{"id":4363,"date":"2023-02-15T12:19:25","date_gmt":"2023-02-15T16:19:25","guid":{"rendered":"https:\/\/solutionsreview.com\/security-information-event-management\/?p=4363"},"modified":"2023-02-15T12:28:29","modified_gmt":"2023-02-15T16:28:29","slug":"navigating-the-confusing-compliance-environment-of-the-dods-cmmc-2-0","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/security-information-event-management\/navigating-the-confusing-compliance-environment-of-the-dods-cmmc-2-0\/","title":{"rendered":"Navigating the Confusing Compliance Environment of the DoD\u2019s CMMC 2.0"},"content":{"rendered":"

\"CMMC<\/p>\n

Solutions Review\u2019s Expert Insights Series is a collection of contributed articles written by industry experts in enterprise software categories. Matthew Hodson of Valeo Networks<\/a> lays out a clear path to more easily navigate the DoD’s CMMC 2.0 program.<\/strong><\/em><\/p>\n

\"ExpertFirst, the bad news.<\/p>\n

Although the Department of Defense (DoD) has simplified the original version of its Cybersecurity Maturity Model Certification (CMMC), version 2.0 of the program still leaves a lot of contractors\u2019 questions unanswered. But the good news is that the DoD is clearly trying to make the compliance process less complicated. And with the proper guidance, your company can get there– even if you\u2019re not cybersecurity experts.<\/p>\n


Widget not in any sidebars
<\/p>\n

CMMC 2.0: Navigating Through the Confusion<\/strong><\/h2>\n
\n

The Challenges of CMMC 1.0<\/strong><\/h3>\n

Whether buying advanced weapons, furniture, or catering services, the DoD will often have to share with those contractors what\u2019s known as Controlled Unclassified Information (CUI)– data that\u2019s not top secret but needs to be kept confidential and safeguarded from hackers.<\/p>\n

To make sure that any vendor required to handle CUI would be capable of keeping that data secure, the government launched CMMC in 2020. The program established cybersecurity standards that contractors would need to meet \u2014 and demonstrate through third-party assessment \u2014 before they could apply for contracts. Even longtime DoD vendors would need to go through this certification.<\/p>\n

But when the government introduced CMMC 1.0, Defense Industrial Base (DIB) companies began citing challenges with it almost immediately. For example:<\/p>\n

    \n
  • Contractors were confused by the five levels of certification and unsure which levels they\u2019d need to reach to qualify for specific types of DoD contracts.<\/li>\n
  • The assessment process was confusing, and many contractors weren\u2019t sure which third-party consultant\u2019s evaluations the government would accept.<\/li>\n
  • Contractors complained that the numerous steps needed to reach even the lower certification levels made the process cost-prohibitive for their businesses.<\/li>\n<\/ul>\n

    Based on this feedback \u2014 which the government\u2019s CMMC website explains included more than 850 public comments \u2014 the DoD acted quickly, announcing a streamlined CMMC 2.0 just over a year after the original program\u2019s rollout.<\/p>\n

    CMMC Certification: Complicated But Achievable<\/strong><\/p>\n

    So, does CMMC 2.0 solve all of the challenges DIB companies faced with version 1.0? Not exactly. Here\u2019s what\u2019s changing with the new program:<\/p>\n

      \n
    1. Fewer levels: <\/strong>Streamlining the program from CMMC 1.0\u2019s five levels down to three was designed to make it easier for contractors to determine where on the cybersecurity hierarchy their contracts will require them to be.<\/li>\n
    2. Self-assessments: <\/strong>For certification to levels one and two, a contractor can now undergo a self-assessment process and affirm its compliance with the DoD\u2019s security standards. (Level three still requires evaluation by a qualified third party.)<\/li>\n
    3. Plans of Action and Milestones are allowed: <\/strong>Where CMMC 1.0 required businesses to complete the certification process before applying for contracts, DIB companies, in some cases, will now be allowed to begin competing for DoD business after submitting Plans of Action and Milestones (POAM) for achieving compliance. (They will then need to complete those plans within a several-month grace period.)<\/li>\n<\/ol>\n

