CMMC, NIST and CIS Controls explained for Australian businesses

Why this matters in Australia

Australian businesses are increasingly being asked about US cyber security frameworks. Sometimes that comes from a US-based parent company, sometimes from a multinational customer, and sometimes from a US Defence prime contractor flowing down DFARS 252.204-7012 and a CMMC clause. The four frameworks that come up in almost every conversation are CMMC, NIST Cybersecurity Framework 2.0, NIST SP 800-171 and the CIS Critical Security Controls.

None of these frameworks replace the ASD Information Security Manual, the Essential Eight, the Privacy Act 1988 or the Security of Critical Infrastructure Act 2018. They sit alongside them. The good news is that they overlap heavily. With the right approach you can produce one set of evidence and reuse it across multiple framework conversations.

CMMC: the US Defence supply chain assurance program

The Cybersecurity Maturity Model Certification (CMMC) program is run by the US Department of Defense (DoD). Its purpose is to assure the protection of Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) shared with contractors and subcontractors across the US Defense Industrial Base (DIB). It enforces the security requirements of 32 CFR Part 2002, DFARS 252.204-7012 and DoDI 5200.48, and operationalises NIST SP 800-171.

Phase I began on 10 November 2025. On 13 July 2026, the US programme announced that Phase II, previously scheduled for 10 November 2026, was suspended for review. Phase I self-assessment requirements remain in force. Do not rely on the earlier third-party certification timetable when budgeting or answering a tender. Check the official CMMC status notice and the instructions attached to your contract.

On 13 July 2026 the US Department of War announced the immediate suspension of the CMMC Phase II requirements, halting the transition to third-party certification for defence contractors handling Controlled Unclassified Information, so the previously scheduled 10 November 2026 expansion is no longer an active deadline and Phase I self-assessment duties remain in force. US Department of War, 13 July 2026.

In September 2026 a new class deviation moved the CMMC Phase II pause from policy into an enforceable binding regulation, so the suspension is now locked into the acquisition framework rather than a temporary directive a future administration could reverse, which means contractors should plan around Phase I self-assessments remaining the operative baseline for the foreseeable term. Washington Technology, September 2026.

The three CMMC levels

Scope follows the information, not your company name. Identify where FCI or CUI is received, stored, processed and sent. Include email, engineering files, staff devices, backups, supplier support and remote administration where they touch that information. A controlled environment can reduce exposure, but a boundary diagram must reflect actual data flows rather than a preferred audit boundary.

Keep a system security plan that explains how each requirement is met, backed by configuration records, interviews and tests. A Plan of Action and Milestones is a managed remediation record, not permission to leave any control unfinished. Current programme guidance permits limited Level 2 gaps with closeout conditions and requires continuing affirmation. Confirm eligibility and current rules before using that route.

NIST Cybersecurity Framework 2.0

The NIST Cybersecurity Framework (CSF) is a voluntary framework published by the US National Institute of Standards and Technology. Version 2.0, released in 2024, is widely used internationally as a common language for describing cyber security posture. It is not a certification.

CSF 2.0 organises cyber security activity into six functions. The biggest change from version 1.1 is the new Govern function, which sits at the centre and explicitly covers strategy, policy, roles, supply chain risk and oversight. Australian readers will notice that the structure is essentially identical to the ASD ISM.

Turn the six functions into decisions using NIST's Current and Target Profiles. A Current Profile records the outcomes you achieve now; a Target Profile describes the outcomes needed for your business, threats and obligations. Comparing them produces a gap list that can be assigned to owners, budgets and review dates.

NIST CSF 2.0 is an outcome-based risk management framework rather than a certification, so a Current Profile records the outcomes you achieve now and a Target Profile describes the outcomes needed for your business, threats and obligations, and comparing the two produces a gap list that can be assigned to owners, budgets and review dates without ever claiming a NIST CSF certificate. NIST CSF Profiles.

For example, a business may already have endpoint protection but lack a tested response process. Record the protection outcome separately from the response gap instead of reporting a single reassuring score. Board reporting should explain the business impact, the next decision and the evidence behind each status. CSF gives that reporting structure; it does not prescribe a particular vendor or certify the result.

NIST SP 800-171: protecting Controlled Unclassified Information

NIST SP 800-171 provides requirements for protecting Controlled Unclassified Information in non-federal systems, including components that protect those systems. NIST published Revision 3 in May 2024 with 17 control families and organisation-defined parameters. It is the current NIST publication, but it is not automatically the revision required by every US contract.

Current CMMC Level 2 guidance still uses the 110 requirements from Revision 2. Before assessing, record the contract clause, required revision, assessment method and in-scope environment. If a customer separately asks for Revision 3, document that as a different requirement. Do not substitute a newer publication for an older contractual baseline without written confirmation.

