CMMC 2.0 directly impacts how Defense Industrial Base contractors will be required to implement cybersecurity safeguards. The changes may ease compliance burdens for Level 1 contractors who only handle Federal Contract Information and Level 2 contractors who handle non-critical Controlled Unclassified Information—both of whom can perform self-assessments to show compliance. The Pentagon previously estimated that a substantial majority of DIB companies would require only basic cyber hygiene. However, contractors who hold CUI and were previously required to meet Level 2 security practices may face more stringent requirements under CMMC 2.0’s Level 3.
Source: