On January 31, 2020, the Department of Defense (DoD) issued its
long-awaited final Cybersecurity Maturity Model Certification
(CMMC),1 which DoD hopes will combat the
immense toll cyber threats have taken on the Defense Industrial
Base (DIB), the US economy, and national security.2
The final CMMC provides a comprehensive framework of cybersecurity
controls and policies that defense contractors must implement
depending on the nature of the information that their information
systems will process, store or transmit. In thisAdvisory, we
provide background about the CMMC, describe its structure and
principal features, and discuss implementation.
The CMMC and associated DoD guidance suggest that DoD intends to
implement the CMMC through procurement-specific solicitation
provisions rather than by issuing new Defense Federal Acquisition
Regulation Supplement (DFARS) clauses or revising existing DFARS
clauses, such as DFARS 252.204-7012, Safeguarding Covered
Defense
