This repository is meant to be a one-stop-shop for all CMMCv2-related questions; it will lay out the requirements set by each of the 3 levels of the version 2 regulation, different ways in which compliance can be achieved in common environments, and it will offer insight into best practices, timelines, and expectations for business.

CMMCv2 is the latest iteration of the Cybersecurity Maturity Model Certification, it is a regulation created by the DoD to govern the minimum cybersecurity posture acceptable by active members of the Defense Industrial Base (DIB). It contains 3 levels of compliance which correspond to the level of security required by different kinds of information handled by the DIB; level 1 is for Federal Contract Information (FCI) and is required for every single organization doing business with the Department of Defense. Level 2 is for Controlled Unclassified Information (CUI or "cooey") which is refers to unclassified information which could still be harmful if released indiscriminately; level 2 mandates the protections layed out in NIST SP 800-171 as well as those inherited from level 1. There is some nuance to how the security requirements for levels 2 and 3 which will be explained later. Last, is level 3 which is reserved for secret or top secret information which adds to NISPOM requirements for protection of classified information. Level 3 inherits the protections mandated by level 2 and adds to them some of the items from NIST SP 800-172. All of these requirements are explained in more detail in their respective folders.

• Level 1
• Level 2
• Level 3

If you want to contribute you're welcome to push, pull, fork, etc. as you wish; as this project evolves I will update the procedures for contributing.

This work is licensed under GPLv2.