The Department of Defense requires contractors handling controlled unclassified information to meet cybersecurity standards, and is phasing in certification under the Cybersecurity Maturity Model Certification program.
NIST 800-171
The underlying standard: 110 security controls covering access, training, incident response and more. Self-assessment and scoring are already required under DFARS.
CMMC
Adds third-party certification at higher levels. Rollout is phased into solicitations over several years.
Advertisement
What to do
Know whether you handle CUI. Conduct a gap assessment. Budget for remediation. Do not wait for the solicitation that requires it.
Beacon helps clients understand which requirements apply and plan compliance.