For the 220,000 private companies that do work with the Department of Defense (DoD), time is running out. The DoD’s latest version of its mandatory Cybersecurity Maturity Model Certification, CMMC 2.0, arrived in early 2023, providing a long-awaited framework to protect the public against cybersecurity threats.

While companies have known for years that certification would be mandatory, many have taken no steps toward becoming compliant—despite the fact that 80,000 contractors will require a Level 2 or Level 3 certification to continue working with the government. How serious is this requirement? Consider that Level 2 alone requires the implementation of 110 cybersecurity practices identified in the National Institute for Standards and Technology (NIST) special publication (SP) 800-17.