Tag: Department of Defense

The Pentagon announced an ‘immediate suspension’ of CMMC phase II requirements, what this means and how to proceed
The Department of Defense (now War under President Trump) announced this week they’re suspending all Cybersecurity Maturity Model Certification (CMMC) Phase II requirements effectively immediately. The requirements were originally scheduled to come into effect November 10^th, 2026, these requirements would have required the DoD to be involved in third-party cybersecurity assessments involving sensitive but classified data. Phase requirements that require a CMMC self-assessment and began last November will stay in place as of the time being.

The Pentagon announced they will be doing a “top-to-bottom” review of the CMMC certification program over the next 60 days, the memo released by DoD Chief Information Officer Kristin Davies suggests that the program has come into conflict with Defense Secretary Pete Hegseth’s initiatives to eliminate government bureaucracy and enable more innovation by removing guardrails.

“The current iteration of the Cybersecurity Maturity Model Certification (CMMC) program, while intended to enhance security, imposes significant and often prohibitive burdens on the Defense Industrial Base (DIB), particularly the small and non-traditional businesses that are the engine of American innovation,” Davies wrote. “While cybersecurity is essential, administrative compliance cannot come at the cost of warfighting capability and industrial base growth.” – DoD Chief Information Officer Kristin Davies

In addition to removing the November deadline for third-party assessments the memo suspends all pending and future CMMC milestones “until further notice”. Before this announcement some DoD offices had already began conducting third-party assessments in advance. It’s clear from the memo that this move is intended to remove hindrances from DIB contractors and speed up innovation and capacity within that base to further the goals of the current administration.

However, this change has left many defense contractors uncertain how to proceed. The CMMC program in general has experienced a host of changes since it’s inception in 2010 under an executive order from President Obama. It’s goal was to provide a standard for cyber security for defense contractors who handle controlled unclassified data (CUI) and it wasn’t until 2019 that development on the program actually began.

Self-attestation was originally only meant for very small contractors handling limited CUI while larger contractors and more complete DoD contracts would eventually require third-party assessments and more rigorous levels of cyber security hygiene. Even the DoD itself failed to measure up to the tough requirements outlined in the program.

The CMMC assessment industry has also been booming since the program was implemented and this news will leave many of those outfits in limbo, DoD contractors were using the C3PAO assessment to be officially CMMC certified and for CMMC audits. CMMC C3PAO assessors have received specialized training to be authorized to conduct CMMC assessments and guide organizations through their CMMC journey.

CMMC shares overlap with NIST 800-171 compliance (NIST is also the inspiration for many other cybersecurity frameworks such as CIS) and while the third-party audit portion may be paused at the moment, we still recommend businesses strive to meet compliance with their chosen cyber security framework just as a matter of good practice.

Cyber security framework compliance helps your business:
1. Reduces the chance of a successful cyberattack
  A framework like the NIST Cybersecurity Framework helps a business identify weak passwords, missing updates, excessive permissions, unsecured devices, and other common gaps before attackers exploit them.
2. Limits damage when an incident occurs
  Clear access controls, network protections, backups, endpoint security, and incident-response procedures can keep a compromised account or computer from turning into a business-wide disaster.
3. Improves detection and response time
  Logging, monitoring, alerting, and documented escalation procedures help the business recognize suspicious activity sooner and respond consistently instead of improvising during a crisis.
4. Protects business operations and customer data
  The framework encourages reliable backups, recovery testing, data classification, vendor oversight, and continuity planning. These controls help the company continue operating after ransomware, equipment failure, or account compromise.
5. Builds trust and supports compliance requirements
  Following a recognized framework demonstrates that cybersecurity is being managed systematically. This can help with cyber-insurance applications, customer security questionnaires, contractual requirements, audits, and regulated-data obligations.
As a managed service provider, we help our clients meet compliance requirements for NIST, CMMC, CIS, HIPAA, WISP and more. It can be difficult for a small or medium-sized business to tackle and maintain the security features implemented alone, we suggest working with a trusted partner in this process.

For CMMC contractors, at this point it is too early to know what will happen in the future or with the program in general but the protections that have been put in place to meet the requirements are still a net positive for your business’s security posture. If scaling up your business’s security goals and addressing compliance requirements is on your radar for 2026, Valley Techlogic can be your trusted partner in the process. Learn more today through a consultation.
This article was powered by Valley Techlogic, leading provider of trouble free IT services for businesses in California including Merced, Fresno, Stockton & More. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on X at https://x.com/valleytechlogic
July 17, 2026
CMMC Series: Preparing for your assessment
This is our fifth article on this topic and as we bring it to a close, I’d like to first look back at what we’ve covered so far.

