Updated 2025 Cost Framework for CMMC Level 2 Compliance: Integrating DoD, Industry, and Practitioner Data

Posted on November 11, 2025 by Mabel Sabogal, PhD

This paper builds upon prior Atlantic Digital (ADI) research examining the financial and operational realities of achieving Cybersecurity Maturity Model Certification (CMMC) Level 2 compliance across the Defense Industrial Base (DIB). ADI’s 2024 “Feasibility of SMBs in the DIB” analysis (ADI, 2024a), explored the economic viability and strategic barriers for small and medium-sized businesses, while another paper (ADI, 2024b) established initial cost models and baseline implementation estimates.

This 2025 update advances that work by integrating newer Department of Defense (DoD) data with independently verified industry benchmarks, including insights from cybersecurity strategist Linda Rust (Rust, 2025) and practitioner commentary. Together, these sources produce an evidence-based view of CMMC Level 2 compliance costs, grounded in official estimates, validated analyses, and practitioner experience.

While cost modeling remains an important objective, the evolving conversation within the DIB has shifted focus from compliance as a technical obligation, to CMMC as a driver of organizational transformation. In line with ADI’s own long-standing posture (ADI, 2024c, ADI, 2024a), defense contractors and industry leaders recognize that CMMC readiness is not a one-time event but an ongoing business discipline that demands executive ownership, sustainable governance, and integrated risk management. In this context, cybersecurity compliance is inseparable from broader strategic and financial planning, shaping how defense suppliers structure their operations, allocate resources, and demonstrate long-term resilience.

Baseline Findings from ADI’s 2024 Analyses

The initial ADI analyses offered an early view of the practical cost burden facing small and medium-sized defense contractors pursuing CMMC Level 2 compliance. Both ADI reports argued that government estimates understated the financial burden for small businesses, focusing on structural and scale disadvantages (ADI, 2024a), and ADI, 2024b further highlighting that recurring internal labor and process maintenance are material components of lifecycle cost. Drawing on DoD data, ADI noted that the projected cost for the Level 2 assessment/affirmation component is approximately $104,670 for a small entity. This figure represents the baseline certification cost, excluding the recurring operational and labor expenses that ADI and others identify as the largest lifecycle contributors (ADI, 2024a; ADI, 2024b). Both papers positioned this baseline as an entry point, not a complete three-year total, indicating that human capital and governance activities are the dominant and most variable cost drivers. Subsequent analyses, including those by Rust (Rust, 2025) and other industry practitioners reinforce this conclusion, confirming that sustained labor, documentation, and process sustainment ultimately define the true economic scope of CMMC Level 2 compliance.

Official DoD Estimates

In January 2025, the Department of Defense published in the draft FAR CUI Rule (2024-30437) a high-level estimate of regulatory familiarization costs for achieving and maintaining CMMC Level 2 compliance. Unlike contractor-derived models that reflect field conditions, the DoD guidelines are designed to provide a benchmark for regulatory and budgeting purposes. In conjunction with the baseline costs described above, these guidelines can be interpreted as comprising three major cost components: one-time implementation—the initial “lift;” recurring operational costs; and third-party assessment costs, as summarized by Rust (Rust, 2025; DoD FAR CUI Rule, 2025; DoD, 2023).

According to the DoD data, the three-year cost for a representative small business is estimated to be approximately $487,970, consisting of $175,700 in initial implementation (labor ~$148,200 + hardware/software ~$27,500); $103,800 in recurring annual costs (labor ~$98,800 + hardware/software ~$5,000), and roughly $104,670 in total assessment costs (DoD FAR CUI Rule, 2025; DoD, 2023). These figures are summarized and discussed by industry analysts, including Rust (Rust, 2025), as the most comprehensive official baseline available.

Taken together, the DoD’s three-year projection implies an average annualized compliance burden of roughly $160,000 per year for a small business, yet industry reports consistently show that real-world costs often exceed this benchmark. Actual expenditures vary widely based on system scope, data complexity, and the maturity of internal controls. In practice, small and mid-sized contractors frequently report higher recurring labor and sustainment costs than the DoD model anticipates, a gap that becomes particularly evident when compared with practitioner-validated data.

In addition, it is important to note that the DoD assumes that defense contractors are already operating in conformance with DFARS and NIST requirements, and therefore treats CMMC certification as a marginal rather than initial compliance effort. In practice, however, many small businesses are still closing foundational gaps, making actual expenditures substantially higher than government projections.

Industry Dialogue and Validation

Practitioner dialogue led by industry expert Linda Rust offers an essential bottom-up validation of how CMMC compliance costs materialize in practice. Her 2025 LinkedIn series presents verified cost benchmarks across company sizes, confirming that CMMC Level 2 compliance can carry a six- to seven-figure price tag when broader programmatic labor, tooling, and sustainment are included (Rust, 2025).

Rust’s posts and the ensuing professional discussion revealed broad consensus that official DoD estimates understate the true scope of effort. While direct C3PAO assessments may range between $50,000 and $75,000 for well-prepared organizations, practitioners emphasized that the majority of expenditures occur earlier, through readiness activities, documentation, and recurring labor required to maintain compliance. These inputs can collectively situate one-time implementation costs between $120K to $250K, with recurring annual expenses of $50K to $100K, yielding multi-year program totals that can exceed $1 million when labor costs are considered (Rust, 2025).

The dialogue also broadened beyond cost precision to organizational behavior and strategic accountability. Industry participants emphasized that CMMC represents a long-term business transformation rather than a one-time audit event, requiring executive ownership, financial planning, and cultural alignment. They noted that poor scoping and inadequate data discovery can inflate costs by 20–30 percent, indicating that efficiency in compliance arises from disciplined governance, clear data boundaries, and proactive leadership engagement. Overall, these practitioner perspectives reinforce ADI’s and Rust’s shared conclusion that human labor and ongoing governance, rather than technology purchases or audit fees, are the largest and most variable components of CMMC Level 2 cost. This consensus reframes CMMC as an ongoing organizational investment in operational maturity and strategic resilience.

Practitioner and Community Corroboration

Practitioner reports from the defense contracting community provide an additional layer of validation grounded in lived experience. While not formally verified, these first-hand accounts help contextualize official and expert data by illustrating how cost variability plays out in practice.

A notable example appears in the Reddit thread titled “Costs for Certified Audit & Mock Audit,” where defense contractors share recent cost experiences. Across dozens of posts, contributors report mock audits ranging from $10K–$30K for smaller, well-prepared firms, with $30K–$50K as a common range for more extensive readiness support. Certified third-party assessments, in turn, often run $30K–$100K+ depending on organizational size, scope, and environmental complexity. Several participants noted that total readiness costs (consulting, remediation, and assessment fees) can approach or exceed $100K for small SaaS and complex IT environments. (r/CMMC, 2025).

These practitioner-level findings reinforce the pattern identified in both ADI and Rust’s analyses where audit fees alone rarely reflect the full economic footprint of compliance. The conclusion across government, professional, and community sources is that effective compliance depends as much on workforce capability and governance discipline as on tooling and assessment preparation.

Integrated Findings and Implications

The data reviewed here present a consistent picture of where CMMC Level 2 compliance costs truly reside. These findings synthesize data from official DoD estimates, ADI’s prior SMB feasibility models, Rust’s professional analysis, and practitioner reports from the CMMC community.

Across all sources, labor (both internal staff time and contracted expertise) emerges as the dominant cost driver, with underestimation of this component explaining much of the gap between official projections and real-world expenditures (ADI, 2024a, ADI, 2024b, Rust, 2025). Recurring subscription and tooling costs form a secondary but still significant component of total cost.

Beyond cost structure, governance maturity, scope definition, and early data mapping emerge as pivotal factors shaping financial outcomes. Industry experts repeatedly note that incomplete scoping or poorly mapped CUI can inflate total cost by as much as 30 percent during the discovery and readiness phases. In practice, this reinforces that cost efficiency is less a function of audit pricing and more a function of organizational readiness and disciplined preparation.

The professional dialogue also highlights that CMMC certification is the beginning, not the end, of a continuous resilience program. Effective programs integrate regular authorization reviews, workforce accountability, and visible executive sponsorship. For small and mid-sized contractors, early strategic planning, structured implementation, and continuous training are the most reliable levers for controlling lifecycle costs. Firms that operationalize CMMC as a business discipline rather than a periodic compliance exercise consistently achieve lower total costs while strengthening long-term security posture.

Atlantic Digital’s approach mirrors these findings. Rather than delivering one-size frameworks or isolated solutions, ADI helps contractors operationalize compliance as a business function. The methodology begins with establishing a readiness baseline and tailored scope definition, followed by cost modeling, control implementation guidance, documentation, training, and pre-assessment validation. The ultimate goal is sustainable compliance that executives can fund, manage, and defend, transforming CMMC from a regulatory obligation into a catalyst for stronger, more resilient operations.

As Linda Rust observed, the Defense Industrial Base will align to these requirements “one business leader at a time” (Rust, 2025). Partnering with advisors who translate the technical rigor of CMMC into practical business language, while understanding both regulatory detail and organizational culture, makes alignment far more achievable. Structured readiness planning and phased implementation allow organizations to mitigate financial and operational strain, even when six- to seven-figure expenditures are involved.

Looking ahead to full CMMC rollout between 2025 and 2028, integrated planning, strategic alignment, and disciplined execution will be essential for maintaining competitiveness, resilience, and long-term contract eligibility across the Defense Industrial Base.

Conclusion

Organizations that approach CMMC integrating cybersecurity into core operations and planning for continuous resilience, will better manage costs, protect critical information, and maintain long-term contract eligibility. Atlantic Digital supports contractors in achieving this configuration through readiness assessments, tailored scope definition, cost modeling, control implementation guidance, pre-assessment validation, and maintenance. By leveraging these services, companies can transform CMMC from a compliance obligation into an opportunity for sustained operational and security excellence.

