3
OPINION
The clock is ticking
Government contractors must act now to secure CMMC compliance – or risk losing valuable federal contracts.
F or government contractors in the architecture, engineering, and construction industry, cybersecurity compliance is no longer an option; it’s a requirement. The Department of Defense’s (DoD) Cybersecurity Maturity Model Certification (CMMC) 2.0 framework is set to take effect on October 1, 2025, and failing to meet its standards could mean losing valuable federal contracts.
Phil Keeney
If your firm handles Controlled Unclassified Information (CUI) as part of government projects, compliance with CMMC 2.0 Level 2 and NIST 800-171 is mandatory. With the deadline fast approaching, now is the time to assess your cybersecurity posture and take the necessary steps to ensure compliance. Waiting until the last minute will put you at risk. WHAT IS CMMC 2.0 AND WHY DOES IT MATTER? CMMC 2.0 is the DoD’s response to growing cybersecurity threats, designed to protect sensitive government data across the defense industrial base. This updated framework simplifies compliance by consolidating security requirements into three levels, with Level 2 aligning directly with NIST 800-171, a set of security controls that all contractors handling CUI must follow.
For AEC firms working on federal contracts, achieving compliance means more than just meeting regulations, it’s about safeguarding your business, protecting sensitive project data, and maintaining your eligibility to bid on government work. THE ROLE OF THE SPRS SCORE IN COMPLIANCE. A crucial component of meeting CMMC 2.0 and NIST 800-171 standards is your Supplier Performance Risk System (SPRS) score. The SPRS score is a numerical representation of your organization’s adherence to NIST 800-171 controls. Before pursuing DoD contracts, contractors must submit their SPRS score, which the government uses to evaluate cybersecurity readiness.
See PHIL KEENEY, page 4
THE ZWEIG LETTER MAY 5, 2025, ISSUE 1584
Made with FlippingBook flipbook maker