      Although clearly a step in the right direction, the DoD\u2019s updated certification program still leaves many contractors confused. Here are just some of the open questions:<\/p>\n

        \n
      • How does a contractor determine which of the three certification levels to aim for?<\/strong> Some experts say level one should suffice for businesses that won\u2019t need to handle and store much CUI, but others argue that level two could be the minimum required to remain competitive for most future contracts.<\/li>\n
      • Is providing a self-assessment that claims compliance riskier than working with a third-party evaluator?<\/strong> After all, the company\u2019s senior executives will be held accountable for those claims. What will the penalties be if a DoD review later disagrees with the company\u2019s compliance claim?<\/li>\n
      • Should a DIB company that wants to become eligible for CUI-intensive contracts take the POAM option rather than waiting to complete the CMMC certification?<\/strong> That could lead to contractors sooner– but what happens if the business fails to complete the process in the allowed grace period? Could that result in the loss of a contract and a damaged reputation with the DoD?<\/li>\n<\/ul>\n

        Given these (and the many other) open questions, what should a DIB company do– particularly a non-technical DIB company with little expertise in cybersecurity or other data management best practices?<\/p>\n

        How to Streamline Your CMMC Certification<\/strong><\/h3>\n

        The DoD should be commended for actively seeking feedback from the DIB community after the launch of CMMC 1.0, acting quickly on that feedback to develop the streamlined 2.0, and ensuring the new version of the program addresses contractors\u2019 key concerns.<\/p>\n

        In a Defense Department statement on CMMC 2.0, Deputy Assistant Secretary for Industrial Policy Jesse Salazar said, \u201cBy establishing a more collaborative relationship with industry, these updates will support businesses in adopting the practices they need to thwart cyber threats while minimizing barriers to compliance with DoD requirements.\u201d It\u2019s encouraging to see the DoD\u2019s senior officials working to make it easier for businesses like yours to achieve compliance with these cybersecurity requirements. But if your company isn\u2019t in the IT or data management business, choosing correctly which of the three certification levels to aim for probably won\u2019t be much easier than finding the right level among the original five. Nor will completing an accurate self-assessment of your company\u2019s compliance with CMMC 2.0.<\/p>\n

        So, my recommendation is to work with a CMMC expert, such as a Managed Security Service Provider (MSSP) that specializes in helping government contractors cross the cybersecurity-compliance finish line. Yes, earning CMMC 2.0 certification is still a somewhat complicated undertaking. But you can make the process much quicker and less painful by partnering with a third-party firm that has done it for dozens of other DIB companies– companies now enjoying lucrative DoD contracts themselves.<\/p>\n


        Widget not in any sidebars
        <\/p>\n","protected":false},"excerpt":{"rendered":"