Transitioning from Manual Compliance to GRC for Strategic Advantage

Posted on November 11, 2025 by Mabel Sabogal, PhD

This paper explains when transitioning from spreadsheets to an integrated Governance-Risk-Compliance (GRC) platform becomes cost-effective, and how Atlantic Digital, through its partnership with IntelliGRC, delivers real-time visibility, automated evidence tracking, standardized workflows, and sustained CMMC readiness.

From Manual Strain to Strategic Enablement

For defense contractors and suppliers handling Controlled Unclassified Information (CUI), CMMC has elevated cybersecurity from a back-office discipline to a board-level priority.

The CMMC ecosystem is now in a period of sustained acceleration, with rising numbers of final Level 2 certifications, certified professionals, and more than a hundred assessments underway (Cyber AB). As this activity scales, organizations discover that ad hoc compliance methods cannot keep pace. Spreadsheets may work at early maturity stages, but as contract sizes grow and controls multiply, manual tracking introduces confusion, unclear accountability, and lengthy audit preparation cycles (DoD CIO About CMMC).

In this environment, modern GRC platforms replace manual strain with structure, automating evidence collection, clarifying ownership, and offering executive dashboards that tie compliance posture directly to business outcomes. In short, the question for C-suite leaders becomes how to use GRC to gain strategic advantage in the race for DoD contracts, instead of whether to invest in this technology or not.

IntelliGRC as the Foundation of Sustainable CMMC Compliance

Under Atlantic Digital’s guidance, IntelliGRC (our trusted GRC partner), becomes the connective tissue between security operations, policy enforcement, and executive oversight. The platform consolidates risk registers, control status, POA&M progress, and audit evidence into a single system; automates workflows; enforces accountability; and maintains traceable evidence throughout the compliance lifecycle.

The result is a sustainable compliance culture in which executives gain real-time insight into risk and readiness; compliance teams work with clarity and efficiency; and auditors can quickly verify evidence through transparent, data-driven documentation. IntelliGRC transforms cybersecurity from a cost center into a competitive differentiator.

When and Why Organizations Transition from Manual Tracking to GRC

The shift from spreadsheets to an integrated GRC platform is a pivotal step in CMMC maturity. For many organizations, the tipping point occurs when contract complexity, assessment scope, and audit frequency outpace manual coordination.

CMMC Levels 2 and 3 introduce hundreds of controls that are difficult to track in spreadsheets. In today’s accelerating readiness environment, manual methods increase the risk of delays, oversight gaps, and inconsistent evidence.

A centralized solution such as IntelliGRC streamlines documentation, automates evidence reminders, maintains continuity during staff turnover, and ensures compliance remains traceable and repeatable.

Once organizations reach moderate contract volume or enter CMMC Level 2/3 territory, staying manual becomes more expensive than transitioning to structured governance.

Atlantic Digital and IntelliGRC: A Partnership Model for Sustainable CMMC Readiness

Achieving and maintaining CMMC compliance requires the right blend of technology, governance, and expertise. Atlantic Digital delivers this through a partnership model that integrates IntelliGRC’s robust GRC capabilities with strategic advisory support tailored to each organization’s mission.

Atlantic Digital and IntelliGRC follow a clear lifecycle approach that ensures alignment and long-term sustainability:

Analyze current controls, documentation, and contract landscape to identify gaps and areas where automation yields maximum ROI.
Implement IntelliGRC pre-mapped to NIST SP 800-171 and CMMC Levels 1–3 configuring workflows, role-based access, and dashboards.
Embed the platform into daily compliance operations and train control owners, reviewers, and executives.
Update the environment as CMMC and NIST requirements evolve.

This model ensures that the technology and advisory components reinforce one another, creating an ecosystem that grows with the organization rather than constraining it. Unlike spreadsheets, IntelliGRC unifies evidence, accountability, oversight, and scalability.

Atlantic Digital’s involvement continues beyond implementation. We work alongside defense organizations to align compliance strategy with business goals, sustain readiness, and maintain a competitive advantage through evolving CMMC requirements.

Conclusion

Defense contractors must embed cybersecurity assurance into daily operations. A well-implemented GRC system, such as IntelliGRC, supported by Atlantic Digital’s expert guidance, provides automation, workflow consistency, executive visibility, and traceable oversight. By institutionalizing continuous compliance, organizations gain operational efficiency, contract readiness, and a strategic advantage in the defense supply chain.

To ensure your organization achieves these benefits and stays ahead in cybersecurity compliance, connect with Atlantic Digital and begin strengthening your defense readiness today.

About IntelliGRC

IntelliGRC is an intelligent SaaS GRC Platform purpose-built for cybersecurity compliance at scale. Leveraging our proprietary Intelligent Control Library (ICL), asset-centric automation, and proven methodologies powered by tuned AI models, IntelliGRC delivers more than traditional GRC tools.

Where other platforms over-generalize, over-simplify, or provide a blank canvas, IntelliGRC uniquely addresses the complexities and nuances of stringent cybersecurity frameworks by delivering turnkey solutions that ensure compliance precision for service providers and their customers.

Learn more at www.intelligrc.com

Risks and Remedies in CMMC Self-Attestation: Managing SPRS Scoring and Legal Exposure

Posted on October 17, 2025 by Mabel Sabogal, PhD

In September 2025, the Department of Defense finalized DFARS updates implementing the Cybersecurity Maturity Model Certification (CMMC) program into the Federal Acquisition Regulation Supplement. Effective November 10, 2025, the rule makes both self- and third-party cybersecurity assessments contractually enforceable for defense contractors (Federal Register, 2025).

Under the final rule, contractors handling only Federal Contract Information (FCI) may continue to self-assess annually at CMMC Level 1, while those that handle Controlled Unclassified Information (CUI) will fall under Level 2 requirements. For Level 2, the Department of Defense differentiates between contracts that permit self-assessment versus those that require third-party certification by a CMMC Third-Party Assessment Organization (C3PAO). The DoD’s phased rollout anticipates that a substantial proportion of Level 2 contractors will require independent C3PAO validation prior to contract award (DoD).

This paper examines the operational and legal challenges posed by self-attestation and Supplier Performance Risk System (SPRS) scoring under CMMC. Public reporting through 2024 and 2025 shows persistent readiness shortfalls across the Defense Industrial Base (DIB), with low average SPRS readiness metrics and relatively few final or conditional CMMC Level 2 certifications compared to the estimated population of covered entities (Cyber AB, 2025; businesswire; National Defense, 2024). These gaps highlight the difficulty many contractors face in attaining the 110-point SPRS threshold required for final Level 2 certification and underscore the need for rigorous self-assessment practices and stronger verification mechanisms.

The following sections analyze these challenges and present evidence-informed mitigations, including structured gap analysis, cross-functional governance, automated evidence collection, and disciplined POA&M management, to help organizations attain accurate SPRS scores and preserve DoD contract eligibility. This shift from voluntary attestation to enforceable validation reshapes contractor readiness planning across the DIB.

When Self-Assessment Is Allowed, and When Third-Party Assessment Is Required

The 2025 DFARS final rule formalizes the CMMC assessment model across three levels:

• Level 1 – Self-Assessment Only: Annual self-assessment and executive affirmation in SPRS

• Level 2 – Mixed Model: Contractors handling CUI may perform self-assessments for lower-risk programs, but contracts deemed critical to national security require third-party assessment by a C3PAO.
• Level 3 – Government Assessment: Contractors supporting the most sensitive missions undergo government-led assessments against NIST SP 800-172 controls.

This tiered structure allows DoD to scale assurance based on risk while reducing unnecessary burden on small and medium contractors that handle less sensitive information (DoD; Federal Register).

Understanding SPRS and the Assessment Process

The Supplier Performance Risk System (SPRS) is the DoD’s authoritative database for supplier performance and cybersecurity assessment information. Under DFARS 252.204-7019, contractors must submit their NIST SP 800-171 assessment scores to SPRS, which DoD acquisition officials reference during source-selection and award decisions (Acquisition.GOV, 2025; SPRS).

SPRS scoring evaluates implementation of the 110 NIST SP 800-171 requirements. A fully implemented environment earns +110 points, while deductions for unmet controls can reduce scores to –203 under the DoD Assessment. Under current guidance, organizations scoring between approximately 88 and 109 points may provisionally qualify for CMMC Level 2 status if all deficiencies are documented in approved POA&Ms. Final certification requires a perfect score of 110, with all deficiencies addressed and POA&Ms closed within 180 days (CMMC Level 2 Assessment Guide v2; NIST; NIST).

In addition to scores, SPRS captures metadata, such as assessment dates and POA&M completion, which acquisition officials consider alongside numerical scores when evaluating supplier cybersecurity posture.

While SPRS provides a structured framework for tracking performance and cybersecurity compliance, accurately reporting and maintaining these records presents ongoing operational challenges for contractors.

Operational Challenges in Accurate SPRS Scoring

Defense contractors face persistent operational barriers when reporting cybersecurity posture through SPRS mechanisms. Despite expanded DoD guidance and automation efforts, accurately capturing and maintaining scores remains challenging.

While self-assessments may identify many deficiencies internally, third-party C3PAO evaluations often uncover documentation or technical gaps that internal reviews overlook, requiring objective verification and remediation. For contractors pursuing third-party certification, additional challenges include coordinating evidence reviews, maintaining consistent control implementation across business units, and responding to assessor findings during the remediation window. These implementation difficulties can lead to compliance deficiencies, contract disqualification, or potential legal liability.

Below are notable pain points:

1. Incomplete or outdated System Security Plans (SSP)

SSPs serve as foundational evidence. Common deficiencies include outdated or incomplete control descriptions, missing system boundaries, or absent evidence of implementation. Because DoD assessors validate SSP-described controls against actual practice, SSP shortcomings surface during assessments (CMMC Assessment Guide Level 2 v2.13).

2. Limited internal expertise for accurate scoring

Small and medium contractors often lack dedicated cybersecurity and DoD-assessment expertise, making accurate interpretation of NIST SP 800-171 and SPRS scoring difficult. Industry guidance and DoD small-business outreach resources confirm that limited internal capability is a major readiness barrier (DoD; Defense.GOV).

