News
February 11, 2022
Published in Architecture and Governance Magazine
By: David Touchton and Jeremy Good
The Cybersecurity Maturity Model Certification (CMMC) 2.0 is a hot topic right now, and for good reason! It will require any company that does business with the federal government and stores sensitive information to comply with an extensive set of cybersecurity policies and go through an audit by an approved third party. This regulation can impact companies who simply store sensitive information as well. And while the latest version (2.0) was released in November of 2021 and may take up to two years to reach final approval by the Pentagon, obtaining a favorable rating of compliance will take time and work; companies who store sensitive data are urged not to postpone implementing the changes needed to comply with CMMC.
CMMC aims to unify and strengthen cybersecurity practices to avoid data leaks. It requires companies conduct a third-party assessment of their security protocols. The type of sensitive data can wildly vary depending on the contracts a company is awarded; for example, sensitive information concerning security clearances, construction information about building DoD facilities that must protect the amount of information known about the building, training programs for DoD special forces, and companies with DoD contracts building military vehicles. Each sector detailed has a varying degree of sensitive information that the DoD does not want in the public space.