        Solutions Review\u2019s Expert Insights Series is a collection of contributed articles written by industry experts in enterprise software categories. Matthew Hodson of Valeo Networks lays out a clear path to more easily navigate the DoD’s CMMC 2.0 program. First, the bad news. Although the Department of Defense (DoD) has simplified the original version of its […]<\/p>\n","protected":false},"author":513,"featured_media":4364,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[551,1,43],"tags":[2183,2184,2186,2189,861,2185,2190,2187,532,2168,2188],"acf":[],"yoast_head":"\nNavigating the Confusing Compliance Environment of the DoD\u2019s CMMC 2.0<\/title>\n<meta name=\"description\" content=\"Matthew Hodson of Valeo Networks lays out a clear path to more easily navigate the DoD's CMMC 2.0 program.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/security-information-event-management\/navigating-the-confusing-compliance-environment-of-the-dods-cmmc-2-0\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Navigating the Confusing Compliance Environment of the DoD\u2019s CMMC 2.0\" \/>\n<meta property=\"og:description\" content=\"Matthew Hodson of Valeo Networks lays out a clear path to more easily navigate the DoD's CMMC 2.0 program.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/navigating-the-confusing-compliance-environment-of-the-dods-cmmc-2-0\/\" \/>\n<meta property=\"og:site_name\" content=\"SIEM Tools & Security Event Management | Solutions Review\" \/>\n<meta property=\"article:published_time\" content=\"2023-02-15T16:19:25+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-02-15T16:28:29+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/02\/Navigating-the-Confusing-Compliance-Environment-of-the-DoDs-CMMC-2.0.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Matthew Hodson\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Matthew Hodson\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/navigating-the-confusing-compliance-environment-of-the-dods-cmmc-2-0\/\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/navigating-the-confusing-compliance-environment-of-the-dods-cmmc-2-0\/\",\"name\":\"Navigating the Confusing Compliance Environment of the DoD\u2019s CMMC 2.0\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/navigating-the-confusing-compliance-environment-of-the-dods-cmmc-2-0\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/navigating-the-confusing-compliance-environment-of-the-dods-cmmc-2-0\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/02\/Navigating-the-Confusing-Compliance-Environment-of-the-DoDs-CMMC-2.0.jpg\",\"datePublished\":\"2023-02-15T16:19:25+00:00\",\"dateModified\":\"2023-02-15T16:28:29+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/00b91ab431d8c81f9ae06b46b9379f93\"},\"description\":\"Matthew Hodson of Valeo Networks lays out a clear path to more easily navigate the DoD's CMMC 2.0 program.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/navigating-the-confusing-compliance-environment-of-the-dods-cmmc-2-0\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/security-information-event-management\/navigating-the-confusing-compliance-environment-of-the-dods-cmmc-2-0\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/navigating-the-confusing-compliance-environment-of-the-dods-cmmc-2-0\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/02\/Navigating-the-Confusing-Compliance-Environment-of-the-DoDs-CMMC-2.0.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/02\/Navigating-the-Confusing-Compliance-Environment-of-the-DoDs-CMMC-2.0.jpg\",\"width\":800,\"height\":400,\"caption\":\"CMMC 2.0\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/navigating-the-confusing-compliance-environment-of-the-dods-cmmc-2-0\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Navigating the Confusing Compliance Environment of the DoD\u2019s CMMC 2.0\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\",\"name\":\"SIEM Tools & Security Event Management | Solutions Review\",\"description\":\"Evaluating Enterprise SIEM Systems, Log Management Analytics & SOAR Platforms.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/00b91ab431d8c81f9ae06b46b9379f93\",\"name\":\"Matthew Hodson\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/8d1e036d3252ad9f296e83d8979c4fcc?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/8d1e036d3252ad9f296e83d8979c4fcc?s=96&d=mm&r=g\",\"caption\":\"Matthew Hodson\"},\"description\":\"Matthew is the Co-Founder and CIO of Valeo Networks, overseeing all divisions and corporate marketing. Matthew specializes in the areas of vCTO, IT strategy, policy, budget, strategic partnerships, sales, process improvement, and Mergers & Acquisitions (M&A). He brings more than 21 years of experience in technology running an IT consulting firm and over 6 years co-running an MSP. Matthew is an avid foodie and enjoys numerous outdoor activities like hiking and snowboarding throughout the year.\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/author\/mhodson\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Navigating the Confusing Compliance Environment of the DoD\u2019s CMMC 2.0","description":"Matthew Hodson of Valeo Networks lays out a clear path to more easily navigate the DoD's CMMC 2.0 program.