3. Failure to track POA&M remediation timelines

DoD guidance ties conditional status to documented POA&Ms and expects timely remediation of deficiencies. Contractors that fail to maintain POA&M discipline risk losing certification or contract eligibility.

Together, these operational challenges can result in inaccurate self-attestations, exposing the organization to serious legal and contractual consequences.

Legal and Operational Risks of Inaccurate SPRS Reporting

Inaccurate or exaggerated SPRS self-assessments expose organizations to both legal and operational risks, including False Claims Act (FCA) liability, contract ineligibility, potential suspension or debarment.

Both self-assessment and third-party verification data must now be entered into SPRS. Under DFARS 252.204-7020 and the 2025 final rule, each contractor’s assessment, whether internally completed or validated by a C3PAO, receives a unique identifier (UID) used by contracting officers to verify compliance before award. Misstatements tied to these UIDs may be considered material to DoD’s payment decisions.

Legal Accountability and Executive Attestation Under the False Claims Act

The Department of Justice’s Civil Cyber-Fraud Initiative has pursued multiple enforcement actions against defense contractors that misrepresented compliance or inflated SPRS scores. Under the False Claims Act (31 U.S.C. §3729 et seq.), violators may face treble damages and statutory penalties. For example:

Raytheon Technologies (RTX) paid $8.3 million following a whistleblower complaint about cybersecurity misrepresentations (OPA, 2025).
MORSE Corporation paid $4.6 million to resolve allegations of false SPRS scoring (OPA, 2025).
Higher-education contractors and others have likewise reached settlements resolving FCA allegations tied to cybersecurity non-compliance. For instance, The Pennsylvania State University agreed to pay $1.25 million in 2024 to resolve related allegations (OPA, 2024).

Each contractor must also ensure that the Affirming Official (AO), typically a senior company executive, signs off that the SPRS assessment is accurate and complete. False affirmations may trigger FCA liability (SPRS; SMITHERS).

Impact of expired or missing SPRS entries on contract eligibility

Beyond legal exposure, inaccurate or expired SPRS entries can directly affect contract eligibility and award timelines. Beginning November 10, 2025, contracting officers will be required to verify contractors’ SPRS assessment scores before award or renewal, in accordance with DFARS 252.204-7019 and associated rules. Organizations without a current and validated SPRS entry may be deemed ineligible for new contracts, and existing awards may be delayed or suspended pending compliance verification (Federal Register, 2024; Acquisition.GOV).

Best Practices to Improve CMMC Self-Assessment Accuracy

Given the heightened legal and contractual risks associated with inaccurate self-attestation, precision in CMMC self-assessments is essential. Contractors must adopt structured, repeatable processes to address the vulnerabilities identified across the Defense Industrial Base (DIB).

1. Conduct structured gap analyses to validate CMMC readiness and engage cross-functional teams

Begin with a structured gap analysis across all 110 controls and 320 assessment objectives (NIST SP 800-171A Rev. 3). Involve leadership, compliance, IT, and business units to ensure complete visibility and accountability.

2. Leverage automation for continuous evidence validation

Automated evidence collection tools help maintain compliance accuracy by continuously validating control implementation across cloud and on-premises systems. Integration with environments such as AWS GovCloud, Azure Government, and Microsoft GCC High supports generation of traceable documentation consistent with CMMC and NIST evidence requirements.
3. Maintain annual SPRS updates and executive affirmations

Contractors must conduct and affirm at least one self-assessment annually in SPRS. The Affirming Official should certify that the assessment accurately reflects the organization’s compliance status. The CMMC Level 1 Assessment Guide recommends routine internal reviews to ensure continuous readiness and prevent score degradation that can jeopardize contract eligibility (Acquisition.GOV, SPRS, CMMC Level 1 Assessment Guide).

4. Prepare for third-party assessment proactively

Contractors anticipating third-party assessments should adopt pre-assessment readiness reviews to identify documentation gaps and technical deficiencies before engaging a C3PAO. Early preparation reduces costs, minimizes findings during formal assessment, and improves the likelihood of achieving a passing score within the remediation window.

Implementing these measures is especially critical as CMMC 2.0 enters Phase 1 of its enforcement rollout in November 2025, when contracting officers may begin including CMMC requirements in solicitations and contracts, especially for self-assessments of Level 1 or 2 systems.

Conclusion

CMMC 2.0 compliance marks a pivotal shift for defense contractors operating in an increasingly regulated cybersecurity environment. Many contractors continue to report scores below full implementation. And because the Department of Justice’s Civil Cyber-Fraud Initiative actively pursues false or misleading SPRS attestations, accurate self-assessment has become both a compliance obligation and a legal imperative.

Under the False Claims Act, organizations and their Affirming Officials, may face treble damages and civil penalties for knowingly submitting inaccurate information. Addressing core challenges (misinterpretation of NIST requirements, incomplete SSPs, inflated self-assessments, limited internal expertise, and lax POA&M discipline) is essential as CMMC 2.0 requirements phase into DoD solicitations and contracts starting November 2025.

To mitigate risks and ensure readiness, organizations should institutionalize disciplined, evidence-based assessment processes, maintain verifiable SPRS records, and prepare for third-party validation. Those that adopt these practices will be in the strongest position for contract eligibility, legal defensibility, and competitive stability as CMMC enforcement unfolds throughout FY 2026.

At Atlantic Digital, we help contractors bridge the gap between self-assessment readiness and successful third-party certification. Our team provides tailored readiness assessments to identify compliance gaps; implement required security controls aligned with NIST SP 800-171; assist with policy development, System Security Plan (SSP) and POA&M creation; and conduct pre-assessment or mock-audit exercises to reduce surprises during formal C3PAO engagements. For contractors already approaching their SPRS scoring thresholds, we ensure that both self-attestations and third-party assessments are conducted with confidence, supported by verifiable evidence sufficient to meet DoD contracting and CMMC 2.0 requirements.

The SA-24 Update: Critical Implications for Defense Industrial Base Compliance

Posted on October 7, 2025 by Mabel Sabogal, PhD

The recent update to NIST SP 800-53 (Release 5.2.0) on August 27, 2025, introduced a significant new security control, SA-24 “Design for Cyber Resiliency,” that warrants immediate attention from Defense Industrial Base (DiB) organizations (NIST 2025).

Rationale for SA-24 Introduction

The inclusion of SA-24 in NIST SP 800-53 Release 5.2.0 addresses the growing need for systems to be designed with inherent cyber resiliency. This control emphasizes the importance of anticipating, withstanding, recovering from, and adapting to adverse conditions, stresses, attacks, or compromises on systems that utilize or are enabled by cyber resources. This proactive approach aims to reduce mission, business, organizational, enterprise, or sector risk associated with cyber dependencies. The decision to introduce SA-24 was influenced by stakeholder feedback highlighting the necessity for a structured framework to embed cyber resiliency into system design processes (NIST 2025).

Strategic Significance for DiB Organizations

This update establishes a critical bridge between security compliance frameworks and systems security engineering, and, for DiB contractors, this development is particularly consequential for several reasons:

Anticipatory Compliance Requirements: Although SA-24 is not currently included in NIST SP 800-171 Revision 3, it is anticipated that future revisions will incorporate this control. The alignment of SP 800-171 with SP 800-53 Revision 5, as seen in the recent updates, suggests a trend towards harmonizing security requirements across NIST publications. Organizations should proactively prepare for this integration by familiarizing themselves with the SA-24 control and considering its application in their current security practices (secureframe 2025; NIST 2024).

CMMC Implications: Organizations pursuing Cybersecurity Maturity Model Certification should recognize this update as a potential indicator of future assessment criteria, particularly for higher maturity levels where resiliency requirements are emphasized.

Competitive Differentiation: DiB contractors who proactively adopt cyber resiliency principles may secure advantageous positioning for future contract opportunities where robust security engineering is evaluated.

Technical Implementation Considerations

The SA-24 control establishes comprehensive requirements for cyber resiliency that align with strategic objectives outlined in SP 800-160 (NIST 2021):

Definition of organization-specific cyber resiliency goals and objectives
Implementation of designated cyber resiliency techniques and approaches
Integration of cyber resiliency design principles into systems engineering processes
Systematic review procedures as part of organizational risk management

To operationalize SA-24, organizations should map its elements to existing risk management frameworks and business continuity plans. For instance, the “organization-defined cyber resiliency goals” can be aligned with risk appetite statements in the risk register. Likewise, “cyber resiliency techniques” may be integrated into business continuity or disaster recovery strategies to ensure critical functions persist through and recover from adverse events. NIST SP 800-160 (Vol. 2) offers a technical foundation for selecting and applying techniques (e.g. redundancy, diversity, isolation, adaptability).

Procurement vehicles are increasingly reinforcing this convergence between compliance and resiliency. A prominent example is GSA’s OASIS+, a government-wide, multi-award IDIQ contract vehicle for acquiring complex professional services across domains (GSA. GSA). Under OASIS+, contractors responding to task orders may be required to fulfill J-3 “Cybersecurity/Supply Chain Risk Management (C-SCRM)” deliverables, which call for a documented cybersecurity program (mapped to NIST guidance), a C-SCRM plan, incident response capabilities, and business continuity/disaster recovery practices (GSA, GSA).

While OASIS+ is not itself a resiliency framework, its contractual deliverables illustrate how procurement requirements can drive adoption of resiliency-by-design principles like those in SA-24.

Implementing SA-24: Practical Examples:

Organizations can adopt various techniques to implement SA-24 effectively:

Redundancy: Implementing redundant systems and data paths to ensure availability during disruptions.
Diversity: Utilizing diverse technologies and vendors to mitigate the risk of widespread failures.
Isolation: Designing systems to contain and limit the impact of potential breaches.
Adaptability: Ensuring systems can evolve in response to emerging threats and vulnerabilities.

These techniques should be tailored to the organization’s specific operational context and risk profile (GSA, NIST 2021).

