CMMC 2.0: What You Need to Know

To provide solutions to the US DoD, certain security standards must be adhered to. This guidance is evolving in the form of the Cybersecurity Maturity Model Certification (CMMC) framework, a revised 2.0 version of which has just been released. But what is CMMC, and how do defense contractors ensure they are compliant? We explore more in this blog.

What is the history of CMMC?

A notable rise in government-targeted cybercrime has been identified in recent years, particularly state-sponsored attacks that are increasingly sophisticated in their execution. Attackers began to specifically hunt for data, potentially compromising US national security.

In 2019 it was determined that existing cybersecurity guidance needed to be solidified further, at which point the Cybersecurity Maturity Model Certification (CMMC) was introduced, which has NIST 800-171 at the heart of it (more below). CMMC proposed a level-based approach for DoD contractors and was due to roll out in 2021.

The initial framework covered requirements for the safeguarding of the separation of data, access to data, physical security – i.e. access granted to buildings that handle data – and workflows, ensuring they adhered to the framework requirements.

The CMMC ranged from levels one through five, with level one being the ability to demonstrate a basic level of network and physical security hygiene. Level three showed that the contractor had implemented the guidance of NIST 800-171 from a technical implementation point of view, as well as adding additional policies and procedures around that.

Level five, meanwhile, applied mainly to prime contractors that deliver complex programs to the DoD and needed to show full compliance. Levels two and four were transitionary stages to levels three and five, respectively.

Importantly, CMMC introduced a certification process for all companies to prove they are compliant with the standard, and only by keeping up with your certification would you be able to bid on defense contracts.

For small and medium enterprises, this process posed challenges, and a potentially disproportionate amount of work would have to be carried out to win small pieces of work.

It also posed a heavy burden on the government to ensure that companies were certified in time for the 2025 deadline by which the majority of contracts would contain a CMMC certification clause.

While everybody agrees that cybersecurity compliance is essential to the interests of the DoD, companies called for a more accessible approach to demonstrating this compliance.

What is CMMC 2.0?

On November 4, 2021 the Pentagon announced a revised CMMC 2.0, which maintains the original framework’s goal of safeguarding sensitive information, but eases the burden on contractors and simplifies the process they have to follow.

So what are the major changes and implications from CMMC 1.0 to CMMC 2.0?

The tiers have been reduced from five to three, namely:

  • Level 1, a foundational level (also level one in the first iteration of CMMC);
  • Level 2, an advanced level (replacing level three); and
  • Level 3, an expert level (replacing level five).

Additionally, CMMC 2.0 waives the mandate for all contractors to be certified. Companies planning to achieve level one and subsets of level two requirements no longer need to be externally examined, but can instead self-assess against the clearly articulated cybersecurity standards.

Only the contractors managing information critical to national security – which will be categorized as a subset of level 2 – will be required to undergo third-party assessments. And all level three programs will require triannual assessments because they are critical defense acquisitions.

Another significant change is the removal of the hard requirement that contractors need to have certification in order to win any contracts. Plan of action & milestones (POA&M) with a firm timeline will be accepted for contracts, showing that companies have a timeline of when they expect to implement changes required to achieve particular levels.

While more information on the framework is expected to be released shortly, CMMC 2.0 is already showing itself to be a more simplified and achievable approach to safeguarding Controlled Unclassified Information (CUI). We also know that NIST 800-171 still remains at the heart of the DoD’s guidance and all its future frameworks.

What is NIST 800-171?

Security safeguard requirements such as multi-factor authentication are now commonplace, and more often than not, access to applications and online accounts needs to be verified in multiple ways before being granted.

But why is this important for defense? If cybersecurity is now a vital function for commercial devices, then the requirements for the safeguarding of government-level systems that process sensitive national security information must be an order of magnitude higher.

In the case of the US Department of Defense, defense contractors must adhere to the National Institute of Technology and Security’s (NIST) 800-171 Special Publication, which outlines the technical practices that contractors should follow to protect any networked systems from potential security breaches.

The 800-171 framework is mandated under Defense Federal Acquisition Regulation Supplement – or DFARS – regulation 7012, and covers all CUI, which is information either created or owned by the US government.

This has become the standard in the security and cybersecurity industry for implementing good cybersecurity hygiene practice and required if supplying to federal or state agencies.

Where does Elotek fit in and what are we doing?

We strongly believe in the importance of implementing best security practices at Elotek, so we have achieved level two adherence under CMMC 2.0. In order to continue to provide value to our customers and manufacturers, and to protect their sensitive data, we have also upgraded Office 365 to GCC High and our SalesForce to Government Cloud.




Microchip SyncServer S2xx/S3xx/S100 Internal Week Number Rollover event on September 18, 2022

Field Service Bulletin (FSB) / Customer Advisory Notice (CAN)




Systel Achieves AS9100D Quality Certification

Systel has achieved AS9100:2016 Rev D certification. AS9100 is a widely adopted quality management system for the aerospace and defense industry, encompassing ISO 9001:2015 with additional rigorous requirements.




Quasonix Data Quality Metric

Would you like to improve your telemetry link? How about your post-mission analysis? Or maybe you’d like to reduce the time, cost, and frustration of troubleshooting the link in the first place? If any of those are true, then Data Quality is your new best friend.

The Data Quality Metric is a measure of received signal quality. More specifically, it is an estimate of bit error probability (BEP). Quasonix RDMS™ displays a streamlined version of DQM known simply as “Q,” which ranges from zero to ten. A zero means there is no confidence that the bits have been received correctly; a ten indicates that the probability of bit errors is less than one in ten billion – essentially perfect data.

What’s “magical” about DQM is that it works all the time – with any data, even encrypted, and any data modulation. This is because determining the error probability of any given bit is done without knowing what the bit is supposed to be. DQM is calibrated and verified against a wide variety of signal impairments, making it not only highly accurate but also interoperable among equipment vendors.

Because it reliably indicates the real-time likelihood of an error for every bit received, DQM enables several key benefits: It is at the heart of the Best Channel Selector (BCS) built into our RDMS™. End-to-end mission performance can be evaluated using a recording of DQM from the Status Logger with no knowledge of the received data. DQM is a great diagnostic tool. For example, if you know the signal is clean (Q = 10) but your decomm still won’t sync, it’s very likely that your baseband encoding at the transmit end doesn’t match the decoding at the receiving end (randomizer, differential encoding, etc.). To learn more about Data Quality and how it fits into troubleshooting your link setup, read our new guide, DQM and RDMS™ Troubleshooting.




ViaLite RF over Fiber Mil-Aero 6 GHz Link Pair White Paper

Optimizing Telemetry Links in Mil-Aero Environments