Research on Policy Measures in Response to CMMC Trends in the United States

The U.S. Department of Defense’s new cybersecurity certification framework, CMMC, is a framework developed to strengthen the cybersecurity level of the defense industrial base and protect federal contract information(FCI) and controlled unclassified information(CUI). It plans to gradually apply CMMC to all companies and contractors preparing for contracts. In this paper, based on survey analysis, we propose a 2-track policy approach that balances the need to respond to cyber threats while reducing the CMMC burden on exporting companies. This approach combines two options: Korean-style CMMC and directly adopting the CMMC method. To implement this policy, three implementation measures are proposed: ① Establishing a private-sector-led evaluation ecosystem, ② Linking the CMMC with defense contracts, and ③ Partially exempting certain aspects of the integrated status survey