Who Should Be Paying Attention

Prime Defense Contractors: Organizations directly contracted with DoD handling CUI must closely monitor how this update will influence contractual requirements.
System Security Engineering Teams: Technical specialists responsible for architecture design and security implementation need to integrate these resiliency principles into development lifecycles.
Compliance Officers: Professionals tasked with maintaining regulatory adherence should begin evaluating how SA-24 principles align with existing control implementations.
Risk Management Leadership: Executives responsible for enterprise risk governance must consider how cyber resiliency objectives will factor into broader business continuity planning.
Supply Chain Security Managers: The emphasis on cyber resiliency complements the Supply Chain Risk Management (SR) family introduced in NIST SP 800-171 Rev. 3 (NIST 2024), suggesting an integrated approach to supply chain security and operational resilience.

This development underscores the evolving regulatory landscape’s increasing focus on proactive, resilience-oriented security engineering rather than merely reactive compliance measures. Organizations that recognize this shift and adapt accordingly will be better positioned for both regulatory compliance and operational security effectiveness.

Conclusion

The introduction of SA-24 signifies a pivotal shift towards embedding cyber resiliency into the fabric of system design and operation. For DiB organizations, proactively adopting these principles not only ensures compliance with evolving standards but also fortifies the organization’s ability to withstand and recover from cyber adversities. By aligning with SA-24, organizations demonstrate a commitment to safeguarding critical missions and maintaining trust with federal partners.

At Atlantic Digital, our CMMC Strategy Experts help defense contractors translate evolving requirements like SA-24 into practical, actionable programs. From readiness assessments to ongoing compliance support, we partner with organizations to strengthen resiliency and secure their position in the defense supply chain.

Contact us today to learn how ADI can support your compliance and cyber resiliency journey.

DOM-based Extension Clickjacking: The Silent Threat to Your Password Manager

Posted on August 28, 2025 by Mabel Sabogal, PhD

In the world of cybersecurity, sometimes the most dangerous threats are the ones hiding in plain sight, or rather, the ones hiding behind what you can’t see.

Introduction

Password managers have become the digital equivalent of Fort Knox for many of us (trusted guardians of our most sensitive information in an increasingly complex online world). We’ve been told repeatedly by security experts: use unique, complex passwords for every account and store them in a password manager. But what happens when the very tools designed to protect us become vectors for attack?

Czech security researcher Marek Tóth recently uncovered a sophisticated vulnerability affecting popular password manager browser extensions that could make your digital fortress about as secure as a sandcastle at high tide. This newly identified attack vector, dubbed “DOM-based extension clickjacking,” has sent shockwaves through the cybersecurity community, affecting extensions with a combined user base exceeding 40 million installations (Tóth).

The Art of Digital Sleight of Hand

Imagine you’re browsing a website and encounter a seemingly innocent cookie consent banner. You click “Accept” to dismiss it and continue browsing. Simple, right? Not quite. Through DOM-based extension clickjacking, that single click might have just handed over your credit card details, including security codes, to an attacker without you noticing a thing.

But how exactly does this digital sleight of hand work? DOM-based extension clickjacking represents an evolution of traditional clickjacking attacks, specifically targeting browser extensions that inject interactive elements into a webpage’s Document Object Model (DOM).

The attack exploits a fundamental aspect of how password manager extensions interact with web pages:

Password managers inject user interface elements (like autofill prompts) into the webpage DOM
An attacker’s malicious JavaScript can manipulate these elements, making them invisible while maintaining their functionality
Deceptive content is overlaid, tricking users into interacting with the hidden password manager interface
When users click what appears to be legitimate page elements, they unknowingly trigger the hidden password manager functionality

What makes this attack particularly concerning is its minimal interaction requirements. In many demonstrated scenarios, a single user click is sufficient to extract sensitive information.

Technical Mechanics

The DOM-based extension clickjacking vulnerability exploits several technical approaches:

Direct Element Manipulation: Applying CSS properties like opacity: 0 directly to the extension’s UI components, making them invisible while maintaining functionality
Parent Element Modification: Altering container elements that hold the password manager’s interface
Strategic Overlay Positioning: Placing deceptive content over the password manager’s interface while using CSS properties like pointer-events: none to ensure clicks pass through to hidden elements underneath

As Tóth explains, “The principle is that a browser extension injects elements into the DOM, which an attacker can then make invisible using JavaScript” (Tóth).

The Damage Potential

The severity of this vulnerability varies depending on context, but several concerning attack scenarios have been demonstrated:

On Malicious Websites

Extraction of stored credit card information, including card numbers, expiration dates, and security codes
Theft of personal data like names, addresses, and phone numbers
Credential harvesting

On Legitimate but Compromised Websites

If an attacker exploits cross-site scripting (XSS) vulnerabilities or subdomain takeovers on trusted domains, they can potentially extract login credentials and two factor authentication codes
Even manipulation of passkey authentication flows is possible in some scenarios

Particularly concerning is how the attack can exploit the subdomain autofill behavior of password managers. If a user has credentials stored for a domain like accounts.google.com, an attacker only needs to find an XSS vulnerability on any subdomain (e.g., test.dev.sandbox.cloud.google.com) to potentially steal those credentials.

Affected Password Managers

Tóth’s research presented at DEF CON 33 identified vulnerabilities in several password managers at the time of disclosure. The versions tested are listed below, though patch status has since varied. Users should consult vendor advisories for the latest updates:

1Password (version 8.11.4.27)
Bitwarden (version 2025.7.0)
LastPass (version 4.146.3)
LogMeOnce (version 7.12.4)
Enpass (version 6.11.6)
Apple’s iCloud Passwords (version 3.1.25)
NordPass (now fixed in version 5.13.24 or later)
ProtonPass (now fixed in version 1.31.6 or later)
RoboForm (now fixed in version 9.7.6 or later)
Keeper (now fixed in version 17.2.0 or later)
Dashlane (now fixed in version 6.2531.1 or later)
KeePassXC-Browser (version 1.9.9.2)

The response from vendors has varied significantly. Some have quickly addressed the issue with comprehensive fixes, while others have taken a more measured approach or initially classified the issue as “informative” rather than a direct vulnerability in their products.

Jacob DePriest, CISO at 1Password, has noted that “the underlying issue lies in the way browsers render webpages” and that there’s “no comprehensive technical fix that browser extensions can deliver on their own” (Security Week). This stance highlights the fundamental tension between usability and security in password manager design.

Mitigation Strategies for Users

While awaiting comprehensive fixes from vendors, users can take several proactive steps to protect themselves:

Update Browser Extensions: Ensure you’re running the latest version of your password manager’s browser extension, as several vendors have released patches or partial mitigations.
Consider Alternative Access Methods: Use desktop or mobile applications, when possible, as these are not vulnerable to web-based clickjacking attacks.
Disable Autofill Functionality: Configure your password manager to require explicit action before filling credentials.
Exercise Caution with Web Interactions: Be suspicious of websites that display intrusive popups or request unusual interactions.
Implement Browser-Level Protections: For Chromium-based browser users, configure extension permissions to “on click” rather than allowing automatic access to all websites.

The Balancing Act

The discovery of DOM-based extension clickjacking vulnerabilities highlights a fundamental challenge in security design: the balance between usability and protection. While separate popup windows for autofill would provide stronger security against clickjacking, they would also introduce significant friction to the user experience, potentially driving users toward less secure practices out of convenience.

As Alex Cox, Director of Threat Intelligence at LastPass, notes, this research “highlights a broader challenge facing all password managers: striking the right balance between user experience and convenience, while also addressing evolving threat models” (Daily Security Review).

Conclusion

The DOM-based extension clickjacking vulnerability serves as a stark reminder that even security tools require vigilant oversight and continuous improvement. As password managers have become increasingly central to cybersecurity strategies, they have also become more attractive targets for sophisticated attacks.

Users should remain alert to potential risks while maintaining perspective; password managers still provide significant security benefits compared to alternative approaches like password reuse or weak memorized credentials. The appropriate response is not abandonment of these tools, but rather informed usage combined with additional security layers.

For the password management industry, this discovery highlights the need for continued innovation in secure design patterns for browser extensions. Future approaches may include greater isolation between extension interfaces and webpage content, improved verification of user intent before sensitive operations, and more robust detection of potential manipulation attempts.

As vendors continue to release updates addressing these vulnerabilities, users should prioritize keeping their software current and implementing available security options. By combining technical protections with informed usage practices, the risks associated with DOM-based extension clickjacking can be significantly reduced while preserving the substantial security benefits that password managers provide.

At ADI, we help organizations build sustainable cybersecurity frameworks that adapt as threats evolve. Whether you need guidance on compliance, strategy, or hands-on defense, our team is here to support your mission with tailored solutions. Explore ADI’s CMMC and cybersecurity services here.

Secure.Comply.Excel.

Navigating the Latest DoD Memo on CMMC Certification Requirements with Atlantic Digital

Posted on March 11, 2025 by Mabel Sabogal, PhD

Introduction

The Department of Defense (DoD) continually updates its cybersecurity protocols to safeguard sensitive information within the Defense Industrial Base (DIB). The latest memorandum, “Implementing the Cybersecurity Maturity Model Certification (CMMC) Program” (DoD), introduces significant changes to the Cybersecurity Maturity Model Certification (CMMC) requirements, directly impacting contractors and service providers. This paper examines these updates, addresses critical compliance challenges, and outlines how Atlantic Digital (ADI) helps clients achieve compliance.

Understanding the Latest DoD Memo on CMMC

The recent DoD memorandum formalizes the CMMC framework by confirming a phased implementation and clarifying the conditions under which different levels of certification are required. It also provides new guidance on waivers and subcontractor compliance.

Key updates include:

CMMC certification requirements will be introduced incrementally upon publication of the final DFARS rule, 2019-D041. Contractors must prepare for increasing compliance obligations over the next two years as Level 1, Level 2, and Level 3 requirements take effect.

