No More "Wait & See" for CMMC: DoD Releases Final Cybersecurity Maturity Model Certification
Client Alert | 1 min read | 02.03.20
The Department of Defense (DoD) has released Version 1.0 of the Cybersecurity Maturity Model Certification (CMMC), Appendices A-F, and an Overview Briefing. While Version 1.0 largely mirrors the draft Version 0.7, the final version includes notable revisions, such as:
- Process and Practice Descriptions in Appendix B, which include discussions and clarifications for every “practice” within each CMMC Level, including the long-awaited examples for Levels 4 and 5; and
- Source Mapping in Appendix E, which maps each “practice” across all five Levels –171 in total – to other pre-existing cybersecurity frameworks.
Much, however, remains to be done. In anticipation of the DoD adopting “go/no-go” CMMC certification requirements later this year, a privately-run Accreditation Body is expected to begin training third-party assessors (3PAOs) this spring in conducting those certifications for contractors. Simultaneously, the DoD is expected to issue a proposed rule incorporating the CMMC into DFARS 252.204-7012, to be finalized this fall.
Contacts
Partner and Crowell Global Advisors Senior Director
- Washington, D.C.
- D | +1.202.624.2698
- Washington, D.C. (CGA)
- D | +1 202.624.2500
Insights
Client Alert | 3 min read | 05.28.26
Earlier this month, the U.S. Environmental Protection Agency (EPA) withdrew a February 2024 Biden administration proposed rule, “Definition of Hazardous Waste Applicable to Corrective Action for Releases From Solid Waste Management Units,” under the Resource Conservation and Recovery Act (RCRA).[1] The withdrawn proposal would have revised RCRA corrective action regulations to expressly apply the broader statutory definition of “hazardous waste,” rather than only the narrower regulatory definition. Now, EPA is maintaining the status quo for corrective action under RCRA. However, EPA’s withdrawal of its proposed RCRA hazardous waste definition makes no mention of its corresponding proposal from 2024 to list nine per- and polyfluoroalkyl substances (PFAS) as RCRA hazardous constituents.[2] This disjointed withdrawal, while providing some certainty for regulated entities, does not resolve how EPA plans to address PFAS under the RCRA program.
Client Alert | 8 min read | 05.28.26
Texas Targets Big Tech With Wave of Suits and Investigations, Part of Nationwide Trend
Client Alert | 7 min read | 05.27.26
Colorado Hits Reset on AI Regulation: SB 26-189 Repeals and Reenacts the Colorado AI Act
Client Alert | 3 min read | 05.27.26
Don’t Get Left in the Doghouse: The Federal Circuit’s Global K9 Case and the Duty to Intervene
