CMMC – Where Does It Stand In 2023?

For companies doing business with the Department of Defense (DoD), the Cybersecurity Maturity Model Certification (CMMC) has been a source of confusion for nearly five years. Originally, Nov. 30, 2020, was the deadline for DoD to implement a standard methodology for assessing DoD contractor compliance with security requirements in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171. Concurrently, the DoD would roll out CMMC as a certification process designed to measure a company's maturity and institutionalization of cybersecurity practices and processes. This certification, in turn, would be required for the performance of DoD contracts.

Implementation suffered a delay in 2021 when the DoD announced it was suspending the current iteration of CMMC in order to streamline the size and scope of required administrative, technical, and physical controls for businesses contracting with the DoD. In its place, the DoD announced