DoD Issues Clarification on CMMC Level 2 Requirements for Subcontractors
The Department of Defense has clarified that subcontractors must obtain Cybersecurity Maturity Model Certification (CMMC) Level 2 when processing Controlled Unclassified Information (CUI). This guidance highlights potential compliance challenges for small businesses and emphasizes the importance of contract clauses in managing cybersecurity responsibilities.