The memo reiterates that CMMC Level 3 requirements should not be unnecessarily imposed on subcontractors unless they handle mission-critical CUI. Program Managers are advised to take a risk-based approach when determining subcontractor obligations.

Service and Component Acquisition Executives (SAE/CAE) may waive CMMC certification requirements under certain conditions but must still ensure compliance with cybersecurity safeguards.

Phased Implementation Process

The DoD memo confirms that CMMC implementation will begin once the final Title 48 CFR rule is published. Implementation will proceed as follows:

Upon publication of the final DFARS rule, 2019-D041, CMMC Level 1 requirements will take effect for applicable contracts.

One year after DFARS publication, CMMC Level 2 assessments will be introduced as part of the phased implementation process.

Two years after DFARS publication, CMMC Level 3 certification assessments will be mandatory, when appropriate.

The DoD will update Instruction 8582.01 and provide additional guidance regarding the application of NIST SP 800-172 protections for Level 3 contractors.

CMMC Level Assessments

CMMC builds upon NIST SP 800-171 self-assessments already obligatory under DFARS 252.204-7019, and organizations must continue conducting these assessments as required. Additionally, the CMMC Program requires pre-award assessments of covered contractor information systems against prescribed cybersecurity standards for safeguarding Controlled Unclassified Information (CUI) and Federal Contract Information (FCI).

Assessment Breakdown:

CMMC Level 1 requires an annual self-assessment against 17 basic cybersecurity practices, based on the Federal Acquisition Regulation (FAR) 52.204-21.

CMMC Level 2 requires adherence to NIST SP 800-171 requirements. Depending on the sensitivity of the Controlled Unclassified Information (CUI) handled, assessments may be either self-assessments or conducted by a Certified Third-Party Assessment Organization (C3PAO).

CMMC Level 3 requires a DoD-led assessment, incorporating NIST SP 800-172 enhanced security requirements.

Flow-Down Requirements for Subcontractors 

The memo warns that CMMC Level 3 requirements should not be unnecessarily flowed down to all subcontractors, as this could impose undue financial and administrative burdens. Program Managers must ensure only essential subcontractors handling mission-critical CUI are subject to Level 3 requirements. 

New CMMC Waiver Process

The memo establishes a waiver process, allowing SAE/CAE officials to waive CMMC certification under specific conditions. Waivers do not remove cybersecurity compliance obligations but offer flexibility in cases where certification requirements could limit competition.

Waiver Guidelines:

CMMC waivers may be granted on a case-by-case basis by SAE/CAE officials

All cybersecurity requirements remain in effect, regardless of whether a waiver is granted.

According to the memo, “There are no circumstances likely to warrant approval of requests to waive CMMC Level 1 requirements.”

The memo confirms that some “…CMMC Level 2 third-party assessment requirements may be waived under certain conditions,” but “there are no circumstances likely to warrant approval of requests to waive CMMC Level 2 self-assessment requirements.”

Waivers for Level 3 contractors will be highly limited due to their handling of mission-critical CUI.

Identified Compliance Challenges

While the DoD memo provides clarity on CMMC requirements, additional challenges arise when managing information such as Export-Controlled Information (EXPT), which is regulated under separate frameworks like the International Traffic in Arms Regulations (ITAR) and the Export Administration Regulations (EAR). Unlike Controlled Technical Information (CTI), which directly triggers CMMC Level 2 requirements under DoD contracts, EXPT is a broader category of Controlled Unclassified Information (CUI) that applies across multiple federal agencies, including the Departments of Commerce and State. As a result, contractors handling EXPT may face cybersecurity requirements that extend beyond DoD mandates and into multi-agency oversight (DoD, Export Solutions).

Key Challenges

Export Controlled (EXPT) information is classified as Controlled Unclassified Information (CUI) under the National Archives’ CUI Registry. This classification encompasses unclassified technical data, software, or other items subject to export restrictions under the International Traffic in Arms Regulations (ITAR) or Export Administration Regulations (EAR) (National Archives, DoD)

While EXPT itself is not categorized as Controlled Technical Information (CTI), there are instances where the same dataset may be classified as both EXPT and CTI (National Archives, National Archives). In such cases, contractors may be required to comply with multiple regulatory frameworks, including DFARS 252.204-7012 and export control laws.

The presence of EXPT in a Department of Defense (DoD) contract does not automatically trigger CMMC certification requirements. However, if a contract involves both EXPT and CTI, the contractor may be required to undergo a full CMMC Level 2 assessment due to the handling of CTI. Additionally, in cases where a non-DoD agency is involved, equivalent cybersecurity measures may be required even if the DoD does not impose them directly.

Since ITAR and EAR compliance imposes security requirements beyond those outlined in NIST SP 800-171, organizations must implement a dual compliance strategy. Contractors should assess regulatory obligations across all awarding agencies to ensure alignment with both DoD and export control cybersecurity requirements.

In this sense, understanding the interplay between CMMC, DFARS, and export control regulations is critical for organizations handling sensitive government data. The presence of EXPT can introduce additional layers of compliance, even when CMMC is not explicitly required by DoD. Contractors must evaluate regulatory obligations beyond DoD contracts, ensuring that cybersecurity measures align with both defense and non-defense federal agency requirements.

Atlantic Digital’s (ADI’s) Strategy and Compliance Solutions

Atlantic Digital offers a strategic approach to navigating CMMC compliance, ensuring organizations meet the necessary standards while addressing challenges posed by complex regulatory frameworks. ADI’s team helps contractors determine their certification requirements, implement necessary safeguards, and provide solutions to comply with both DoD mandates and broader federal regulations. Through comprehensive risk assessments, ongoing education, and specialized support, ADI ensures that clients can confidently meet their compliance obligations, optimize their security measures, and remain competitive in the defense sector.

How ADI Helps Clients Achieve Compliance:

ADI assists clients in aligning multiple frameworks, offering contract-based certification guidance, and determining whether CMMC certification is required based on contract requirements from DoD and other federal agencies.

ADI advises clients on separating CUI from other sensitive data to avoid excessive security obligations on subcontractors, in accordance with DoD recommendations.

ADI works with clients to educate subcontractors on their cybersecurity responsibilities to enhance compliance and reduce risks.

ADI stays updated on changes to DFARS, CMMC methodologies, and regulatory guidance, ensuring clients remain compliant with strict cybersecurity requirements.

Conclusion

The evolving cybersecurity landscape demands that contractors remain agile and informed. The latest DoD CMMC implementation memo provides clarity on assessment levels, waivers, and subcontractor requirements. However, challenges remain for organizations handling information regulated under separate frameworks, requiring a strategic approach to compliance. Atlantic Digital empowers clients to meet these challenges by offering expert guidance on aligning multiple cybersecurity frameworks, minimizing unnecessary security obligations, and ensuring compliance with both DoD and other regulations.

ADI’s comprehensive solutions ensure that clients can navigate the complexities of CMMC compliance, mitigate risks, and achieve robust cybersecurity resilience. For expert CMMC strategy and compliance solutions, contact ADI today to ensure your business remains secure and competitive in the evolving defense sector.

The Limits and Realities of Cyber Insurance

Posted on February 24, 2025 by Mabel Sabogal, PhD

Cyber attacks now cost organizations $4.88 millions per breach on average (IBM). This stark reality underscores the importance of cyber insurance as a critical tool for financial and operational risk mitigation. However, the complexities and limitations inherent in these policies create significant challenges for businesses. To navigate these drawbacks effectively, organizations must understand the evolving threat landscape, policy limitations, claims management hurdles, and cost considerations.

Evolving Threat Landscape

The sophistication and scale of cyber threats have reshaped the insurance industry, leading to increasingly restrictive coverage and higher barriers to policy access. These developments demand that businesses critically evaluate emerging risks and align their risk management strategies accordingly.

Ransomware Attack Patterns
Ransomware remains one of the most pressing threats in 2024, evolving from basic encryption tactics to advanced strategies that cause significant financial and operational disruption. For instance, the average ransomware demand reached $5.2 million per incident in the first half of 2024 (Infosecurity Magazine), and LockBit, one of the most notorious ransomware groups, claimed at least 428 victims alone (Flashpoint). High-profile targets include critical sectors such as political systems, healthcare, manufacturing, financial services, and infrastructure (ADI). The mounting frequency and severity of these attacks underscore the importance of cyber insurance while simultaneously making comprehensive coverage increasingly elusive.

At the same time, nation-state-sponsored cyber activities present unique risks. Nation-state actors accounted for 45% of all cyberattacks targeting government institutions in 2024 (Cyble). These actors often infiltrate critical infrastructure systems undetected, launching attacks at strategically chosen moments (State Scoop). Marked by persistent threats and AI-driven disinformation campaigns, these operations are frequently excluded from standard cyber insurance policies, leaving affected organizations vulnerable to substantial financial and operational risks.

Other Attack Vectors
The risk landscape continues to shift beyond ransomware and nation-state threats. IoT malware attacks, for example, have surged by 400% (Infosecurity Magazine). Abuse of valid credentials remain a critical vulnerability, accounting for 44.7% of data breaches in 2023 (Deloitte), while infostealer attacks compromised over 53 million credentials in the first half of 2024 (Flashpoint). AI-powered cyber attacks further exacerbate these issues by enabling automated hacking and sophisticated phishing campaigns at scale (Crowdstrike, CSO) Notably, manufacturing has emerged as the most targeted industry in this evolving threat landscape (WEF). Together, these trends highlight the importance of adopting holistic security practices alongside cyber insurance.

Policy Coverage Limitations and exclusions

As cyber risks evolve, insurance providers have responded by tightening policy terms, which significantly impacts businesses’ ability to transfer risk effectively. Stricter qualification requirements, such as multi-factor authentication, patch management, employee security trainings, among others (ADI, Netwrix, Trend), in addition to exclusions for critical infrastructure, business interruption gaps, and limitations on third-party liability coverage create challenges that organizations must carefully navigate.