We started the series looking at what’s ahead for the Cybersecurity Maturity Model Certification (CMMC) program in 2022. Then we covered tiers one, two and three as they exist in the current 1.0 model of the program. We’re anticipating that tiers two and three will be merged going forward as version 2.0 rolls out (placing a larger burden on defense contractors looking to scale past the beginner controls in tier one and become more competitive in the marketplace).

So, if you’re reading this you’ve hopefully begun the process of implementing the controls within your business and are thinking it’s time to begin the process of obtaining your certification. There are several steps that come before actually obtaining your certification (although it should be noted that the CMMC Accreditation Body is currently in the process of hiring and waiting lists for certification could be lengthy at this time). The sooner you begin implementing the CMMC controls within your business, the sooner you can attempt to get on the waiting list to receive your certification.

The assessment process will follow these steps:
1. You will need to begin implementing a plan for CMMC within your business, and conduct a self-assessment against the NIST 800-171 (or partner with a provider like Valley Techlogic to assist you with this).
2. As you improve your processes you can submit your score to the Department of Defenses’ (DoD) Supplier Performance Risk System (SPRS).
3. From there you will need to identify the scope you wish to obtain for your business (it’s our opinion maturity level 3 will be required for most defense contractors in the future).
4. Obtain a third-party gap assessment, this will show you where your business is and where it needs to be to achieve your goals.
5. After addressing the gaps found in the assessment, you can look to the CMMC Accreditation Marketplace and choose a CMMC Third-Party Assessment Organization (C3PAO) to conduct your CMMC assessment.
6. The CMMC Accreditation Body will review the assessment submitted by your C3PAO and award you your CMMC certification.
Of course, this is boiling down many months (or even years) of preparation into what looks like 6 easy steps. The process will be time consuming and potentially costly, but for those who wish to continue doing business with the DoD it’s a necessary investment in the future.

As we’ve mentioned in past articles on the topic, defense contractors who refuse to comply with the CMMC process will no longer be eligible for defense contracts in the future. Beyond that, if you reach a higher level of certification, you will be in a better position to receive more contracts as it will be used as a comparative tool going forward.

If you’re like assistance with the CMMC self-assessment process or preparing for your CMMC AB assessment, Valley Techlogic has experience in this area. We have helped businesses begin the process of becoming CMMC ready, if you’d like to learn more schedule a consultation with our experts today.

Looking for more to read? We suggest these other articles from our site.
This article was powered by Valley TechLogic, IT service provider in Atwater, CA. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on Twitter at https://x.com/valleytechlogic.
February 4, 2022
CMMC Series: Tier Two Overview
This is the third week of our Cybersecurity Maturity Model Certification (CMMC) Series. You can find week one, which was a look at what’s happening with CMMC in 2022 here. Last week, we gave you an overview of tier one which you can review here.

Tier one in CMMC really covers the basic foundational steps you must take to move on to tier two and tier three. For some contractors, tier one will be enough to keep and maintain compliance with their Department of Defense (DoD) contracts. Every situation is unique, but broadly speaking if you don’t handle Controlled Unclassified Information (CUI) in your business – tier one will probably be the extent that you need to reach.

If you do handle any CUI data, then we recommend you strive towards tier two or tier three. Many of the protections that come in the later tiers specifically cover how to safeguard this data and it’s in your businesses best interest to meet the requirements. While there are no direct financial penalties at the time of writing for not doing so, the DoD is considering a system of rewarding businesses who achieve greater CMMC maturity levels.

If you and another business are exactly the same in what you do and, in your pricing, – or even if their pricing is a bit higher than yours – if they have achieved tier three cybersecurity maturity model certification and your business is tier one or not certified at all yet, it’s likely your competitor will win the bid.

So, what goes into reaching tier two in CMMC?

Tier two is the next milestone within CMMC, and the difficulty does scale considerably with each level. While tier one had 17 provisions, tier two introduces 55 more for a total of 72 practices you’ll need to cover to meet the requirements (the practices are cumulative).

In addition to more practices tier two also introduces new domains.

First there is Access Control, tier two access control looks to limit access to who can log into your organizations systems (and how much they can access when they do).

Next is Awareness and Training, in tier two you will need to make sure your managers, administrators and anyone else you who would have access to sensitive systems is attending regular cybersecurity training.

In Audit and Accountability, we look to maintain logs of user activity for review.

Security Assessment is where we really begin to see accountability being held on organizations, you will need to conduct regular assessments as you work towards your cybersecurity goals and develop cybersecurity plans based on the assessment results.

