The basic premise of the CMMC is to ensure that by 2025, all the DoD supply chain contractors and subcontractors, except for the providers of commercial-off-the-shelf products, should get a third-party certification for their proficiency in cybersecurity before embarking on the awarded contract.
Controlled Unclassified Information (CUI) refers to information that requires safeguarding or dissemination controls under federal regulations or government-wide policies. CUI is a result of Executive Order 13556, which aims to standardize the management and protection of unclassified information across federal agencies.
Streamline Your NIST SP 800-171 Compliance with Our Assessment Template: A Comprehensive Guide to Evaluating and Enhancing Your Organization’s Cybersecurity Posture
The DoD’s current cybersecurity regulations are specified in the Defense Federal Acquisition Regulation Supplement (DFARS), released in 2015. DFARS required the defense contractors handling Controlled Unclassified Information (CUI) to build resilient cybersecurity infrastructure following the 110 security controls specified by the National Institute of Technology and Standards Special Publication 800-171 (NIST SP 800-171) by the end of 2017.
What is SP 800-171 Rev. 2?
SP 800-171 Rev. 2 is a set of cybersecurity requirements developed by the National Institute of Standards and Technology (NIST) to protect controlled unclassified information (CUI) stored on non-federal information systems. Released in 2020 (updates to January 28, 2021), it aligns with NIST’s Cybersecurity Framework (CSF) and aims to safeguard sensitive information, such as technical data, export-controlled information, or sensitive government information.
BREAKING NEWS: NIST Unveils Public Draft for Strengthening Security of Controlled Unclassified Information
The National Institute of Standards and Technology (NIST) has just released an initial public draft of a groundbreaking document, SP 800-171, Revision 3. This draft aims to bolster the security requirements and protocols necessary to safeguard sensitive federal information from unauthorized disclosure, in nonfederal systems and organizations.
We’re happy to answer any questions you may have and help you determine which of our services best fit your needs.
Schedule an initial meeting
Arrange a discovery and assessment call
Tailor a proposal and solution
