Cybersecurity Maturity Model Matures: DoD Adds New Requirements to Draft Cybersecurity Certification
Client Alert | 1 min read | 09.10.19
The Defense Department has released Revision 0.4 of its Cybersecurity Maturity Model Certification (CMMC) that, starting next year, independent auditors are to use to certify contractor compliance with DoD cybersecurity requirements. Revision 0.4 more than doubles the number of cybersecurity controls across the CMMC’s five maturity “Levels.” But the DoD emphasizes that it will further down-select these controls and that mature contractor processes may counteract gaps in the final controls’ implementation. In addition to NIST SP 800-171 (the default standard under DFARS 252.204-7012), Revision 0.4 now incorporates requirements from the NIST Cybersecurity Framework, ISO 27001, and CIS Critical Security Controls, as well as from “additional DIB inputs.” Notably missing is NIST SP 800-171B, which remains under review.
The DoD is requesting feedback on Revision 0.4 through September 25, 2019, and plans on releasing Revision 0.6 for comment in November 2019. The final CMMC is expected in January 2020.
Contacts
Partner and Crowell Global Advisors Senior Director
- Washington, D.C.
- D | +1.202.624.2698
- Washington, D.C. (CGA)
- D | +1 202.624.2500
Insights
Client Alert | 7 min read | 10.29.26
On 8 October 2026, Crowell & Moring, King's College London, and the Competition Law Center at George Washington University co-hosted the 7th EU Competition Law Conference at De Warande in Brussels. Mark Meador, Commissioner at the US Federal Trade Commission (FTC), delivered the opening keynote address, followed by four panels bringing together practitioners, regulators, academics, and in-house counsel to discuss the latest developments in EU, UK, and US competition law enforcement. Among other things, the panels examined algorithmic pricing; the European Commission's (Commission) new guidelines on exclusionary abuses under Article 102 TFEU (Article 102 Guidelines); the impact of dominant positions in merger reviews; and lessons from the enforcement of the Digital Markets Act (DMA) and the UK’s Digital Markets, Competition and Consumers Act.
Client Alert | 3 min read | 10.29.26
What University Licensors Should Learn From TexasLDPC v. Broadcom
Client Alert | 2 min read | 10.28.26
Debriefing to Dead Briefing: How to Avoid Dismissal by Identifying “Required” Debriefings
Client Alert | 7 min read | 10.27.26
