Read on grclab.com | Read time: 3 minutes
Welcome to GRC Lab, a weekly newsletter where we provide actionable advice to help you launch, grow and accelerate your career in Governance, Risk and Compliance.
P.S. You can find free tutorials on our YouTube Channel.
Inside this Edition
Here’s what we got for you today:
Learn about the fundamentals of CMMC, how it works and who is affected by it.
NIST releases updated guidelines on media sanitization.
GRC Spotlight
NIST Releases Updated Guidelines on Media Sanitization
NIST has released SP 800-88r2, an updated guide on media sanitization. This publication is about the process of making data on storage media irretrievable. The revision shifts focus from hands-on sanitization methods to establishing enterprise-wide media sanitization programs that protect sensitive information during disposal or reuse.
You can find the updated guidance here.
This week, I’m thrilled to welcome Jacob Hill, Director of Cybersecurity at Summit 7, as a guest author.
Some of you might remember Jacob from his GRC Academy Podcast, which was the very first podcast I was invited to join. He’s an excellent educator, and I’m very happy that he has agreed to write this guest edition of GRC Lab.
In the article below, Jacob shares his insights on CMMC and its impact on organizations today.
After so many years of waiting CMMC is finally here!
The United States Department of War (DoW) released the Cybersecurity Maturity Model Certification (CMMC) final acquisition rule on August 15, 2025 and it becomes effective on November 10, 2025.
Let’s dive into what CMMC is and what happens next!
How did we get here?
Foreign adversaries have been compromising DoW contractor networks and stealing information about critical DoW programs for years.
The department responded by creating contractual clauses focused on the implementation of NIST 800-171’s security controls. NIST 800-171 outlines the controls necessary to protect Controlled Unclassified Information (CUI) on non-government systems.
DFARS 252.204-7012 required contractors to:
Implement NIST 800-171 no later than December 31, 2017
Report cyber incidents within 72 hours
Use FedRAMP moderate “equivalent” cloud service providers when they hold CUI
The DoW soon discovered that contractors were still not implementing the security controls, so the DoW created provision DFARS 252.204-7019 and contract clause DFARS 252.204-7020.
DFARS 252.204-7019 requires the contractor to submit a NIST 800-171 self-assessment score to DoW to be eligible for contract award.
DFARS 252.204-7020 requires the contractor to allow the government to perform third-party cyber assessments of the contractor’s covered network.
The government has been assessing contractor networks for years under DFARS 7020, and contractors have continued to demonstrate that self-attestation of cyber compliance does not work.
CMMC
“Cybersecurity Maturity Model Certification”
How does CMMC fit into the picture?
CMMC has three levels, and the requirements vary per level:
CMMC Level 1
Implement 15 controls
Required for contracts with only Federal Contract Information (FCI) (no CUI)
Contractor is required to perform a self-assessment – no 3rd-party assessment is required
CMMC Level 2
Implement 110 controls
Required for contracts with CUI
Many contracts will require a CMMC level 2 certification via a 3rd-party assessment by a C3PAO
CMMC Level 3
Implement 24 additional enhanced security controls
Required for DoW’s most critical CUI programs
All contracts will require a 3rd-party assessment by DIBCAC resulting in CMMC certification
CMMC level 2 certification is a prerequisite
Contracts/solicitations will require compliance or certification at a specific CMMC level and the government will not award a contract to a company that isn’t compliant.
The acquisition rule modifies a contractual clause called DFARS 252.204-7021 which is the contractual clause that will require either CMMC compliance or certification at a specified CMMC level.
It is estimated there are 80,000 and 300,000 companies in the Defense Industrial Base (DIB). It is impossible for the government to assess that number of companies.
CMMC expands the capacity to perform independent assessments and establishes an ecosystem of independent assessors called CMMC Third-Party Assessor Organizations (C3PAOs).
From the beginning, the DoW has been focused on protecting their information. Similar to health data in a HIPAA context, or PII in a privacy law context, FCI and CUI are the regulated information that is in scope.
In less than 5 minutes, the Summit 7 Pathfinder Tool shows you:
Where you currently stand on CMMC compliance
The exact steps to move forward with confidence
How to communicate the value and game plan to leadership
👉 Get CMMC Confident - take the quiz and get your tailored roadmap today.
What’s next?
CMMC certification assessments have been occurring since the CMMC final program rule became effective back in December of 2024. When the CMMC acquisition final rule is effective in November of 2025, the CMMC phase-in begins.
