The U.S. Department of Defense (DoD) released version 1.0 of its
Cybersecurity Maturity Model Certification (known as CMMC) on Jan.
31, 2020. The CMMC model draws heavily on the National Institute
for Standards and Technology's (NIST) Special Publication (SP)
No. 800-171, as well as other cyber protection standards. Once
DoD's rollout of the CMMC program is complete, contractors will
need to have third-party certifications in order to be awarded DoD
contracts.
While DoD implements all the elements of CMMC, DoD contractors
will still need to comply with the existing DoD cybersecurity
regulations, which went into effect on Jan. 1, 2017. These
regulations require covered DoD contractors to: 1) comply with the
NIST SP 800-171 cybersecurity standards; 2) report cyber incidents
to DoD within 72 hours of discovery; 3) investigate cyber
incursions while preserving affected media/data for 90 days and, if
applicable, submit malicious software (discovered in connection
with a
