--- title: Are You Ready for Cybersecurity Maturity Model Certification? description: After several fits and starts over the past five years, the Department of Defense (DoD) finally issued its final ruling on October 15 for CMMC 2.0 compliance. This final rule coincides with October which happens to be Cyber Security Awareness Month. image: https://sql.sympaq.com/hubfs/Digital%20image%20of%20womans%20eye.%20Security%20concept.jpeg --- [Contact: 800-437-8151](tel:18004378151) [Help Desk](https://aldebaron.assist.com/portal) [![DCAA Compliant Accounting System | SYMPAQ](https://sql.sympaq.com/hubfs/crop-trans-logo.png "Government Contract Cost Accounting")Project Cost Accounting Software for Government Contractors](https://www.sympaq.com/) - [PRODUCTS](https://www.sympaq.com/) - [SYMPAQ Accounting](https://www.sympaq.com/sympaq-sql/) - [SYMPAQ Time & Expense](https://www.sympaq.com/sympaq-etx/) - [SYMPAQ DEMOS](https://www.sympaq.com/demos/) - [PRICING](https://www.sympaq.com/sympaq-pricing/) - [SERVICES](https://www.sympaq.com/services/) - [AUDITS](https://www.sympaq.com/dcaa-audits/) - [DCAA Audits](https://www.sympaq.com/dcaa-audits/) - [Single Audits](https://www.sympaq.com/a-133-audits/) - [RESOURCES](https://www.sympaq.com/#) - [Events / Webinars](https://www.sympaq.com/events-schedule/) - [SYMPAQ Demos](https://www.sympaq.com/demos/) - [Useful Links](https://www.sympaq.com/useful-links/) - [BLOG](https://sql.sympaq.com/blog) [![REQUEST DEMO](https://no-cache.hubspot.com/cta/default/2695973/fa292e59-f01d-4acf-b907-53fc989efa07.png)](https://cta-redirect.hubspot.com/cta/redirect/2695973/fa292e59-f01d-4acf-b907-53fc989efa07) [![DCAA Compliant Accounting System | SYMPAQ](https://sql.sympaq.com/hubfs/crop-trans-logo.png "Government Contract Cost Accounting")Project Cost Accounting Software for Government Contractors](https://www.sympaq.com/) - [PRODUCTS](https://www.sympaq.com/) - [SYMPAQ Accounting](https://www.sympaq.com/sympaq-sql/) - [SYMPAQ Time & Expense](https://www.sympaq.com/sympaq-etx/) - [SYMPAQ DEMOS](https://www.sympaq.com/demos/) - [PRICING](https://www.sympaq.com/sympaq-pricing/) - [SERVICES](https://www.sympaq.com/services/) - [AUDITS](https://www.sympaq.com/dcaa-audits/) - [DCAA Audits](https://www.sympaq.com/dcaa-audits/) - [Single Audits](https://www.sympaq.com/a-133-audits/) - [RESOURCES](https://www.sympaq.com/#) - [Events / Webinars](https://www.sympaq.com/events-schedule/) - [SYMPAQ Demos](https://www.sympaq.com/demos/) - [Useful Links](https://www.sympaq.com/useful-links/) - [BLOG](https://sql.sympaq.com/blog) [![REQUEST DEMO](https://no-cache.hubspot.com/cta/default/2695973/fa292e59-f01d-4acf-b907-53fc989efa07.png)](https://cta-redirect.hubspot.com/cta/redirect/2695973/fa292e59-f01d-4acf-b907-53fc989efa07) [![DCAA Compliant Accounting System | SYMPAQ](https://sql.sympaq.com/hubfs/crop-trans-logo.png "Government Contract Cost Accounting")Project Cost Accounting Software for Government Contractors](https://www.sympaq.com/) menu close close - PRODUCTS - [SYMPAQ Accounting](https://www.sympaq.com/sympaq-sql/) - [SYMPAQ Time & Expense](https://www.sympaq.com/sympaq-etx/) - [SYMPAQ DEMOS](https://www.sympaq.com/demos/) - [PRICING](https://www.sympaq.com/sympaq-pricing/) - [SERVICES](https://www.sympaq.com/services/) - RESOURCES - [Events / Webinars](https://www.sympaq.com/events-schedule/) - [Useful Links](https://www.sympaq.com/useful-links/) - [BLOG](https://sql.sympaq.com/blog) ## Blog ### Subscribe to our Blog # Are You Ready for Cybersecurity Maturity Model Certification? [cybersecurity](https://sql.sympaq.com/blog/topic/cybersecurity) 11/01/2024 [G. Chris Brown](https://sql.sympaq.com/blog/author/cbrown) [![Sympaq - Cyber Security Awareness Month](https://sql.sympaq.com/hs-fs/hubfs/Digital%20image%20of%20womans%20eye.%20Security%20concept.jpeg?width=1000&height=600&name=Digital%20image%20of%20womans%20eye.