Critical Infrastructure Exclusions
One significant limitation involves exclusions related to failures in critical infrastructure. Policies increasingly exclude losses stemming from disruptions to essential services, such as electricity, water, gas, satellite, and telecommunications. This exclusion reflects insurers’ concerns about the systemic nature of these failures, which can cause widespread, catastrophic losses beyond the financial capacity of individual insurers to absorb. This shift reflects insurers’ limited capacity to manage systemic catastrophic losses, leaving critical industries particularly exposed (ABI, Munich RE, Gallagher).

Business Interruption Gaps
Business interruption coverage presents another significant limitation. Policies can include waiting periods before activation, narrowly define covered events, and may require complete business shutdowns to trigger coverage. Contingent business interruption, which protects against service provider failures, is not universally included in cyber insurance policies, leaving businesses vulnerable to operational disruptions. (SCS Agency, Corvus, Insurance Advisor).

Third-Party Liability Issues
Third-party liability coverage also features notable restrictions. Policies may exclude claims from employees, contractors, or partially owned subsidiaries and often cap coverage for regulatory investigations, lawsuits, and settlements. These exclusions require careful evaluation (Intelice, SCS Agency, ABI, Gallagher).

Claims Management Challenges

Even when coverage is in place, navigating the claims process presents its own set of obstacles. Businesses must adhere to strict reporting timelines, documentation standards, and recovery requirements to avoid delays or denials.

Response Time Requirements
Timely reporting is critical to avoid claim denial. Most insurers require notification of incidents within 60 days of an event (Lawyers Mutual, NACHC)). Quick coordination with approved vendors and stakeholders is also essential to meet policy deadlines.

Documentation Demands
Insurers now require rigorous documentation for claims, including detailed incident response logs, system restoration costs, business interruption calculations, third-party vendor expenses, and evidence of pre-incident security measures. Formal proof of loss submissions are typically required within 90 days (WTW), Failure to meet these demanding standards can result in denied claims or delayed payouts.

Recovery Process Complexities
The recovery process itself is not without challenges. Insurers frequently mandate the use of pre-approved vendors, limiting flexibility. Moreover, policies generally only cover system restoration to pre-incident states, leaving businesses responsible for any improvements. This meticulous cost-tracking adds to the administrative burden during post-incident recovery (Marsh).

Cost-Benefit Considerations

As the U.S. cyber insurance market dominates 59% of the $16.66 billion in global premiums (NAIC), businesses must weigh the costs and benefits of coverage carefully.

Premium vs Coverage Analysis
U.S. insurers reported $7.25 billion in direct written premiums in 2024 (NAIC). Premiums vary based on company size, industry risk, security measures, and claims history. Small businesses, for example, pay an average of $145 per month (Insureon), while larger organizations face significantly higher premiums.

Deductible Structure Impact
Deductibles also play a crucial role in shaping the cost-benefit analysis of cyber insurance. With average deductibles around $2,500 (Insureon), companies may adjust their self-insured retentions (SIRs) to manage premium expenses (Johnson and Bell, Lowenstein Sandler).

Return on Insurance Investment
When evaluating the return on investment (ROI) for cyber insurance, businesses must consider factors such as reputation protection, regulatory compliance support, crisis management assistance, and legal liability coverage Improved loss ratios reported by insurers—dropping from 66.4% in 2021 to 44.6% in 2022—reflect better risk management and policy terms (NAIC).

Future Market Predictions
The global cyber insurance market is projected to grow from $14 billion in 2023 to $23 billion by 2026 (Insurance Business Magazine). This growth underscores the increasing costs of premiums and evolving coverage requirements discussed earlier, as insurers adapt to the rising frequency and severity of cyber incidents. This growth will be driven by technological advancements, emerging threats, and enhanced risk assessment tools. AI, in particular, is reshaping risk modeling, claims processing, and incident monitoring. However, human expertise remains critical to bridging existing coverage gaps and ensuring comprehensive protection (Insurance Thought Leadership, ABA, Munich RE).

Conclusion

While cyber insurance provides a vital safety net for businesses facing financial and operational risks, its limitations—from restrictive policies to complex claims processes—pose significant challenges. As the market continues to grow, organizations must adopt proactive risk management strategies, meet stringent insurer requirements, and address coverage gaps. Ultimately, cyber insurance should complement, not replace, robust cybersecurity practices. By aligning insurance coverage with comprehensive security measures, businesses can enhance resilience in an increasingly hostile digital landscape.

Cyber Insurance in 2024—Key Requirements and Industry Insights

Posted on February 24, 2025 by Mabel Sabogal, PhD

Businesses are losing an average of $4.88 million per breach from cyber attacks in 2024, and these figures continue to increase (IBM). The rising threats have turned cyber insurance from a nice-to-have into a must-have business tool. The cyber insurance market moves faster than ever. Insurers now demand tougher requirements and adjust their coverage to counter new threats. Companies must meet strict cyber insurance standards such as “the use of multifactor authentication, regular software updates, vulnerability patching and training employees” (Cybersecurity Dive).

This piece breaks down today’s cyber insurance world, what you need for coverage, and the trends that shape the industry in 2024.

Current State of the Cyber Insurance Market

The U.S. leads the world’s cyber insurance market, which has reached a new level of maturity, generating USD 16.66 billion in global premium volume during 2023, with the U.S. contributing 59% of the total (NAIC). U.S. insurers alone reported USD 7.25 billion in direct written premium, marking steady growth since 2022. This expansion is further reflected in a 11.7% increase in active policies, totaling 4,369,741 in 2023 (NAIC).

Key indicators reveal a market that is stabilizing and evolving to meet demand:

Premium rates dropped by 6% in regions of all sizes.
The SME segment remains underserved, with 72% of uninsured businesses recognizing their cyber risks but lacking coverage.
Overall market conditions have stabilized, with lower rate increases and some flat renewals, signaling a maturation phase for the sector.

(Cybersecurity Dive, NAIC)

However, this stabilization does not imply reduced risks. While market conditions appear steadier, the frequency and severity of claims have continued to increase since 2022 (Coalition). According to Allianz’s annual cyber risk outlook, the frequency of large cyber claims (over €1 million) increased by 14% and their severity by 17% in the first half of 2024. Notably, data and privacy breaches were involved in two-thirds of these major losses (Allianz). In response, insurance providers have tightened their underwriting rules significantly. They now have detailed requirements that organizations need to meet for cyber coverage.

Mandatory Security Controls

Today, organizations need specific security measures in their digital world to get cyber insurance coverage. Multi-factor authentication (MFA) is the main requirement, and insurers want it on all critical systems and administrator accounts, but there are other core security controls:

Control	Description
Multi-Factor Authentication (MFA)	A security measure that requires users to provide two or more verification methods, such as a password and a mobile app, to gain access. MFA significantly reduces unauthorized access risks.
Patch Management	The process of consistently updating and fixing software vulnerabilities to prevent exploits. Includes prioritizing, testing, and deploying updates to systems and applications.
Endpoint Detection and Response (EDR)	A cybersecurity solution for detecting, analyzing, and responding to threats on devices like laptops and mobile phones.
Incident Response Plan	A detailed plan outlining steps to identify, contain, eradicate, and recover from a cyberattack. Includes public relations strategies and technical/business continuity measures.
Employee Training and Awareness	Regular training sessions that educate employees on identifying phishing attempts, using strong passwords, and adopting safe online practices to minimize human error as a cybersecurity risk.
Immutable and Isolated Backup Systems	Ensures data cannot be altered or deleted, a safeguard against ransomware attacks.
Privileged Access Management (PAM)	Critical for managing and securing administrator-level accounts, which are high-value targets for attackers. Insurers value PAM to enforce least-privilege access and limit lateral movement during breaches.
Compliance with regulations and policies	Ensures organizations adhere to standards like NIST SP 800-171 or CIP regulations, which establish required cybersecurity practices for specific industries.
Third-party risk management	Establishes a framework for evaluating and monitoring vendors’ and partners’ cybersecurity practices to reduce supply chain vulnerabilities.
Modern Attack Surface Management (ASM)	ASM provides real-time visibility and continuous risk assessment, enabling proactive responses to vulnerabilities. Integration across devices, accounts, and applications strengthens the overall cybersecurity posture.
Secure network access controls	Applies encryption, MFA, and other security measures to mitigate risks associated with remote desktop protocols and remote work.

Other requirements might include cybersecurity awareness training for all users, security information and event management (SIEM), monitoring event logs, content filtering, supply chain risk management, replacement of end-of-life systems, secure remote access, and vulnerability prioritization. Recent industry data show the great majority of cyber breaches come from human mistakes, highlighting the importance of reliable security measures in that regard (UpGuard, Verizon).

Furthermore, technology has transformed cyber insurance requirements. Insurers now need sophisticated security measures that use artificial intelligence and machine learning. Recent data show that machine learning algorithms have improved threat detection rates dramatically compared to traditional methods (Cyber Magazine, EST, Trend, Kaspersky, WSJ).

Extended Detection and Response (XDR) has become essential, replacing traditional endpoint detection and response (EDR) systems. Insurance providers now need:

AI Security Component	Description
Threat Intelligence	Immediate correlation in multiple security layers
Automated Response	Machine learning-driven incident containment
Predictive Analytics	Proactive vulnerability identification
Behavioral Analysis	Continuous monitoring of user patterns

In addition, cloud security governance has become vital. Insurers need complete protocols for cloud-based operations. Key requirements include:

Implementation of immediate telemetry data monitoring
Dynamic risk assessment through API-driven systems
Continuous compliance validation in multi-cloud environments
Automated configuration management and vulnerability scanning

(Proofpoint, Coalition)

Compliance Framework Implementation

Organizations seeking cyber insurance coverage should consider adopting recognized cybersecurity frameworks that align with industry standards. In fact, insurers often require organizations to adhere to established cybersecurity frameworks to assess and mitigate risks effectively. Some prominent frameworks include:

NIST Cybersecurity Framework: Developed by the National Institute of Standards and Technology, this framework provides a structured approach to managing and reducing cybersecurity risks.
ISO 27001: This standard specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).
SOC 2: Developed by the American Institute of Certified Public Accountants, SOC 2 focuses on controls relevant to security, availability, processing integrity, confidentiality, and privacy.