The CMMC timeline
Each phase of the CMMC rollout introduces progressively higher certification requirements, ultimately leading to full implementation by phase 4. Here’s a breakdown of the timeline:
Phase 1: Initial Requirements
Start Date: November 10, 2025
Requirements: contractors handling FCI and CUI will need to self-assess that they meet either CMMC level 1 or CMMC level 2 to qualify for applicable DoW contracts.
Optional: The DoW may require CMMC level 2 certification for specific contracts or option periods.
Phase 2: CMMC Level 2 Third-Party Assessments
Start Date: November 2026
Requirements: DoW will mandate CMMC level 2 certification requirements for contract awards, with the flexibility to require it only during option periods.
Optional: The DoW may begin to include CMMC level 3 certification requirements for contracts with higher security needs.
Phase 3: CMMC Level 3 Third-Party Assessments
Start Date: November 2027
Requirements: Both CMMC level 2 and CMMC level 3 certification will be required as conditions for new contracts and option periods.
Optional: The DoW may delay CMMC level 3 requirements to option periods for some contracts.
Phase 4: Full Implementation
Start Date: November 2028
Requirements: At this final phase, CMMC requirements will apply to all applicable contracts, including those awarded prior to Phase 4.
What contractors should do now
If your company hasn’t started working on NIST 800-171 and CMMC compliance, it is time to dive in before it is too late!
Large primes are applying more pressure on their subcontractors to become certified because they will be accountable for their subcontractors’ compliance – at all tiers.
Becoming CMMC certified early in the CMMC phase in period will be a competitive advantage, but over time it will become “the norm.”
Here are a few steps you should prioritize right now:
1. Determine Your Certification Level
Identify which CMMC level your organization needs based on the type of information you handle.
This step will determine the CMMC level of assessment and resources required. Plan ahead and think of the contracts you want to go after in the next three years, because CMMC level 1 will be limiting. C3PAOs can be found on the CyberAB marketplace.
2. To insource or outsource?
Does your team have the technical and cybersecurity skills to address the security controls?
If not, consider hiring a Managed Service Provider (MSP) like Summit 7 to manage your IT environment. Most MSPs are not focused on CMMC and unfortunately will be the cause of many failed CMMC assessments, so choosing the right MSP is critical!
3. Begin preparing ASAP
Estimates on how long it takes to go from 0% to 100% CMMC compliance range from 6 – 18 months. The duration varies based on the size and complexity of your organization and systems.
4. Engage with a C3PAO Early
If CMMC certification is in your future, reserve your assessment spot with a C3PAO as soon as you can. There are only 82 C3PAOs as of the time of this writing, and many of them are already booked into 2026.
5. Develop an Ongoing Compliance Strategy
CMMC certification requires annual affirmations of compliance. Set up regular reviews and training to ensure ongoing compliance.
Resources
CMMC may seem overwhelming. I remember encountering this firsthand when I began to research NIST 800-171 for my company many years ago. The good news is there are now excellent resources to help get you started quickly.
In addition to being the premier MSP for DoW contractors, we at Summit 7 offer a ton of free education on LinkedIn and our YouTube channel! We also offer a free CMMC pathfinder tool that helps you know where you are with CMMC and what to do next!
Here are several folks you should follow on LinkedIn to keep up with CMMC:
After learning from Summit 7’s content for so many years, it’s amazing to be part of the Summit 7 team!
Closing Thoughts
NIST 800-171 is the US federal standard to protect CUI.
Soon there will be a contractual clause in the FAR requiring the implementation of NIST 800-171 for federal (non-DoW) contracts. If you want to support the federal government, you will not be able to get away from these security controls.
For the sake of our nation’s security and your business’s survival, the time to comply is now.
Take control of your chaotic inbox
Stop drowning in spam. Proton Mail keeps your inbox clean, private, and focused—without ads or filters.
Test your Knowledge
Today’s question is from the CRISC curriculum:
At which stage of the SDLC are system vulnerabilities MOST likely to be discovered?
A) Planning
B) Development
C) Testing
D) Deployment
👉 Think you know the answer? Scroll down for the solution!
Share the Lab
Give yourself a free “MBA” in GRC with our library of must-have resources for every GRC professional.
👉 Refer just 1 friend and we’ll send over the database.
Your current referral count: {{ rp_num_referrals }}
Or share your personal link with others: {{ rp_refer_url }}
Your Feedback Matters
How helpful was today's Email?
Answer: The correct answer is C.
A) Planning focuses on defining the project but not on discovering vulnerabilities.
B) Development involves creating the system, and while vulnerabilities may be introduced here, they are not likely to be discovered.
C) Testing is where systems are rigorously evaluated for weaknesses, making it the most likely phase for discovering vulnerabilities.
D) By the time of deployment, it’s generally too late for vulnerability discovery to be most effective.