How we’re making sense of CMMC 2.0

This report reviews the DoD's proposed CMMC 2.0 updates, highlighting eight major changes—including elimination of levels 2 and 4, annual self-assessments for Level 1, contract-dictated Level 3 assessment types, removal of certain additional controls and process-maturity requirements, allowance of POA&Ms, and possible waivers—and discusses how these changes may reduce compliance burden for some organizations while introducing risks (e.g., reduced process maturity, potential misuse of waivers, and reliance on self-attestation).