CMMC - Frequently Asked Questions

6. Why is CMMC 2.0 important for DOD Vendors in 2024 and 2025?

In December 2023, the DoD submitted the CMMC 2.0 rule for review. That cleared the way for its official rollout in contracts, as early as May 2024. That made CMMC critical for defense contractors in 2024 and 2025. Here is why:

• Compliance becomes mandatory: CMMC 2.0 phases in required assessments. They are based on contract value and CUI access level. If you do not comply, you can face exclusion from DoD contracts.
• Stronger security posture: CMMC builds the cyber resilience of the defense industrial base. It guards sensitive data and critical infrastructure. That is good for the country. It is good for vendors too, as long as they keep pace as the rules change.
• Level playing field: CMMC sets one standard approach to cybersecurity. That keeps the field fair for every contractor. The DoD plans to publish the standard, so each vendor knows what is expected.

Remember: CMMC takes planning, assessment, and often work to fix gaps. Advice from CMMC-accredited consultants helps a lot.

(Back to question list)

7. When do I need to be ready for CMMC?

The DoD said its CMMC 2.0 rulemaking would take 9 to 24 months. The clock started when the DoD announced the plan in July 2023. So vendors could see CMMC enforcement start as early as May 2024. The roll out could stretch into Q2 or Q3 of 2025. Experts have urged vendors to start CMMC readiness work since 2024. The DoD published rules in December of 2023 and has been clear that the new rules are the standard.

If you are a DoD vendor, your own timeline turns on a few factors:

• Contract value: Higher-value contracts need assessments sooner.
• CUI access level: Higher levels of CUI access mean earlier compliance.
• DoD guidance updates: The DoD may adjust the rollout as things develop.

(Back to question list)

8. What is involved with CMMC Readiness?

Essendis highly recommends that defense contractors check their CMMC readiness early. Here is how:

• Learn the CMMC 2.0 requirements.
• Run a self-assessment to find gaps in your cybersecurity practices.
• Build a plan to close those gaps.
• Get guidance from CMMC-accredited experts for help and resources.

Know the CMMC history, timeline, and importance. That is how defense contractors stay ahead and keep winning DoD work. Essendis can help you find out how prepared you are for CMMC.

(Back to question list)

9. What does a CMMC Audit Entail?

A CMMC audit is run for the DoD. It looks at your whole business and your IT setup. The goal is to prove that you protect Controlled Unclassified Information (CUI). How deep the audit goes varies with the size and nature of your DoD work. Even so, expect certified experts to review every part of your cybersecurity practices in detail.
‍
See the exact practices they check on our CMMC Level 1 and CMMC Level 2 pages.

(Back to question list)

10. Who Needs to be prepared for CMMC?

Once CMMC 2.0 is fully rolled out, every DoD vendor, contractor, and sub-contractor must be ready for an audit. You may not hold a DoD contract yourself. But if one of your customers works on government contracts, your work may still touch Controlled Unclassified Information (CUI). That alone can qualify you for an audit. So as a DoD subcontractor, find out whether you handle CUI.
‍
Two groups should get ready for CMMC 2.0 and a government cybersecurity audit:

1. Companies that contract directly with the DoD on work that involves Controlled Unclassified Information (CUI).
2. Vendors and subcontractors to firms that support Department of Defense work (a “DoD Prime”), when their work involves CUI under the contract.

(Back to question list)

11. Does my company handle CUI?

Not sure if your data counts as CUI? It is easy to find out:

1. Check your DoD contracts for CUI wording or DFARS clauses like DFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting).
2. Ask your legal or contracting team for a firm answer on CUI. Then book a CMMC readiness consultation to learn more.

(Back to question list)

12. What Industries will CMMC impact First/most?

CMMC 2.0 reaches more industries than past DoD cybersecurity models. In time the standards will cover the whole DoD supply chain. The first focus is on the industries most critical to national security:

• Defense contractors (Prime and sub-contractors)
• Aerospace and defense manufacturers
• Information technology (IT) service providers
• Engineering service firms
• Supply chain management (technology and service)

Remember: the key factor for CMMC audits is whether you handle CUI. And the type and timing of a CMMC audit turn on your contract and your DoD work.

(Back to question list)

13. How will CMMC impact Saas Companies?

CMMC 2.0 mainly targets Defense Industrial Base (DIB) companies that hold government contracts. But your SaaS product may store or process Controlled Unclassified Information (CUI) for DoD contractors. If it does, CMMC compliance may be the price of keeping their business.

Run or advise a SaaS company? Here is the impact:

• Increased Scrutiny: DoD contractors will look for SaaS providers with proven cybersecurity practices that match CMMC rules.
• Compliance Demands: To keep DoD clients, you may need assessments to prove your CMMC level. That can cost extra.
• Competitive Advantage: Proof of CMMC compliance sets you apart. It draws new DoD contractor clients who want secure tools.

(Back to question list)

14. Who at a company should be worried about CMMC?

CMMC tasks often land with IT and cybersecurity teams. But the duty to understand the rules and meet them is shared across:

• Individuals directly involved in:
  - Security and compliance
  - Contract acquisition and management
  - Data management and protection
  - Supply chain management
• Senior leaders who own risk management and strategy.

(Back to question list)

15. What do I Need to know about CMMC? - CISSP / CTO / CFO

Do you own cybersecurity at your company? If a CMMC 2.0 audit is coming, talk to a Certified Information Systems Security Professional (CISSP). A CISSP brings the DoD-specific know-how you need. That is how you reach real CMMC readiness.
‍
Are you a CTO, CFO or COO? Use these steps as your road map to CMMC readiness:

1. Get Executive Buy-In: Your leaders must commit. They need to fund CMMC compliance and align your sub-contractors.
2. Involve your CFO: Build CMMC costs into the budget. Money spent early saves money later.
3. Complete an IT Assessment: Review your IT setup and security practices in full. Find the gaps.
4. Retain CISSP Expertise: Use CISSP-certified staff to build a strong compliance plan.
5. Find and Use CMMC Resources: Use firms that specialize in CMMC 2.0. Add CMMC-AB (CMMC Accreditation Body) approved resources to train your team.

(Back to question list)