1. Home
  2. |Insights
  3. |CMMC 2.0: DoD Unveils Sweeping Changes Streamlining CMMC Requirements

CMMC 2.0: DoD Unveils Sweeping Changes Streamlining CMMC Requirements

Client Alert | 1 min read | 11.05.21

The Department of Defense (DoD) recently announced significant changes to its Cybersecurity Maturity Model Certification (CMMC) program intended to simplify the requirements and ease the compliance burden on contractors.  Unlike its predecessor, the new CMMC 2.0 moves to three compliance levels rather than five; aligns the required security controls (known as practices) with National Institute of Standards and Technology (NIST) Special Publications (SP) 800-171 and 800-172; and eliminates entirely previously required maturity processes.  The changes also include a shift to self-assessments for all but contractors supporting the most sensitive programs, as well as the return of Plans of Action and Milestones (POAMs) to demonstrate compliance and achieve certification. 

The new requirements are summarized below:

  • CMMC Level 1, Foundational – Contractors must implement the 17 controls from NIST SP 800-171 enumerated in FAR 52.204-21 and submit an annual self-assessment to the DoD through the Supplier Performance Risk System (SPRS).  
  • CMMC Level 2, Advanced – Contractors must implement the 110 controls in NIST SP 800-171 and submit an annual self-assessment or, if required to handle (as yet undefined) critical national security information, a triennial independent assessment performed by a CMMC Third Party Assessment Organization (C3PAO). 
  • CMMC Level 3, Expert – Contractors must implement the 110 controls in NIST SP 800-171 and a subset of controls from NIST SP 800-172 before undergoing a triennial government-led assessment.  The DoD, however, is still in the process of developing the requirements for this Level.

CMMC 2.0 will be implemented through the rulemaking process, which the DoD estimates could take anywhere from nine months to two years.  Thereafter, the DoD will begin to incorporate CMMC 2.0 requirements into contracts.  In the meantime, the DoD has suspended its CMMC pilot program and will not approve the inclusion of CMMC requirements in any forthcoming DoD solicitations.

Contacts

Insights

Client Alert | 2 min read | 11.14.25

Defining Claim Terms by Implication: Lexicography Lessons from Aortic Innovations LLC v. Edwards Lifesciences Corporation

Claim construction is a key stage of most patent litigations, where the court must decide the meaning of any disputed terms in the patent claims.  Generally, claim terms are given their plain and ordinary meaning except under two circumstances: (1) when the patentee acts as its own lexicographer and sets out a definition for the term; and (2) when the patentee disavows the full scope of the term either in the specification or during prosecution.  Thorner v. Sony Comput. Ent. Am. LLC, 669 F.3d 1362, 1365 (Fed. Cir. 2012).  The Federal Circuit’s recent decision in Aortic Innovations LLC v. Edwards Lifesciences Corp. highlights that patentees can act as their own lexicographers through consistent, interchangeable usage of terms across the specification, effectively defining terms by implication....

View All Insights