NIST published SP 800-171 Revision 3 in May 2024 with 17 control families and organisation-defined parameters, but publication of a newer standard does not automatically replace the version incorporated into a contract or assessment programme, so current CMMC Level 2 still uses the 110 requirements from Revision 2 and a customer that separately requires Revision 3 must document that as a distinct obligation. NIST SP 800-171 Revision 3.

CIS Critical Security Controls v8.1

The CIS Controls are a prioritised set of safeguards published by the Center for Internet Security, a US non-profit. Version 8.1 (the current version) contains 18 Controls and 153 individual Safeguards, grouped into three Implementation Groups (IGs) so organisations can scale based on size, risk and capability.

Start with the safeguards that match your risk and assign each an owner. Asset inventories need a process for new and retired devices. Access reviews need a record of decisions. Backup needs evidence of a restore. Installing software covers only part of the work: configuration, monitoring and repeatable operating procedures establish whether the safeguard is actually effective.

CIS Controls and CIS Benchmarks do different jobs. Controls describe the security activities an organisation should perform; Benchmarks provide product-specific configuration recommendations. A benchmark scan can support secure configuration evidence, but it cannot prove incident planning, staff training or supplier oversight. CIS recommends starting with IG1 and adding safeguards according to complexity, data sensitivity and risk.

CIS Controls v8.1 contains 18 controls and 153 safeguards across three Implementation Groups, with IG1 holding 56 foundational safeguards suited to small businesses with limited IT and cyber expertise, IG2 adding 74 safeguards for organisations with regulated data and a dedicated IT function, and IG3 comprising all 153 safeguards for organisations facing targeted attacks, so selection should follow complexity, data sensitivity and risk rather than headcount alone. CIS Implementation Groups.

Side by side comparison

Four frameworks, four different audiences. This is how we usually summarise them on the first call with an Australian client.

Separate the operating model, technical requirements and assurance method in your proposal. CSF can explain the risk programme to a board, CIS can organise day-to-day safeguards, and a contract can still require a specific NIST SP 800-171 assessment. Choosing one as the internal reporting structure does not cancel the others where they are explicitly required.

Compare scope before comparing scores. An assessment of a small project environment does not establish the security of every company system. Likewise, a well-configured cloud service does not prove that staff devices, external administrators or file exports meet the same requirements. State what was assessed, which revision was used and what remains outside the claim.

How they map to Australian frameworks

The most important practical point: you do not need to run separate cyber programs for each framework. The control families overlap heavily. We typically build evidence once against ASD Essential Eight and the ISM, then map it across to whichever international framework a customer or insurer is asking about.

A practical evidence record links the requirement to a policy, a live configuration and a test result. For access control, that might include the approved role design, current account and group membership, an access review and a leaver test. Reuse those records where appropriate, but document why they meet each mapped requirement rather than simply copying the same status across every framework.

Identify shared supplier controls separately from controls you operate yourself. The provider's assurance needs to cover the service and period in question, while your evidence covers permissions, administration and information handling in your environment. If a mapping is partial, state the gap and treatment instead of reporting full compliance on the basis of a similar control name.

Which framework do you actually need?

A short decision guide based on the conversations we have most weeks.

Ask the customer for the exact clause, version, assessment boundary, evidence format and deadline. Then distinguish a legal or contractual requirement from a preferred reference framework. That stops a general request for a NIST-aligned security programme turning into an unnecessary CMMC certification project.

Use Real Bytes as your MSP and MSSP

Real Bytes operates as a combined Managed Service Provider (MSP) and Managed Security Service Provider (MSSP), based in Australia, with engineers and analysts you deal with by name. We help Australian businesses that are being asked about US frameworks turn the request into a single, evidence-led program of work that satisfies multiple audiences at once.

How we cover NIST, CIS and CMMC alongside Australian frameworks

A practical seven-step action plan

If a customer or prime contractor has just sent you a security questionnaire referencing CMMC, NIST or CIS, this is the order we usually recommend.

Budget for the whole operating cycle: gap analysis, technical remediation, policy and evidence work, the required assessment, and ongoing review. Buying a tool or completing an initial questionnaire is not the finish line. Controls need owners during staff changes, supplier changes and incidents, and current CMMC affirmation requires confidence that implementation continues after the assessment date.

Before signing a readiness proposal, check which baseline it uses and what the provider will deliver. A useful scope identifies the contract revision, system boundary, evidence register, remediation responsibilities and exclusions. Keep independent assessment separate from implementation support, and do not accept a promise that a generic cloud licence or a framework mapping guarantees contract eligibility.

Frequently asked questions

Sources and further reading

All references in this guide are drawn from publicly available US and Australian government and standards sources.

Related reading