(BitSight, Nemko)

Documentation and Reporting Standards

Detailed documentation is central to securing and maintaining cyber insurance coverage, ensuring clarity and compliance throughout the policy period. Cyber insurance policies must clearly outline the protocols for reporting security incidents, including specific deadlines and notification procedures. To meet insurer requirements, organizations must maintain thorough records across key areas, including:

Legal and regulatory compliance costs
Breach notification procedures
Investigation and review processes
Settlement coverage specifications

This documentation must not only meet regulatory requirements but also provide sufficient detail to facilitate smooth claims processing. Insurers increasingly demand proof of proactive measures, such as regular security audits and system reviews, to ensure that organizations maintain robust cybersecurity practices throughout the policy term. By meeting these expectations, businesses can demonstrate preparedness and reduce potential liability.

(WTW, Coalition, FDIC, CISA)

Cost-Benefit Analysis

Organizations need to assess how their cyber insurance investments impact their finances; particularly as premium costs fluctuate. Small businesses, for instance, typically pay an average of USD 145 per month for cyber insurance, although this amount can vary depending on several key factors. Insurance providers consider the following elements when determining premiums:

Factor	Impact on Premium
Company Size/Revenue	Higher revenue = Higher premium
Industry Sector	Healthcare/Finance = Higher rates
Security Measures	Strong controls = Lower rates
Claims History	Previous incidents = Higher costs
Data Management	Sensitive data = Premium increase

Small businesses can typically secure basic coverage at more affordable rates, while larger organizations with a significant online presence face higher premiums due to the greater risks they encounter (Insure on, TechInsurance, Founders Shield).

ROI Assessment Methods

Cyber risk quantification (CRQ) has changed how companies calculate ROI for cyber insurance investments. Companies now use automated CRQ solutions that give more accurate results than manual calculations. The assessment looks at:

Financial effects of possible cyber events
How well current security controls work
Possible losses compared to premium costs
Whether coverage matches identified risks

(Squalify, KOVRR)

Risk Mitigation Benefits

The total global cyber insurance premiums were estimated to be around USD 14 billion at the end of 2023, with projections to reach USD 23 billion by 2026. North America remains the largest market segment within the global total (Industrial, Captive). This growing investment in cyber insurance reflects the comprehensive protection it offers, with research indicating that companies with robust cyber insurance spend less when breaches occur. In 2024, the average claim payments for cyber insurance show the financial impact of cyber incidents:

The average loss amount is approximately $100,000
For small and medium-sized enterprises (SMEs), the average claim cost is around USD 345,000, with ransomware events specifically averaging USD 485,000.
The average claim for all organizations is $812,360

(Network Assured, Astra, Coalition)

Cyber insurance also offers several additional services that enhance its overall value, including:

Risk assessment and security audits before problems occur
Help with incident response planning
Employee cybersecurity training programs
Special forensic services when needed

By implementing recommended security measures, organizations not only strengthen their defenses but may also improve their insurance terms, potentially lowering premiums through the demonstration of a strong security posture.

Industry-Specific Compliance

Different industries face varying cybersecurity compliance requirements and insurance mandates based on their unique challenges. For example, the healthcare sector saw a 93% increase in large breaches from 2018 to 2022, and ransomware incidents jumped by 278% during this period (HHS). Furthermore, data from 2023 reveal that 58% of the 77.3 million individuals affected by data breaches were victims of healthcare business associate attacks, “a 287% increase compared to 2022” (AHA). In that sense, healthcare organizations face strict cybersecurity rules because they handle sensitive patient data. Some of these rules include:

Data Protection: Encryption of patient records
Access Management: Role-based authentication
Incident Response: 72-hour breach notification
Business Continuity: Extended downtime procedures

(HIPPA Journal, VISEVEN)

Similarly, financial institutions must follow detailed cybersecurity frameworks set by regulators. For instance, the New York Department of Financial Services (NYDFS) has rolled out stronger requirements (DFS) that focus on better governance oversight; broader notice requirements; required encryption of non-public information; and strict multi-factor authentication protocols.

In the same vein, critical infrastructure protection has become a national priority. The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) works with 12 other agencies to protect various sectors. They have enhanced security protocols, including include changes in sector-specific cybersecurity performance goals; required incident reporting; regular vulnerability checks; and integration with national cybersecurity frameworks (CISA, Gallagher, The Register, CISA, CISA).

The energy sector faces unique challenges, as it needs protection against threats that could disrupt vital supplies. The North American Electric Reliability Corporation’s (NERC) Critical Infrastructure Protection standards require strong security measures, including risk assessments and system resilience testing (FERC).

In short, companies need to meet sector-specific requirements to keep their cyber insurance coverage. Insurance providers now look more closely at security controls and incident response capabilities. Breaking these rules can lead to heavy penalties, including monetary fines and possible coverage denials.

Conclusion

Cyber insurance has evolved from a supplementary safeguard to a critical business necessity, driven by the rising costs of breaches and the growing sophistication of cyber threats. Today, organizations must meet rigorous security standards, such as implementing multi-factor authentication (MFA) and adopting AI-driven threat detection systems. While premium rates have generally declined, the strength and breadth of coverage options reflect the stability of the market.

Modern cyber insurance policies are now built upon strong security practices, established compliance frameworks, and rigorous documentation standards. Companies that demonstrate robust security controls through regular assessments can secure more favorable coverage terms. The continued evolution of cyber threats is mirrored by the increasing reliance on advanced technologies, especially AI-driven security solutions.

The financial impact remains significant, with premiums varying based on company size, industry, and the strength of implemented security measures. Sectors such as healthcare, finance, and critical infrastructure face additional compliance requirements due to the sensitive nature of their data and operations.

These comprehensive requirements not only protect insured organizations but also contribute to enhanced cybersecurity practices across industries. As the cyber insurance market matures, it continues to adapt its standards and coverage models to address emerging threats and technological advancements.

Where Atlantic Digital Makes the Difference

Cyber insurance demands strong cybersecurity foundations, and that’s exactly what Atlantic Digital delivers. Through our CMMC compliance solutions, we help businesses achieve more than just certification. By guiding you through CMMC’s stringent security controls, including MFA, risk management, continuous monitoring, and incident response, we ensure you meet the tough standards insurers now require.

CMMC can be your key to becoming a more insurable, resilient business.

Is your organization prepared to meet these new requirements? Let Atlantic Digital help you implement the right cybersecurity measures and frameworks to secure insurance coverage and mitigate risks. Contact us today!

The 32 CFR CMMC Final Rule: Implications, and Preparations for Defense Contractors

Posted on October 16, 2024 by Mabel Sabogal, PhD

Introduction

The cybersecurity landscape is undergoing rapid transformation, and the Department of Defense (DoD) is making substantial strides to safeguard sensitive information. On October 15, 2024, the 32 CFR Cybersecurity Maturity Model Certification (CMMC) Final Rule was published in the Federal Register, marking a pivotal development in defense cybersecurity (visit Atlantic Digital for a detailed timeline of these developments). This framework strengthens cybersecurity compliance across the Defense Industrial Base (DIB) by aligning with NIST standards and reinforcing the security posture of DoD contractors. Understanding the key changes and implications of this new rule is essential for defense contractors navigating the evolving landscape of cybersecurity regulations.

Key Changes and Requirements

The CMMC Final Rule introduces significant changes to the cybersecurity requirements for DoD contractors. It places the onus of compliance timing on contractors and subcontractors, requiring them to achieve the specified CMMC level before contract awards. This shift necessitates careful consideration of business objectives, and the resources required for certification.

Once fully implemented, the DoD will only accept assessments from authorized and accredited Certified Third-Party Assessment Organizations (C3PAOs) or certified CMMC Assessors (DoD CIO, Cyber AB). This ensures a standardized approach to cybersecurity evaluation across the DIB. The proposal introduces a tiered system for assessments based on the sensitivity of the information handled. Contractors dealing with Federal Contract Information (FCI) will be required to perform annual self-assessments, while those managing critical national security information will undergo CMMC Level 2 third-party assessments. The most critical defense programs will face government-led assessments. (Atlantic Digital)

Additionally, the rule introduces a CMMC assessment appeal process, allowing organizations to address disputes related to assessor errors or unethical conduct. However, ultimate liability in assessment disputes remains between the organization seeking certification and the C3PAO (DoDCIO). To maintain transparency and accountability, the DoD will have access to assessment results and final reports. Contractors’ self-assessment results will be stored in the Supplier Performance Risk System (SPRS), while CMMC certificates and third-party assessment data will be housed in the CMMC Enterprise Mission Assurance Support Services (eMASS) database (DoD CIO).

Impact on Small and Medium Businesses

The CMMC Final Rule has significant implications for small and medium businesses (SMBs) in the DIB. These organizations face unique challenges in achieving compliance with the new cybersecurity standards.

One of the primary hurdles is the correct identification and categorization of CUI and FCI. Many small businesses struggle with this task (DoD CIO). Additionally, the financial burden of implementing CMMC requirements presents a significant concern for these businesses. The costs associated with security controls, audit preparation, and the certification process can be substantial, placing a heavy strain on companies with limited budgets (Atlantic Digital). Furthermore, small businesses must also consider the operational, technical, legal, and scheduling implications of either achieving or failing to meet compliance standards, which can affect their ability to continue doing business with the DoD (Atlantic Digital). SMBs need to work proactively to address these challenges, to enhance cybersecurity resilience, and capitalize on growth opportunities in the defense sector.

Preparing for FY25 Implementation

As the Department of Defense (DoD) prepares for full CMMC implementation, contractors must take calculated measures to ensure compliance. The phased rollout plan, expected to begin in FY25, underscores the need for readiness, as the number of contracts requiring CMMC certification is projected to increase significantly. (ClearanceJobs, Atlantic Digital).