Configuration Management covers the need to manage the configurations of your office devices and equipment with cybersecurity best practices in mind.

Identification and Authentication is similar to access control, but it specifically looks to limit sensitive systems to only those who should have authorization to access them.

While tier one in CMMC only covered the basics and didn’t address what happens when you have a cyber incident, tier two starts to cover that with the Incident Response control.

The Maintenance control in tier two actually refers to your devices and how you maintain them, and what you will need to do in case of their failure.

Media Protection in tier two covers specific provisions around the handling and destruction of removable media, such as flash drives.

We started looking at Physical Protection in tier one by keeping visitor logs, but tier two asks that you actually begin to escort guests through your facilities and screening personnel.

Tier one surprisingly doesn’t ask that you backup your data (even though we would always recommend that) – in tier two Recovery you must have a plan for backing up your data.

In tier two Risk Management, CMMC asks that you begin to conduct risk assessments and fix any vulnerabilities that are uncovered during the process.

Systems and Communications Protection in tier two includes controlling communications within your organization, not just monitoring them.

Finally, the System and Information Integrity domain covers actively monitoring your systems for breaches and quickly resolving any that come up.

As you can see, CMMC maturity tier two dives into the deep end of cybersecurity, but the provisions it covers will make a discernible impact in your cyber readiness throughout your entire business.

Does your business need to meet the requirements for being certified with CMMC? Valley Techlogic can help, we have experience helping DoD contracted businesses reach their cybersecurity and CMMC goals, as well as helping with the certification process itself. Learn more today in a free consultation.

Looking for more to read? We suggest these other articles from our site.
This article was powered by Valley TechLogic, IT service provider in Atwater, CA. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on Twitter at https://x.com/valleytechlogic.
January 21, 2022
Cybersecurity Maturity Model Certification 2.0 has been announced, what it means for you and your business
If you’re a contractor or subcontractor for the Department of Defense (DoD) you probably at least have an awareness of the evolving situation surrounding the CMMC (Cybersecurity Maturity Model Certification) program, or maybe you’ve even begun the self-assessment process.

Announced summer of 2019, version 1.0 was released January 31^st, 2020, and a 5 year roll out was planned to get DoD contractors and subcontractors compliant with the framework. The framework is based on the security controls found in the National Institute of Standards and Technology (“NIST”) Special Publication (“SP”) 800-171, with many of the security controls found in CMMC having a direct correlation to a control found in NIST 800-171.

While the initial CMMC framework was aimed at bringing defense contractors up to speed in their cybersecurity efforts to protect critical Controlled Unclassified Information (CUI), the use of the broad term CUI instead of the defense specific Covered Defense Information (CDI) phrase may indicate that this framework will extend beyond just defense contractors in the future.

The controls found in NIST are applicable to businesses of all sizes and in all sectors so following the CMMC or NIST frameworks whether or not you’re defense contractor/subcontractor will mean your business will be well protected and compliant with rules and regulations set by your vendors, clients, and services for your business such as cybersecurity insurance.

In it’s original iteration there were 5 maturity levels found in CMMC, with levels 1-3 really closely following NIST and 4-5 going beyond the scope of what NIST covers. They were described as “maturity levels” as they were meant to measure the maturity of the cybersecurity practices found within your organization.

For most defense contractors, reaching level 3 of CMMC would be an ideal goal. Levels 4 and 5 covered practices outside the scope of most business’s and would require more specialized (and expensive) security practices. Even in version one of CMMC contractors were allowed to self-certify for maturity level 1, but beyond that would require outside certification. The waiting list to receive that certification is long, so planning to implement the required cybersecurity measures and getting on the waiting list to be certified ASAP is a good idea.

Now, as of November 4^th the DoD has announced an update to CMMC. Version 2 may be removing two of the levels and some of the security measures that were unique to CMMC framework, making the framework match NIST even more closely. Below is the chart we have created with the outlined changes as we know them and as of this posting.

Click to view the full size.

This is an evolving situation and as the rollout progresses it’s imperative that businesses that receive DoD contracts begin or continue to increase their efforts in becoming CMMC certified, which may mean drastically increasing your cybersecurity efforts across the board.

Valley Techlogic has experience in helping businesses meet the goals found within the CMMC framework and we’re ready to help your business meet your certification and cybersecurity goals today. Click here to schedule a quick consultation to find out more.

Looking for more to read? We suggest these other articles from our site.
This article was powered by Valley TechLogic, adns, n IT service provider in Atwater, CA. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on Twitter at https://x.com/valleytechlogic.
November 17, 2021