No More "Wait & See" for CMMC: DoD Releases Final Cybersecurity Maturity Model Certification
Client Alert | 1 min read | 02.03.20
The Department of Defense (DoD) has released Version 1.0 of the Cybersecurity Maturity Model Certification (CMMC), Appendices A-F, and an Overview Briefing. While Version 1.0 largely mirrors the draft Version 0.7, the final version includes notable revisions, such as:
- Process and Practice Descriptions in Appendix B, which include discussions and clarifications for every “practice” within each CMMC Level, including the long-awaited examples for Levels 4 and 5; and
- Source Mapping in Appendix E, which maps each “practice” across all five Levels –171 in total – to other pre-existing cybersecurity frameworks.
Much, however, remains to be done. In anticipation of the DoD adopting “go/no-go” CMMC certification requirements later this year, a privately-run Accreditation Body is expected to begin training third-party assessors (3PAOs) this spring in conducting those certifications for contractors. Simultaneously, the DoD is expected to issue a proposed rule incorporating the CMMC into DFARS 252.204-7012, to be finalized this fall.
Contacts
Partner and Crowell Global Advisors Senior Director
- Washington, D.C.
- D | +1.202.624.2698
- Washington, D.C. (CGA)
- D | +1 202.624.2500
Insights
Client Alert | 4 min read | 08.27.26
FCC Clarifies Covered List for Power Inverters and Advanced Robotic Devices
On July 28, 2026, the Federal Communications Commission (FCC) updated its Covered List — established through the Secure and Trusted Communications Networks Act — to include foreign-produced connected power inverters and advanced robotic devices, following an executive branch national security determination that they “pose unacceptable risks to the national security of the United States or the safety and security of United States persons.” Equipment on the Covered List is ineligible for FCC equipment authorization, effectively prohibiting the import, sale, or marketing of those products without an exception or approval.
Client Alert | 4 min read | 08.27.26
Power Play: New Executive Order Targets Electrical Grid Equipment
Client Alert | 5 min read | 08.26.26
D.C. Circuit Upholds Designation of PFOA and PFOS as CERCLA Hazardous Substances
Client Alert | 5 min read | 08.26.26