To prepare, organizations should first identify their required CMMC level based on the sensitivity of the information they handle. Conducting a thorough NIST 800-171 and CMMC gap analysis is crucial to assess the current cybersecurity posture. Companies must then develop comprehensive System Security Plans (SSPs) and Plans of Action & Milestones (POA&Ms) to address any identified gaps (Federal Register).

Partnering with a C3PAO is crucial for the certification process. However, to prevent conflicts of interest, C3PAOs are prohibited from offering consulting services before conducting their assessments. This is where Atlantic Digital (ADI) comes in. As a consultant, ADI provides expert guidance that simplifies the certification process, ensuring timely compliance and facilitating smooth access to government contracts.

Conclusion

The evolving cybersecurity landscape and the DoD’s push to enhance protection through the CMMC final rule represent a significant shift for defense contractors. The framework aims to strengthen the cybersecurity posture of organizations across the DIB by aligning with NIST standards and streamlining compliance requirements. With the phased implementation plan set to begin in FY25, it is crucial for contractors to proactively address the upcoming changes.

Understanding the intricacies of the proposed CMMC final rule is essential for organizations seeking to maintain and secure their defense contracts. The adjustments outlined in the Federal Register Final Rule emphasize the need for contractors to be vigilant, prepared, and aligned with new compliance requirements. By conducting thorough gap analyses, developing robust security plans, and engaging with experts at organizations such as ADI, contractors can better navigate the complexities of CMMC certification and ensure they meet the necessary standards.

As the defense sector prepares for these pivotal changes, staying informed and taking decisive action will be crucial for maintaining a competitive edge and safeguarding sensitive information. The CMMC Final Rule represents not only a regulatory shift but also an opportunity for organizations to enhance their cybersecurity resilience and align with industry best practices. Contact Atlantic Digital to learn more about how our tailored services can safeguard your organization’s future in the evolving landscape of defense industry cybersecurity.

CMMC Timeline

Posted on October 16, 2024 by Mabel Sabogal, PhD

Introduction 

The Cybersecurity Maturity Model Certification (CMMC) serves as a vital framework established by the Department of Defense (DoD) to bolster cybersecurity within the Defense Industrial Base (DIB). As cybersecurity threats continue to evolve, the necessity for a comprehensive certification process has become increasingly urgent. The publication of the 32 CFR Cybersecurity Maturity Model Certification (CMMC) 2.0 Final Rule in the Federal Register on October 15, 2024, marks a pivotal development in the DoD’s mission to safeguard sensitive information. This framework is designed not only to enhance compliance among defense contractors but also to ensure the implementation of robust security measures essential for protecting Controlled Unclassified Information (CUI).

Understanding the nuances of the Federal Register is critical in this context, as it serves as the official journal of the U.S. government, detailing proposed and final rules along with other significant regulatory documents.

The Federal Register and Its Role in Rulemaking

The Federal Register plays a crucial role in the rulemaking process by providing transparency and enabling public feedback on proposed regulations. The publication of a proposed rule in the Federal Register follows a period of internal development and review, leading to a public comment period where stakeholders can express support, concerns, or suggestions for modifications. Although the timeline for finalizing a rule can vary, the publication of a proposed rule signifies the DoD’s intent to enforce new cybersecurity standards, making these requirements binding across the DIB. Once a rule is finalized, it is officially published in the Federal Register as a Final Rule, signaling that all public input has been considered, and the rule is ready to be implemented and enforced as law. (Federal Register).

Timeline for the CMMC Program 

Building on the foundation established by the Federal Register, understanding the evolution of the CMMC program leading to CMMC 2.0 is essential. It is important to note that the security requirements forming the basis of CMMC 2.0 Level 2, as outlined in NIST SP 800-171, have been mandatory for DoD contractors handling sensitive information since December 2017. This requirement followed the introduction of DFARS clause 252.204-7012, which addresses the safeguarding of Covered Defense Information and Cyber Incident Reporting in DoD solicitations and contracts. However, enforcement of these requirements initially relied on self-attestation, lacking an effective verification process.

Consequently, many contractors did not fully implement the necessary security controls, which limited the DoD’s ability to ensure compliance. In response to these challenges, the DoD initiated the CMMC program as a structured framework for verifying compliance with the DFARS requirements. This initiative established a system through which compliance is assessed by CMMC Third Party Assessment Organizations (C3PAOs), which are certified by the DoD (RiskInsight).

Some of the CMMC program key milestones are as follows: 

In 2019, the DoD announced the development of the Cybersecurity Maturity Model Certification (CMMC) as a crucial step to enhance the cybersecurity posture of the Defense Industrial Base (DIB) sector against evolving threats. This initiative was conceived by the Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) to transition from a self-attestation model of security to a structured certification process (Federal Register).

On September 9, 2020, the DoD published the 48 CFR CMMC interim rule to the DFARS in the Federal Register (DFARS Case 2019-D041 85 FR 48513), which implemented the DoD’s initial vision for the CMMC program (“CMMC 1.0”) (DoDCIO, Federal Register).  This rule integrated requirements from the DFARS clause DFARS 252.204-7012, mandating defense contractors to implement NIST SP 800-171 controls to safeguard Covered Defense Information (CDI—Unclassified information specifically connected to defense contracts, programs, or operations), and report cyber incidents within 72 hours (Summit7). Additionally, it extended these obligations to subcontractors throughout the supply chain, introducing clauses like 252.204-7020 and 252.204-7021 that govern compliance with CMMC requirements and assessment methodologies. This shift formalized the CMMC certification process and emphasized the importance of protecting Controlled Unclassified Information (CUI), which is sensitive information that, while not classified, could still pose a risk to national security or other critical interests if improperly disclosed.

CMMC 1.0 ensured that contractors handling CUI met a baseline cybersecurity standard and could respond quickly to cyber incidents. It required these contractors to obtain third-party CMMC certification through C3PAOs, marking a significant departure from the self-attestation approach under DFARS 252.204-7012.  The interim 48 CFR CMMC 1.0 rule became effective on November 30, 2020, marking the start of a phased rollout of CMMC requirements over five years (Federal Register, DoDCIO, CyberSheath, Acquisition.gov, LII / Legal Information Institute).

 In March 2021, the Department initiated an internal review of CMMC’s implementation, responding to approximately 750 public comments on the 48 CFR CMMC interim final rule. This review led to proposed updates, that would ensure the incorporation of the latest CMMC 2.0 requirements into the federal acquisition process. These updates were intended to provide clarity and enforce compliance, aligning cybersecurity requirements with the CMMC standards (Federal Register).

The DoD announced 32 CFR CMMC 2.0, on November 4, 2021. This revision aimed to simplify the certification structure to three levels and reduce the cost burden on small and medium-sized businesses (SMBs), while also aligning assessments with NIST standards and maintaining key protections outlined in DFARS 252.204-7012 (Summit7, DoDCIO, CyberSheath), The 32 CFR CMMC 2.0 Proposed Rule was subsequently published in the Federal Register on December 26, 2023 (DoD).

On June 27, 2024, the DoD submitted a draft of the 32 CFR CMMC 2.0 Final Rule to the Office of Information and Regulatory Affairs (OIRA), which is part of the standard rulemaking process, marking a key step toward the finalization of CMMC 2.0 (RiskInsight).

Additionally, on August 15, 2024, the DoD issued a Proposed Rule to amend the Defense Federal Acquisition Regulation Supplement (DFARS), incorporating the latest CMMC 2.0 requirements (Arnold & Porter, Atlantic Digital). This amendment updates the existing requirements of DFARS 252.204-7021, which outlines the cybersecurity certification levels that contractors must achieve to handle sensitive defense information. This rule builds directly upon the requirements established in DFARS 252.204-7012.  It also aligns with 32 CFR 117.8, which specifies reporting requirements for contractors working with classified information. Both 32 CFR 117.8 and the DFARS regulations emphasize the importance of reporting security incidents and any material changes that could affect defense contracts. (National Archives, DoD). Following its publication in the Federal Register, the Proposed Rule initiated a public comment period. Once this period concludes and revisions are implemented based on stakeholder feedback, the rule is expected to be finalized in early 2025, becoming enforceable and requiring all contractors to comply with the updated CMMC 2.0 standards to be eligible for DoD contracts. This proposed rule will also serve as an update to the 48 CFR, which governs the entire federal acquisition process, ensuring consistent alignment with cybersecurity requirements.

Finally, the 32 CFR CMMC 2.0 Final Rule was published on October 15, 2024, and will become effective on December 16, 2024. This rule mandates that contractors must be certified under CMMC 2.0 before they can bid on or be awarded defense contracts; thereby, enforcing the CMMC 2.0 requirements across the DIB. The phased rollout will facilitate a gradual compliance process for contractors, ultimately strengthening cybersecurity across the entire defense supply chain.  The full impact of the Final Rule is expected to manifest in early 2025 (Arnold & Porter, ECURON).

In sum, the 48 CFR Final Rule, which includes the DFARS as a supplement to the Federal Acquisition Regulation, will enforce compliance through contractual obligations. In contrast, the 32 CFR Final Rule will outline the detailed cybersecurity practices contractors are required to adopt. This alignment between the DFARS and the 32 CFR Final Rule demonstrates the DoD’s concerted effort to integrate stringent cybersecurity controls and reporting protocols into defense contracts, ensuring that the entire defense supply chain is fortified against potential cybersecurity threats.

Conclusion

The timeline of the CMMC program reflects a critical evolution in the DoD’s approach to cybersecurity. The integration of the CMMC requirements into the federal acquisition process, as detailed in the Federal Register, underscores the importance of a structured, enforceable framework for protecting sensitive information. By mandating compliance and certification, the DoD is taking essential steps to enhance the cybersecurity posture of the Defense Industrial Base, ensuring that contractors are equipped to manage and mitigate potential threats effectively. To learn more about the CMMC timeline and its implications, visit the Atlantic Digital Blog or contact us for a consultation regarding your CMMC compliance needs.