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/security-information-event-management\/navigating-the-confusing-compliance-environment-of-the-dods-cmmc-2-0\/","og_locale":"en_US","og_type":"article","og_title":"Navigating the Confusing Compliance Environment of the DoD\u2019s CMMC 2.0","og_description":"Matthew Hodson of Valeo Networks lays out a clear path to more easily navigate the DoD's CMMC 2.0 program.","og_url":"https:\/\/solutionsreview.com\/security-information-event-management\/navigating-the-confusing-compliance-environment-of-the-dods-cmmc-2-0\/","og_site_name":"SIEM Tools & Security Event Management | Solutions Review","article_published_time":"2023-02-15T16:19:25+00:00","article_modified_time":"2023-02-15T16:28:29+00:00","og_image":[{"width":800,"height":400,"url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/02\/Navigating-the-Confusing-Compliance-Environment-of-the-DoDs-CMMC-2.0.jpg","type":"image\/jpeg"}],"author":"Matthew Hodson","twitter_misc":{"Written by":"Matthew Hodson","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/navigating-the-confusing-compliance-environment-of-the-dods-cmmc-2-0\/","url":"https:\/\/solutionsreview.com\/security-information-event-management\/navigating-the-confusing-compliance-environment-of-the-dods-cmmc-2-0\/","name":"Navigating the Confusing Compliance Environment of the DoD\u2019s CMMC 2.0","isPartOf":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/navigating-the-confusing-compliance-environment-of-the-dods-cmmc-2-0\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/navigating-the-confusing-compliance-environment-of-the-dods-cmmc-2-0\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/02\/Navigating-the-Confusing-Compliance-Environment-of-the-DoDs-CMMC-2.0.jpg","datePublished":"2023-02-15T16:19:25+00:00","dateModified":"2023-02-15T16:28:29+00:00","author":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/00b91ab431d8c81f9ae06b46b9379f93"},"description":"Matthew Hodson of Valeo Networks lays out a clear path to more easily navigate the DoD's CMMC 2.0 program.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/navigating-the-confusing-compliance-environment-of-the-dods-cmmc-2-0\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/security-information-event-management\/navigating-the-confusing-compliance-environment-of-the-dods-cmmc-2-0\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/navigating-the-confusing-compliance-environment-of-the-dods-cmmc-2-0\/#primaryimage","url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/02\/Navigating-the-Confusing-Compliance-Environment-of-the-DoDs-CMMC-2.0.jpg","contentUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/02\/Navigating-the-Confusing-Compliance-Environment-of-the-DoDs-CMMC-2.0.jpg","width":800,"height":400,"caption":"CMMC 2.0"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/navigating-the-confusing-compliance-environment-of-the-dods-cmmc-2-0\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/security-information-event-management\/"},{"@type":"ListItem","position":2,"name":"Navigating the Confusing Compliance Environment of the DoD\u2019s CMMC 2.0"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website","url":"https:\/\/solutionsreview.com\/security-information-event-management\/","name":"SIEM Tools & Security Event Management | Solutions Review","description":"Evaluating Enterprise SIEM Systems, Log Management Analytics & SOAR Platforms.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/00b91ab431d8c81f9ae06b46b9379f93","name":"Matthew Hodson","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/8d1e036d3252ad9f296e83d8979c4fcc?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8d1e036d3252ad9f296e83d8979c4fcc?s=96&d=mm&r=g","caption":"Matthew Hodson"},"description":"Matthew is the Co-Founder and CIO of Valeo Networks, overseeing all divisions and corporate marketing. Matthew specializes in the areas of vCTO, IT strategy, policy, budget, strategic partnerships, sales, process improvement, and Mergers & Acquisitions (M&A). He brings more than 21 years of experience in technology running an IT consulting firm and over 6 years co-running an MSP. Matthew is an avid foodie and enjoys numerous outdoor activities like hiking and snowboarding throughout the year.","url":"https:\/\/solutionsreview.com\/security-information-event-management\/author\/mhodson\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/4363"}],"collection":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/users\/513"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/comments?post=4363"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/4363\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media\/4364"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media?parent=4363"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/categories?post=4363"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/tags?post=4363"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}