Immaturity of the Cybersecurity Maturity Model: Revisions Omit Higher-Level Updates
Client Alert | 1 min read | 11.13.19
Last week, the Defense Department (DoD) released Revision 0.6 to the Cybersecurity Maturity Model Certification (CMMC). Notably absent were revisions to Levels 4 – 5, which DoD promises in the next public release. While the final version of the CMMC is due in late January, Revision 0.6 updated CMMC Levels 1 – 3 by:
- Condensing the CMMC requirements;
- Modifying the practices and processes; and
- Providing clarifications and examples for CMMC Level 1 requirements.
Revision 0.6 also distilled the core requirements for Levels 1 – 3 into the following categories:
- Level 1 -- Basic cyber hygiene: Implementation of security controls in FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems;
- Level 2 -- Intermediate cyber hygiene: Implementation of select NIST SP 800-171 controls; and
- Level 3 -- Good cyber hygiene: Full implementation of NIST SP 800-171 controls.
Industry will benefit from reviewing this latest draft and preparing for DoD’s pending implementation of the CMMC.
Contacts
Partner, Crowell Global Advisors Senior Director
- Washington, D.C.
- D | +1.202.624.2698
- Washington, D.C. (CGA)
- D | +1 202.624.2500
Insights
Client Alert | 2 min read | 09.18.25
On September 9, 2025, the U.S. Department of Health and Human Services (HHS) and the Food and Drug Administration (HHS) issued a news release announcing an “aggressive[]” “crackdown” on direct-to-consumer pharmaceutical advertising. This release came on the heels of a Presidential Memorandum President Trump issued the same day directing HHS to “ensure transparency and accuracy in direct-to-consumer prescription drug advertisements,” and the FDA to “take action to enforce legal requirements that advertisements for prescription drugs be truthful and not misleading.”
Client Alert | 3 min read | 09.17.25
Client Alert | 4 min read | 09.17.25
Client Alert | 5 min read | 09.16.25
Bucking the Odds: Why Technology Companies Should Embrace Software Patents Today