In response to the theft of hundreds of billions of
dollars’ worth of sensitive data due to malicious cyber
activity, DoD has started rolling out a certification program known
as CMMC to certify the cybersecurity maturity of DoD contractors
and their supply chain.
Companies throughout the DoD supply chain will need to be
certified if they are to receive, and potentially continue to
perform, DoD work that requires the possession of sensitive but
unclassified information.
Volume 1.0 of the CMMC Model is anticipated to be released in
January 2020 and to take effect in June 2020.
DoD is in the process of developing the CMMC framework in order
to enhance the protection of sensitive data within the Federal
supply chain. As we previously reported in client alerts of December 2017, May 2018 and October 2018, DoD’s efforts to enhance
these protections began with the implementation of the DFARS clause
252.204-7012 Safeguarding Covered Defense Information and Cyber
Incident
