1. Home
  2. |Insights
  3. |No More "Wait & See" for CMMC: DoD Releases Final Cybersecurity Maturity Model Certification

No More "Wait & See" for CMMC: DoD Releases Final Cybersecurity Maturity Model Certification

Client Alert | 1 min read | 02.03.20

The Department of Defense (DoD) has released Version 1.0 of the Cybersecurity Maturity Model Certification (CMMC), Appendices A-F, and an Overview Briefing. While Version 1.0 largely mirrors the draft Version 0.7, the final version includes notable revisions, such as:

  • Process and Practice Descriptions in Appendix B, which include discussions and clarifications for every “practice” within each CMMC Level, including the long-awaited examples for Levels 4 and 5; and
  • Source Mapping in Appendix E, which maps each “practice” across all five Levels –171 in total – to other pre-existing cybersecurity frameworks.

Much, however, remains to be done. In anticipation of the DoD adopting “go/no-go” CMMC certification requirements later this year, a privately-run Accreditation Body is expected to begin training third-party assessors (3PAOs) this spring in conducting those certifications for contractors. Simultaneously, the DoD is expected to issue a proposed rule incorporating the CMMC into DFARS 252.204-7012, to be finalized this fall. 


Insights

Client Alert | 10 min read | 07.03.25

Focus on Transnational Cartels Continues: FinCEN Targets Three Mexican Financial Institutions with Special Measures, Restricting Their Access to U.S. Financial System

The Orders represent FinCEN’s first actions using new special measures authority under the Fentanyl Sanctions Act and FEND Off Fentanyl Act of 2024 (codified at 21 U.S.C. § 2313a) (the “Fentanyl Act”) and continue the Trump Administration’s broader efforts against transnational cartels and narcotics trafficking....