Issue link: https://iconnect007.uberflip.com/i/1541985
26 PCB007 MAGAZINE I DECEMBER 2025 A RT I C L E BY MARCY LARONT, I-CONNECT007 CMMC 2.0: What You Need to Know T he U.S. Department of Defense's Cybersecu- rity Maturity Model Certification (CMMC) 2.0 officially took effect on Nov. 10, marking a major shift in cybersecurity expectations for the defense industrial base. The update moves the program from concept to contract requirement, and for PCB and electronics manufacturers in the defense sup- ply chain, compliance is no longer optional. It is the new gate to doing business with the Defense department. CMMC 2.0 is now being written directly into DoD contracts and enforced through the Defense Fed- eral Acquisition Regulation Supplement (DFARS) as part of a three-year phased rollout. Contractors will begin seeing the requirements appear in new solicitations and, in some cases, contract modifi- cations. For many small and mid-sized suppliers, this transition represents both an operational and cultural shift in how sensitive information must be handled. A Brief Look Back When CMMC 1.0 debuted in 2020, it offered a five- level maturity model containing 17 domains and 171 practices. Every defense contractor, regardless of size, was expected to seek third-party certification at the designated level. The model was ambitious but unwieldy. For small manufacturers, in particu- lar, the structure proved expensive, complex, and difficult to implement. It never reached wide-scale adoption before Defense rethought the frame- work. What's New in CMMC 2.0 CMMC 2.0 reduces the original five-level system to three and now aligns closely with existing National Institute of Standards and Technology (NIST) and Federal Acquisition Regulatory (FAR) council cyber- security requirements. Level 1 focuses on basic safeguarding of federal contract information and requires only an annual self-assessment with an