Essential Eight ML2 vs CMMC 2.0 Level 2

CMMC requires a documented incident response capability with defined procedures for detecting, reporting, and recovering from incidents. Critically, it requires specific reporting timelines to the US DoD — contractors must report incidents involving CUI within 72 hours. Most Australian companies have informal incident response processes; CMMC requires these to be formalised, documented, tested, and rehearsed.

The System Security Plan (SSP) is the cornerstone of CMMC compliance. It is a comprehensive document that describes the system boundary, all hardware and software in scope, how each of the 110 CMMC practices is implemented, and who is responsible for each control. The Plan of Action and Milestones (POA&M) documents every control that is not yet fully implemented, with remediation timelines. For most organisations, creating these documents from scratch is the single largest effort in a CMMC readiness programme.

CMMC requires periodic risk assessments that identify threats and vulnerabilities to CUI, assess the likelihood and impact of exploitation, and document risk response decisions. This is distinct from vulnerability scanning (which E8 addresses through patching requirements) — it requires a formal risk management process with documented outputs. Many Australian companies have never conducted a formal risk assessment against a structured framework.

CMMC requires documented security awareness training for all personnel with access to CUI, and role-based security training for personnel with security responsibilities. Training must be conducted at hire and periodically thereafter, with records maintained. The content must cover the specific threats relevant to the organisation's CUI handling activities. This is a new ongoing operational requirement with no Essential Eight equivalent.

CMMC Level 2 requires organisations to manage cybersecurity risks in their supply chains. This means assessing the security practices of suppliers and subcontractors who will have access to CUI, including CMMC requirements in supplier contracts, and monitoring supplier compliance over time. For Australian companies with complex supply chains, this requirement cascades security obligations down to subcontractors — who may themselves need to achieve CMMC compliance.

CMMC requires controls over all physical and digital media containing CUI: restricting access to authorised users, sanitising media before disposal or reuse, controlling the transport of media outside secure facilities, and maintaining an inventory of media. For most Australian companies, this requires establishing new procedures for handling USB drives, hard drives, printed documents, and other media containing defence information.

CMMC requires documented physical access controls to facilities and systems that process CUI. This includes controlling physical access to systems, maintaining visitor logs, managing physical access credentials, and monitoring physical access. While DISP addresses physical security through the Defence Security Principles Framework (DSPF), the CMMC physical protection requirements are specifically tied to CUI handling and require separate documentation.

CMMC requires screening individuals prior to authorising access to CUI, establishing termination procedures to ensure access is revoked when personnel leave, and managing access during personnel transfers. Again, while DISP addresses personnel security through the DSPF, the CMMC requirements are specifically tied to CUI access and require documented procedures that are distinct from DISP personnel security requirements.

CMMC requires controls over the maintenance of systems that process CUI, including controlling maintenance tools, requiring multi-factor authentication for remote maintenance, and maintaining records of maintenance activities. This is often overlooked in initial CMMC gap analyses but represents a real compliance gap for organisations that allow third-party IT support providers to access systems containing CUI.

CMMC requires network segmentation to isolate CUI from other systems, monitoring of communications at external boundaries, and encryption of CUI in transit. While E8 addresses some communications security through application hardening, CMMC's SC domain requires a more comprehensive network architecture review and may require significant infrastructure changes for organisations that have not previously segmented their networks around CUI handling.