No More "Wait & See" for CMMC: DoD Releases Final Cybersecurity Maturity Model Certification
Client Alert | 1 min read | 02.03.20
The Department of Defense (DoD) has released Version 1.0 of the Cybersecurity Maturity Model Certification (CMMC), Appendices A-F, and an Overview Briefing. While Version 1.0 largely mirrors the draft Version 0.7, the final version includes notable revisions, such as:
- Process and Practice Descriptions in Appendix B, which include discussions and clarifications for every “practice” within each CMMC Level, including the long-awaited examples for Levels 4 and 5; and
- Source Mapping in Appendix E, which maps each “practice” across all five Levels –171 in total – to other pre-existing cybersecurity frameworks.
Much, however, remains to be done. In anticipation of the DoD adopting “go/no-go” CMMC certification requirements later this year, a privately-run Accreditation Body is expected to begin training third-party assessors (3PAOs) this spring in conducting those certifications for contractors. Simultaneously, the DoD is expected to issue a proposed rule incorporating the CMMC into DFARS 252.204-7012, to be finalized this fall.
Contacts
Partner, Crowell Global Advisors Senior Director
- Washington, D.C.
- D | +1.202.624.2698
- Washington, D.C. (CGA)
- D | +1 202.624.2500
Insights
Client Alert | 3 min read | 11.20.25
Design patents offer protection for the ornamental appearance of a product, focusing on aspects like its shape and surface decoration, as opposed to the functional aspects protected by utility patents. The scope of a design patent is defined by the drawings and any descriptive language within the patent itself. Recent decisions by the Federal Circuit emphasize the need for clarity in the prosecution history of a design patent in order to preserve desired scope to preserve intentional narrowing (and to avoid unintentional sacrifice of desired claim scope).
Client Alert | 3 min read | 11.20.25
Client Alert | 6 min read | 11.19.25
Client Alert | 4 min read | 11.18.25
DOJ Announces Major Enforcement Actions Targeting North Korean Remote IT Worker Schemes
