Compliance 101

Cybersecurity Maturity Model Certification (CMMC) has its roots in the NIST 800-171 framework. But it evolved into a full-fledged certification when mandatory third-party assessments were introduced into the mix. 

CMMC was designed for the Department of Defense after they came to the realization that asking contractors to audit their own cybersecurity preparedness wasn’t getting the job done. 

“I tell people the reason CMMC exists is because China’s next-gen fighter plane looks exactly like ours,” said Nichelson. “The government realized self-attesting just doesn’t work. So, now you need an independent audit. That’s CMMC in a nutshell.” 

First proposed in 2020, the rules have evolved considerably since their final approval in October 2025.  

"For the longest time, people didn’t believe this was really going to happen," Nichelson said in a previous interview. "There were delays, revisions and even talk that the whole thing might get scrapped. But it’s all happening. In fact, contractors are now getting direct letters from the DoD telling them they either need to be CMMC compliant—or they’re out."  

This flurry of activity has led to an influx of new compliance work for CMMC registered practitioners like Nichelson and fellow Inversion6 CISO Craig Burland.  

"Anyone you use to help you prepare has to be totally independent from the third-party auditors who make the final decision," said Nichelson. “That’s creating a lot of demand for folks like Craig and myself right now. But it’s really the auditing timeline that’s going to be the issue.”  

“These auditors are going to start getting bottlenecked and it’s going to get tight for folks who wait too long,” he added. “That’s why I’m telling everyone I know who needs CMMC certification to get started right now. I don’t want to see them waiting in the audit line losing contracts next year.” 

While we talk often about compliance from a U.S. perspective, global businesses also need to account for overseas requirements.  

In the UK, Cyber Essentials is a government-backed certification focused on basic cyber hygiene—think firewalls, patching and malware protection. Cyber Essentials is often seen as a de-facto prerequisite for doing business with UK public-sector entities. In fact, the UK government is so confident that Cyber Essential certification will protect businesses, it offers cyber liability insurance to those who achieve it.  

Then there’s NIS2, the European Union’s updated directive aimed at critical infrastructure and digital service providers. NIS2 compliance sets requirements for risk management, incident reporting, compliance enforcement and supply chain security, to name a few.   

For those providing essential or digital services in the EU, NIS2 compliance is mandatory to maintain access to European markets, making it worthy of attention for any business with global growth plans.