No More "Wait & See" for CMMC: DoD Releases Final Cybersecurity Maturity Model Certification
Client Alert | 1 min read | 02.03.20
The Department of Defense (DoD) has released Version 1.0 of the Cybersecurity Maturity Model Certification (CMMC), Appendices A-F, and an Overview Briefing. While Version 1.0 largely mirrors the draft Version 0.7, the final version includes notable revisions, such as:
- Process and Practice Descriptions in Appendix B, which include discussions and clarifications for every “practice” within each CMMC Level, including the long-awaited examples for Levels 4 and 5; and
- Source Mapping in Appendix E, which maps each “practice” across all five Levels –171 in total – to other pre-existing cybersecurity frameworks.
Much, however, remains to be done. In anticipation of the DoD adopting “go/no-go” CMMC certification requirements later this year, a privately-run Accreditation Body is expected to begin training third-party assessors (3PAOs) this spring in conducting those certifications for contractors. Simultaneously, the DoD is expected to issue a proposed rule incorporating the CMMC into DFARS 252.204-7012, to be finalized this fall.
Contacts
Partner and Crowell Global Advisors Senior Director
- Washington, D.C.
- D | +1.202.624.2698
- Washington, D.C. (CGA)
- D | +1 202.624.2500
Insights
Client Alert | 5 min read | 09.03.26
The U.S. Department of Transportation (DOT) published a final rule amending 14 CFR Part 234 that fundamentally changes how airlines report the causes of flight delays and cancellations. Effective October 19, 2026, the rule implements Section 511(b) of the FAA Reauthorization Act of 2024 by creating a new reporting category, the “Section 511(b) category,” for ten specific events that Congress determined are not attributable to airline control. The rule simultaneously narrows the existing "Air Carrier" reporting category by expressly excluding those same ten events.
Client Alert | 6 min read | 09.03.26
FDA Seeks Input for Regulating GenAI-Powered Medical Devices
Client Alert | less than 1 min read | 09.03.26
SBA Proposal to Overhaul Size Standards Would Transform Federal Government Contracting
Client Alert | 5 min read | 09.02.26
DOJ’s Civil Rights Fraud Initiative Claims Another DEI-Related FCA Settlement
