{"id":3519,"date":"2022-09-05T09:30:59","date_gmt":"2022-09-05T13:30:59","guid":{"rendered":"https:\/\/seaglasstech.wpenginepowered.com\/?p=3519"},"modified":"2023-04-17T10:26:21","modified_gmt":"2023-04-17T14:26:21","slug":"what-is-the-difference-between-dfars-and-cmmc","status":"publish","type":"post","link":"https:\/\/seaglasstechnology.com\/what-is-the-difference-between-dfars-and-cmmc\/","title":{"rendered":"What Is The Difference Between DFARS And CMMC?"},"content":{"rendered":"

\"viewThe Department of Defense (DoD) has released a new set of compliance measures for cybersecurity known as the CMMC<\/a>. The CMMC replaces the DFARS regulations, which were put in place in 2013 to ensure that defense contractors met specific cybersecurity standards. <\/p>\n

While both the DFARS and CMMC are concerned with ensuring the security of sensitive data, there are some key differences between the two frameworks. In this article, we will explore those differences and explain why companies should be aware of them.<\/p>\n

Why Has DFARS Been Replaced?<\/h2>\n

The Department of Defense’s (DoD) Defense Federal Acquisition Regulation Supplement (DFARS)<\/a> was initially released in 2000 in response to the increasing number of cyberattacks against the United States. <\/p>\n

The regulation outlined specific cybersecurity requirements<\/a> for defense contractors and was largely based on the National Institute of Standards and Technology (NIST) Cyber Security Framework. However, in recent years, DFARS has been replaced by the DoD’s more comprehensive CMMC standard.<\/p>\n

The CMMC is an outline of compliance measures that aim to protect critical military data from cyberattacks. It builds on the NIST Cyber Security Framework and includes additional requirements for defense contractors, such as vulnerability scanning and penetration testing<\/a>. The CMMC also establishes baseline security controls for different classification levels<\/a>, from low-risk to top secret.<\/p>\n

So why did DFARS get replaced by the CMMC? There are several reasons:<\/p>\n

    \n
  1. The CMMC is more comprehensive than DFARS.<\/strong> It includes additional requirements for defense contractors, such as vulnerability scanning and penetration testing.<\/li>\n
  2. The CMMC is more up-to-date with current cybersecurity threats. <\/strong>It builds on the NIST Cyber Security Framework, which has been updated multiple times since DFARS was released.<\/li>\n
  3. The CMMC is easier to enforce. <\/strong>It establishes baseline security controls for different classification levels, making it easier for the DoD to ensure that all defense contractors are meeting minimum cybersecurity standards.<\/li>\n<\/ol>\n

    The CMMC 2.0 Updates<\/h2>\n

    \"programmerThe Department of Defense (DoD) released the latest version of its cybersecurity compliance framework, the CMMC 2.0<\/a>, in October of 2019. The updates were necessary to address gaps in the original framework, which had been released in 2017.<\/p>\n

    The CMMC 2.0 includes a number of new features and improvements, including:<\/p>\n