Pentagon Releases Updated CMMC Documentation

The Defense Department has been increasingly focused in recent years on protecting controlled unclassified information, or CUI, within its supply chain. [...]recently contractors were working to implement requirements set forth under CMMC Version 1.0 in anticipation of the rollout. [...]it released key documentation over the final weeks of 2021 that provides insight into forthcoming program requirements, including: a model overview document; self-assessment scopes for Level 1 and 2 assessments/certifications; assessment guides for Level 1 and 2 attestations/certifications; and the artifact hashing tool user guide. Specialized assets are part of the assessment scope under Level 2, however, and contractors are required to document these assets in the system security plan and detail how they are managed using the contractor's risk-based information security policy, procedures and practices.