1. Home
  2. |Insights
  3. |No More "Wait & See" for CMMC: DoD Releases Final Cybersecurity Maturity Model Certification

No More "Wait & See" for CMMC: DoD Releases Final Cybersecurity Maturity Model Certification

Client Alert | 1 min read | 02.03.20

The Department of Defense (DoD) has released Version 1.0 of the Cybersecurity Maturity Model Certification (CMMC), Appendices A-F, and an Overview Briefing. While Version 1.0 largely mirrors the draft Version 0.7, the final version includes notable revisions, such as:

  • Process and Practice Descriptions in Appendix B, which include discussions and clarifications for every “practice” within each CMMC Level, including the long-awaited examples for Levels 4 and 5; and
  • Source Mapping in Appendix E, which maps each “practice” across all five Levels –171 in total – to other pre-existing cybersecurity frameworks.

Much, however, remains to be done. In anticipation of the DoD adopting “go/no-go” CMMC certification requirements later this year, a privately-run Accreditation Body is expected to begin training third-party assessors (3PAOs) this spring in conducting those certifications for contractors. Simultaneously, the DoD is expected to issue a proposed rule incorporating the CMMC into DFARS 252.204-7012, to be finalized this fall. 


Contacts

Insights

Client Alert | 3 min read | 07.10.26

Federal Circuit Clarifies Application of Blue & Gold: Proposal Submission Deadline, Not Award, is the Operative Time for Filing

In Utech, Inc. v. United States, No. 24-1586 (Fed. Cir. June 24, 2026), the U.S. Court of Appeals for the Federal Circuit clarified that in most cases, a pre-award protest must be filed before the proposal submission deadline to avoid the Blue & Gold waiver rule.  This decision, while nonprecedential, is in line with U.S. Government Accountability Office (GAO) precedent, which has long held that pre-award protests must be filed before the proposal submission deadline....

View All Insights