[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-202637-105":59,"doc-detail-202637-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","cybersecurity-maturity-model-certification-cmmc-an-introduction-why-this-why-now","Cybersecurity Maturity Model Certification (CMMC) - An Introduction - Why this? Why now?","","Cybersecurity Maturity Model Certification (CMMC) introduces a risk-based approach to cybersecurity requirements for U.S. Department of Defense contractors, tying obligations to the data handled in a contract. The agenda explains why the model is needed now, defines CMMC as a shift from trust and self-assessment to verification and third-party certification, and outlines how required maturity levels flow from prime contractors to subcontractors. It also summarizes the CMMC framework, model structure, maturity levels for process and cyber hygiene practices, and the standards behind the model.",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":30,"@type":76,"position":81},"https://docshare.wps.com/document/technology/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/cybersecurity-maturity-model-certification-cmmc-an-introduction-why-this-why-now/202637/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/cybersecurity-maturity-model-certification-cmmc-an-introduction-why-this-why-now/202637.png","ImageObject",300,407,{"name":92,"@type":93},"Theodora","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-07","2026-09-04",true,{"@type":102,"interactionType":103,"userInteractionCount":44},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"What is CMMC and who does it apply to?","Question",{"text":112,"@type":113},"CMMC is the Cybersecurity Maturity Model Certification, a new approach to cybersecurity requirements for contractors working with the U.S. Department of Defense (DoD). It focuses on meeting required maturity levels based on the contract’s data types.","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"How does CMMC determine which maturity level a contractor must meet?",{"text":117,"@type":113},"Each DoD contract specifies a required maturity level, driven by the type of data in the contract. Prime contractors then flow the required maturity level down to subcontractors across all tiers.",{"name":119,"@type":110,"acceptedAnswer":120},"What standards influence CMMC?",{"text":121,"@type":113},"CMMC maps to NIST SP 800-171 with additional selected controls in tiers 2–5 from other established sources. It also draws from other standards such as UK NCSC Cyber Essentials, Australian ACSC Essential Eight, and CIS Controls.","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},202637,1788549584,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":29,"category_name":30,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":44,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":139,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":129,"read_time":144},687197207919,"https://ap-avatar.wpscdn.com/avatar/a000253d6f5f7c60be?x-image-process=image/resize,m_fixed,w_180,h_180&k=1779446848396160552","Cybersecurity Maturity Model Certification (CMMC)   \nAn Introduction  \nLinda Rust, CISSP, CISM, PMP  \n[Linda.Rust@SecuriThink.com](Linda.Rust@SecuriThink.com)  \n© 2021 SecuriThink Corporation  \n1  \nAgenda  \n| 1 | Why this? Why now?\u003Cbr>-CMMC as risk-based data protection |\n| --- | --- |\n| 2 | What is CMMC?\u003Cbr>-Framework\u003Cbr>-Model: structure & processes maturity\u003Cbr>-Model: maturity of cyber hygiene practices |\n| 3 | Where does CMMC come from?\u003Cbr>-Standards\u003Cbr>-Contract clauses |\n| 4 | What is the timeline? |\n| 5 | The Bottom Line: Expected results |\n\n© 2021 SecuriThink Corporation  \n2  \nWhy this? Why now?  \n• $570 Billion- $1.09 Trillion The estimated value of stolen intellectual property and sensitive information across all U.S. industrial sectors over 10 years  \n• 36-54%  \nThe estimated implementation of current DoD* cybersecurity requirements in place since 2013  \n* DOD = U.S. Department of Defense  \nSource: Industry 4.0 and cybersecurity-managing risk in an age of connected production. Deloitte.  \n© 2021 SecuriThink Corporation  \n3  \nCMMC is Risk-Based Data Protection  \n• CMMC is driven by the kind of data in a contract  \n• Federal Contract Information (FCI)  \n– “Information not intended for public release. It is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government. FCI does not include information provided by the Government to the public.”1  \n– Federal Acquisition Regulation (FAR) 52.204-21 specifies 15 “Basic Safeguards” equivalent to CMMC level 1  \n• Controlled Unclassified Information (CUI)  \n– “Information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies but is not classified under Executive Order 13526 or the Atomic Energy Act”2  \n– DoD contracts with CUI specify 100 cybersecurity controls of the 130 in CMMC level 3  \n• Under CMMC, each DoD contract will specify a required Maturity Level  \n– Prime contractors will specify the required Maturity Level in flow down to subcontractors  \nSources:  \n1. FAR 52.204-21  \n2. U.S. National Archives – About CUI  \n4  \nWhat is CMMC?   \n• Cybersecurity Maturity Model Certification (CMMC)  \n• New approach to cybersecurity requirements for contractors to the U.S. Department of Defense (DoD)  \n\n| Current DoD Cybersecurity Requirements | CMMC |\n| --- | --- |\n| Based on trust | Based on trust with verification |\n| Self-assessment | Third party assessments conducted by authorized and accredited organizations |\n| Self-attestation of compliance at time of contract award | Certification must be complete before contract award; three-year renewal cycle |\n| Each company is responsible for its own compliance and to “flow down” the requirements to all of its subcontractors | The prime contractor which has the agreement directly with the DoD is responsible to ensure valid certification of all subcontractors at all tiers of the bidding team |\n| Incomplete implementation of compliance controls may be documented on a Plan of Action with Milestones (POAM) | Compliance levels from 1 (basic) to 5 (advanced); no incomplete items allowed beyond a 90-day post assessment remediation period |\n| Based on U.S. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 | Based on NIST SP 800-171 with selected controls added in tiers 2-5 from other respected sources |\n| No process maturity requirement | CMMC tiers 2-5 include progressively higher requirements for process maturity |\n\n5  \nCMMC Framework  \n•CMMC-AB = CMMC Accreditation Body  \n•Authorized by exclusive contract with DoD  \n•ISO 17011:2017 certification required by DoD by Oct 2022  \n•Certifies C3PAO’s and Assessors  \nSource: CMMC-AB Standards Committee Town Hall May 2020  \n•Certified Third Party Assessment Organizations (C3PAO’s)  \n•ISO 17020 certification required by DoD  \n•Assessors must be certified by the Accreditation Body  \n•Certifies Organizations Seeking Cert","cbCaimthc6nLVa11","https://ap.wps.com/l/cbCaimthc6nLVa11","pdf",1765001,15,"English","# Agenda\n## Why this? Why now?\n## What is CMMC?\n## Where does CMMC come from?\n## What is the timeline?\n## The Bottom Line: Expected results\n# Why this? Why now?\n# CMMC is Risk-Based Data Protection\n## Federal Contract Information (FCI)\n## Controlled Unclassified Information (CUI)\n# What is CMMC?\n## Current DoD Cybersecurity Requirements vs CMMC\n# CMMC Framework\n# CMMC Model Structure\n# CMMC Model Maturity\n# Maturity in CMMC Cyber Hygiene Practices\n# Where Does CMMC Come From? Mapping to Standards","[{\"question\":\"What is CMMC and who does it apply to?\",\"answer\":\"CMMC is the Cybersecurity Maturity Model Certification, a new approach to cybersecurity requirements for contractors working with the U.S. Department of Defense (DoD). It focuses on meeting required maturity levels based on the contract’s data types.\"},{\"question\":\"How does CMMC determine which maturity level a contractor must meet?\",\"answer\":\"Each DoD contract specifies a required maturity level, driven by the type of data in the contract. Prime contractors then flow the required maturity level down to subcontractors across all tiers.\"},{\"question\":\"What standards influence CMMC?\",\"answer\":\"CMMC maps to NIST SP 800-171 with additional selected controls in tiers 2–5 from other established sources. It also draws from other standards such as UK NCSC Cyber Essentials, Australian ACSC Essential Eight, and CIS Controls.\"}]","Cybersecurity Maturity Model Certification (CMMC) - An Introduction - Why this? Why now? | PDF",38]