-
- News
- Books
Featured Books
- smt007 Magazine
Latest Issues
Current IssueSolder Printing
In this issue, we turn a discerning eye to solder paste printing. As apertures shrink, and the requirement for multiple thicknesses of paste on the same board becomes more commonplace, consistently and accurately applying paste becomes ever more challenging.
A Culture of Thriving
One cannot simply command thriving; it must be nurtured, developed, and encouraged. In this issue, we explore strategies to improve your working relationship model—both internally and externally. In this culture of thriving, your business will grow in the process.
Certifications
Certifications have historically been seen as a cost of doing business, but how do we turn them into a positive ROI and a value to both customer and vendor?
- Articles
- Columns
Search Console
- Links
- Events
||| MENU - smt007 Magazine
The Double-edged Sword of CMMC 2.0
June 6, 2022 | Divyash Patel, MX2 TechnologyEstimated reading time: 2 minutes
![](https://iconnect007.com/application/files/1616/9086/8615/Divyash_Patel.jpg)
For the past few years, those whose SMT provider organizations supply or contract with the U.S. Department of Defense (DoD) have been hearing about—or even gearing up for—implementation of the Cybersecurity Maturity Model Certification (CMMC) program. By this, I mean that you were gearing up for CMMC 1.0. Today, we have CMMC 2.0, and there are several changes in the new version that impact both the standards for compliance and how you certify that compliance—especially if you run a small business.
Small businesses are the backbone of the defense industrial base (DIB), just as they are for the entire economy. As both patriots and businesspeople, I’m sure most contractors serving the DoD support the goals of the CMMC program: ensuring the security of sensitive data up and down the supply chain. I’m also certain that the CMMC 1.0 rules, which went into effect in November 2020, caused more than a little stress and anxiety for smaller contractors. Why? Because CMMC 1.0 required contractors to undergo an examination by a Certified Third-Party Assessment Organization (C3PAO) to become certified.
When it became clear that the burden CMMC 1.0 placed on small contractors was significant enough to potentially force some out of the DIB, the DoD hit pause on the CMMC program. In fact, the official in charge of the CMMC’s implementation came out and said one of the main goals of revising the program was to decrease the cost burden on small businesses. As a result, the DoD scrapped CMMC 1.0 and announced CMMC 2.0 in November 2021. The full 2.0 framework is expected to be released sometime next year.
But don’t make the mistake of thinking the government will kick the CMMC can down the road once again when 2023 rolls around. I fully expect CMMC 2.0 to come online when the rules are final.
At a high level, the two major changes that will likely affect you are the new tiers of security and the shift to annual self-attestation of compliance.
The original CMMC defined five levels of security. CMMC 2.0 has three:
- Foundational
- Advanced
- Expert
For most of you, the newly collapsed levels won’t change the practical compliance requirements. This is good news. Most contracts will fall into Level 1, so any work you have done to this point to achieve Level 1 compliance under CMMC 1.0 has not been wasted. The new framework relies on the same 17 baseline security controls used in the prior version—more on those controls in a moment.
The key distinction between Level 1 and Level 2 under CMMC 2.0 has to do with the type of information you handle. Level 1 focuses on securing federal contract information (FCI), for which there are no national security concerns. The bar for Level 1 is not set very high— it is essentially developing and maintaining good baseline cybersecurity policies and procedures. In my view, this is something any company should do; it’s just a good business practice.
To read this entire article, which appeared in the June 2022 issue of SMT007 Magazine, click here.
Suggested Items
Rehm Thermal Systems Invests in Future Talent with New Training Program
09/06/2024 | Rehm Thermal SystemsEvery autumn, thousands of school leavers in Germany start a dual vocational training programme, laying the foundations for their professional future. At Rehm Thermal Systems, a manufacturer of production equipment for the electronics industry, a new phase of life also began for eight young people on Monday, 2 September 2024.
Calling All California Employers: Harness State Funding for Workforce Training with IPC and ETP
09/05/2024 | IPCIPC, a global industry association dedicated to its member companies' competitive excellence and financial success, announces a pivotal opportunity for California employers under the Employment Training Panel (ETP) program.
SEMICON Taiwan 2024 to Open with Tech Giants Discussing AI and Semiconductors at CEO Summit
09/04/2024 | SEMISEMICON Taiwan 2024 SEMI opens today at the Taipei Nangang Exibition Center (TaiNEX Hall 2) with industry leaders and visionaries set to take part in this year’s CEO Summit keynote program.
Opportunity Knocks
09/04/2024 | Michelle Te, IPC CommunityIPC member DETEX Corporation of New Braunfels, Texas, like so many similar companies, strives to cultivate a highly skilled workforce to meet the growing demand for electronics assembly professionals. But also like many companies, DETEX, which engineers and manufactures security products, has struggled to hire qualified workers. Most employees are hired without certification or experience. Providing on-the-job training (OJT) without technical instruction has been met with limited success.
Air Force Awards Outpost $33.2 Million for Hypersonic Testing Vehicle
08/29/2024 | BUSINESS WIREThe anticipated AFWERX award will fund four principal Outpost missions of the company’s Ferryall Earth-return vehicle, and development of the large-scale Outpost Carryall vehicle, which will carry up to 10 tons of cargo back to Earth. The first launch is set for the end of 2026.