%20Security%20concept.jpeg)](https://sympaq.com) After several fits and starts over the past five years, the Department of Defense (DoD) finally issued its[final ruling](https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program) on October 15 for CMMC 2.0 compliance. This final rule coincides with October which happens to be [Cybersecurity Awareness Month. ](https://sql.sympaq.com/blog/cybersecurity-in-dcaa-accounting-software) Now that it has been finalized and will take effect on December 16, 2024, the rule will mandate cyber security requirements for contractors working with the DoD. For some perspective, in fiscal year (FY) 2024, the DoD was allocated $824.5 billion in discretionary budget authority, of which approximately 70% was obligated through contracts and grants for products and services. The DoD outspends all other civilian agencies combined on contracts and grants. Therefore, if you think it is too much of a hassle and too expensive to comply, then you will miss out on a big slice of the government contracting pie. And if you are already doing business with the DoD, then the time has arrived to implement the controls promulgated by CMMC [Level 1 & Level 2](https://dodcio.defense.gov/cmmc/About/). Defense contracts that are deemed to be low-risk awards may allow for Level 1 self-attestation with its [17 controls](https://ndisac.org/dibscc/cyberassist/cybersecurity-maturity-model-certification/level-1/) for protecting controlled unclassified information ([CUI](https://csrc.nist.gov/pubs/sp/800/171/r3/final)) and you will not likely have the need to engage a third party for certification as with Level 2 and its [110 controls](https://ndisac.org/dibscc/cyberassist/cybersecurity-maturity-model-certification/level-2/) will require.[Level 3](https://ndisac.org/dibscc/cyberassist/cybersecurity-maturity-model-certification/level-3/), is primarily intended for the large contractors or for the contract awards that carry the most risk and will involve government-led audits performed by the [DCMA](https://www.dcma.mil/DIBCAC/). While it may seem overwhelming and the costs to comply with Level 2 certification may be steep, think of it as a cost of doing business. One thing is for certain, the costs incurred for compliance meet the criteria for allowability. In other words, these costs are necessary, reasonable, and allocable. So as is the case with accounting firm audits and for most information technology costs, you can recover the costs in your [indirect rates](https://sql.sympaq.com/blog/what-is-an-indirect-rate). Best of all, you don't have to go it alone and there are several criteria that your accounting [software vendor](https://sql.sympaq.com/blog/cmmc-compliance-what-can-a-software-vendor-do-for-you) can help to achieve. These include, but are not limited to: ## Level 1 Practices/Controls Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems). - Disable the user accounts of former employees when they leave the company.  Update malicious code protection mechanisms when new releases are available Perform periodic scans of the information system. ## Level 2 Practices/Controls ### Access Controls - Limit Unsuccessful Logon Attempts - Terminate (Automatically) a User Session after a Defined Condition - Remote Access Confidentiality: Employ cryptographic mechanisms for remote access sessions. ### Audit Accountability Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions. - Authoritative Time Source: Provide a system capability to generate time stamps for audit records. - Protect audit information and audit logging tools from unauthorized modification and deletion. ### Identification and Authentication Multifactor Authentication: Use multifactor authentication for local and network access to privileged accounts ### Risk Assessment Scan for vulnerabilities in organizational systems and applications periodically  Vulnerability Remediation: Remediate vulnerabilities in accordance with risk assessments. So there you have it, at least some of the 127 criteria that you need to meet Level 1 and Level 2 compliance are satisfied (or should be satisfied by) your software vendor who securely hosts your mission critical software applications. In the fourteen years that we have been hosting [SYMPAQ](https://sympaq.com) software, we have never had a breach or a cyber security incident that would compromise our subscribers CUI, and we intend to keep it that way!  ### Recent Blogs February, 07 2025 ## [Strong Headwinds Ahead for Federal Government Contractors in 2025](https://sql.sympaq.com/blog/5-challenges-federal-government-contracting-0) [Government Contractor](https://sql.sympaq.com/blog/topic/government-contractor) [Accounting Software](https://sql.sympaq.com/blog/topic/accounting-software) [SYMPAQ Benefits](https://sql.sympaq.com/blog/topic/sympaq-benefits) [Business Tips](https://sql.sympaq.com/blog/topic/business-tips) [Headwinds](https://sql.sympaq.com/blog/topic/headwinds) Poised to bid on contracts with the Federal Government? you will likely encounter challenges with procurement regulations and bureaucracy.