CMMC 2.0: DoD Unveils Sweeping Changes Streamlining CMMC Requirements
Client Alert | 1 min read | 11.05.21
The Department of Defense (DoD) recently announced significant changes to its Cybersecurity Maturity Model Certification (CMMC) program intended to simplify the requirements and ease the compliance burden on contractors. Unlike its predecessor, the new CMMC 2.0 moves to three compliance levels rather than five; aligns the required security controls (known as practices) with National Institute of Standards and Technology (NIST) Special Publications (SP) 800-171 and 800-172; and eliminates entirely previously required maturity processes. The changes also include a shift to self-assessments for all but contractors supporting the most sensitive programs, as well as the return of Plans of Action and Milestones (POAMs) to demonstrate compliance and achieve certification.
The new requirements are summarized below:
- CMMC Level 1, Foundational – Contractors must implement the 17 controls from NIST SP 800-171 enumerated in FAR 52.204-21 and submit an annual self-assessment to the DoD through the Supplier Performance Risk System (SPRS).
- CMMC Level 2, Advanced – Contractors must implement the 110 controls in NIST SP 800-171 and submit an annual self-assessment or, if required to handle (as yet undefined) critical national security information, a triennial independent assessment performed by a CMMC Third Party Assessment Organization (C3PAO).
- CMMC Level 3, Expert – Contractors must implement the 110 controls in NIST SP 800-171 and a subset of controls from NIST SP 800-172 before undergoing a triennial government-led assessment. The DoD, however, is still in the process of developing the requirements for this Level.
CMMC 2.0 will be implemented through the rulemaking process, which the DoD estimates could take anywhere from nine months to two years. Thereafter, the DoD will begin to incorporate CMMC 2.0 requirements into contracts. In the meantime, the DoD has suspended its CMMC pilot program and will not approve the inclusion of CMMC requirements in any forthcoming DoD solicitations.
Contacts
Partner, Crowell Global Advisors Senior Director
- Washington, D.C.
- D | +1.202.624.2698
- Washington, D.C. (CGA)
- D | +1 202.624.2500
Insights
Client Alert | 3 min read | 10.10.25
New Post Appeals Mediation Pilot Program
On October 1, 2025, the IRS Independent Office of Appeals launched a two-year pilot program to make Post Appeals Mediation (PAM) more attractive and accessible to taxpayers. See IRS Announcement 2025-10. The new PAM pilot program offers taxpayers the opportunity to be assigned to a new Appeals team, which is otherwise unconnected to the underlying case, who will represent the original Appeals team in the mediation session. The assignment of the new Appeals team does not begin a new appeals process but rather is intended to help facilitate an expedited and impartial look at the underlying case with the goal of further exploring all potential paths to resolution prior to litigation.
Client Alert | 1 min read | 10.09.25
New California Algorithmic Pricing Law Could Have Far Reaching Effects
Client Alert | 5 min read | 10.08.25
California’s AI Transparency Act (CAITA) May be Amended to Regulate Social Media Platforms
Client Alert | 6 min read | 10.08.25
Hacker No Fly Zone: FAA and TSA Propose Cybersecurity Rules for Drone Ecosystem