Cybersecurity

The Cybersecurity Maturity Model Certification (CMMC) 2.0 is a comprehensive framework launched by the Department of Defense (DoD) to protect the Defense Industrial Base (DIB) from increasingly frequent and complex cyber-attacks. It particularly aims to safeguard information defined as Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) shared within the DIB.

CMMC 2.0 builds on existing trust-based regulations (DFARS 252.204-7012) by adding a verification component for cybersecurity requirements. The program has three key features:

• Tiered Model: CMMC requires that companies entrusted with national security information implement cybersecurity standards at progressively advanced levels, depending on the type and sensitivity of the information. This regulation also sets forward the process for requiring protection of FCI and CUI information that is flowed down to subcontractors.
• Assessment Requirement: CMMC assessments allow the DoD to verify the implementation of clear cybersecurity standards though use of approved auditors.
• Implementation through Contracts: Once CMMC is fully implemented, certain DoD contractors that handle FCI and/or CUI information electronically will be required to achieve a particular CMMC level as a condition of contract award.

It is imperative that all HII subcontractors and/or suppliers that receive and generate FCI and/or CUI meet these new DFARS requirements to be eligible for future work that will contain CMMC 2.0 requirements. Together our continued diligence will protect vital information, minimize risks and secure a competitive advantage for all parties.