[ Read the Blog](https://sql.sympaq.com/blog/5-challenges-federal-government-contracting-0) 0 Comments [Click here to read/write comments](https://sql.sympaq.com/blog/5-challenges-federal-government-contracting-0#comments-listing) January, 10 2025 ## [End of Year Tax Form Filing Has Never Been Easier!](https://sql.sympaq.com/blog/end-of-year-tax-form-filing-has-never-been-easier) [tax](https://sql.sympaq.com/blog/topic/tax) [2024](https://sql.sympaq.com/blog/topic/2024) As we learned last year when the paper filing threshold dropped from 250 for each tax form to 10 tax forms in aggregate (i.e., 1099-NEC plus 1099-Misc plus W2), one should no longer be contemplating t\[...\][ Read the Blog](https://sql.sympaq.com/blog/end-of-year-tax-form-filing-has-never-been-easier) 0 Comments [Click here to read/write comments](https://sql.sympaq.com/blog/end-of-year-tax-form-filing-has-never-been-easier#comments-listing) December, 04 2024 ## [Another Year, Another End-of-Year Update](https://sql.sympaq.com/blog/2024-year-end-of-year-update) [2024](https://sql.sympaq.com/blog/topic/2024) One thing we've learned over the years as a software publisher is that unless you are planning on sunsetting a legacy application, you are never "done" with development.[ Read the Blog](https://sql.sympaq.com/blog/2024-year-end-of-year-update) 0 Comments [Click here to read/write comments](https://sql.sympaq.com/blog/2024-year-end-of-year-update#comments-listing) ![](https://sql.sympaq.com/hs-fs/hubfs/crop-trans-logo.png?width=200&name=crop-trans-logo.png) We are focused on delivering reliable cost accounting, timekeeping and expense reporting solutions to labor-intensive federal government contractors and not-for-profit organizations in search of fully compliant, standards-based, project accounting software. ### Get In Touch [contact@sympaq.com](mailto:contact@sympaq.com) Local phone:[(301) 670-0858](tel:3016700858) Fax: (301) 840-1591 15839 Crabbs Branch Way, Rockville, MD 20855. [Privacy Policy](https://www.sympaq.com/privacy-policy/) [Cookie Policy](https://www.sympaq.com/cookie-policy/) [Terms & Conditions](https://www.sympaq.com/terms-and-conditions/) ### Subscribe to Our Blog Get the latest business resources on the market delivered to your inbox. Copyright © 2023 Aldebaron, Inc. All rights reserved. Website by [IMGdigitalAgency.com](https://www.imgdigitalagency.com/) [![](https://sql.sympaq.com/hubfs/blue-seal-bbb.png)](https://www.bbb.org/us/md/rockville/profile/computer-software-developers/sympaq-0241-236013238#sealclick) ![](https://px.ads.linkedin.com/collect/?pid=1997524&fmt=gif) × ### Speak to a Specialist Find out how SYMPAQ makes DCAA compliance a breeze. Fill out the form below to speak with a SYMPAQ team member. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "G. Chris Brown", "url" : "https://sql.sympaq.com/blog/author/cbrown" }, "dateModified" : "2024-11-01T18:22:24.591Z", "datePublished" : "2024-11-01T18:22:24.000Z", "headline" : "Are You Ready for Cybersecurity Maturity Model Certification?", "image" : [ "https://sql.sympaq.com/hubfs/Digital%20image%20of%20womans%20eye.%20Security%20concept.jpeg" ], "mainEntityOfPage" : { "@id" : "https://sql.sympaq.com/blog/cybersecurity-awareness-month-maturity-model-certification", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://sql.sympaq.com/hubfs/logo-2.png" }, "name" : "Aldebaron, Inc." } } ``` ```json { "@context" : "http://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "G. Chris Brown" }, "dateModified" : "November 1, 2024, 6:22:24 PM", "datePublished" : "2024-11-01 18:22:24", "description" : "After several fits and starts over the past five years, the Department of Defense (DoD) finally issued its final ruling on October 15 for CMMC 2.0 compliance. This final rule coincides with October which happens to be Cyber Security Awareness Month.", "headline" : "Are You Ready for Cybersecurity Maturity Model Certification?", "image" : { "@type" : "ImageObject", "url" : "https://sql.sympaq.com/hubfs/Digital%20image%20of%20womans%20eye.%20Security%20concept.jpeg" }, "mainEntityOfPage" : { "@id" : "https://sql.sympaq.com/blog/cybersecurity-awareness-month-maturity-model-certification", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "http://sql.sympaq.com/hubfs/sympaqlogo.png" }, "name" : "SYMPAQ" } } ```