CMMC 2.0 Phase 1 enforcement is in effect and isn’t going anywhere: contractors handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) must self-assess and attest to NIST SP 800-171 controls now, with False Claims Act exposure for false attestations. Phase 2 — the requirement for independent C3PAO third-party assessment of Level 2 and Read more…