIBCAC teams, at no cost to you, schedule either a moderate confidence or high confidence assessment and, because of that, assign you a completion score using their assessment methodology. That’s one way to be assessed against NIST 800-171.
The other pathway is a proactive approach where you seek CMMC certification. This involves the accreditation body and their authorized assessing organizations, which are the C3PAOs coming in and, at your cost, you are assessed and then certified. That certification is expected to be good for three years. The difference there is that contracting officers are allowed to request your CMMC certification as a source selection criterion for awards. That’s the big shift. Organizations that want to skip many of the government audited steps can go straight to private sector certification, and then have that on file to show you’ve completed everything in NIST 800-171.
They’re not mutually exclusive, so if organizations haven’t completed NIST 800-171 implementations, there is an additional change to rule making that we expect next March. It will involve setting either certain minimum threshold scores or specifying which of the 800-171 requirements must be done as a prerequisite for contract awards while other, perhaps less vital implementations, can be saved until a 180-day window after-contract award.
Johnson: Sounds like there’s room there to transition without being completely locked out.
Bonner: Correct. Organizations should be aware of how compressed a 180-day window is for completing your implementations. It’s not a lot of time based on how long it seems to take most contractors to implement.
Continue reading the rest of this interview in the July 2022 issue of SMT007 Magazine.
Suggested Items
I-Connect007 Editor’s Choice: Five Must-Reads for the Week
02/23/2024 | Andy Shaughnessy, Design007 MagazineIt was a good week in PCB design and manufacturing. In this week’s wrap-up, we have news about an uptick in EMS shipments in January, a look at the current M&A climate, some guidance on investing in your company in order to stay competitive, a primer on designing with embedded capacitance materials, and a roadmap for the industry to embrace sustainable PCBs in the future.
Every Designer Needs to Understand Embedded
02/14/2024 | I-Connect007 Editorial TeamIPC’s Kris Moyer teaches design techniques for embedding components, and he’s noticed an upswing in his students’ interest in embedded component design. We recently spoke with him about embedding component design: best practices, pros and cons, and when it makes sense for designers to start embedding.
IPC Standards: Ticket to a Safe Passage
10/26/2023 | I-Connect007 Editorial TeamJohn Watson, CID, is a customer success manager with Altium who also teaches PCB design at Palomar College in Carlsbad, California. He’s noticed that most of his students are primarily new to the industry and not familiar with IPC standards. In his classes, he teaches how to use these standards while trying to help students access the documents more easily. When we met with John, we asked him to discuss the importance of understanding IPC standards, the price you’ll pay if you decide not to follow them, and his plans for getting new designers on board with standards as early as possible in their careers.
PCBflow Fosters Collaboration Between Design and Manufacture
10/23/2023 | Andy Shaughnessy, Design007 MagazineDuring PCB West, I spoke with Susan Kayesar, program manager for PCBflow, a business unit of Siemens that provides a collaboration environment for designers and manufacturers. We discussed the intent behind PCBFlow and how this platform helps to improve pre-manufacture communications.
Connect the Dots: Best Practices for Prototyping
09/21/2023 | Matt Stevenson -- Column: Connect the DotsPCB prototyping is a critical juncture during an electronic device’s journey from concept to reality. Regardless of a project’s complexity, the process of transforming a design into a working board is often enlightening in terms of how a design can be improved before a PCB is ready for full production.