What is CMMC?
CMMC is a unified cybersecurity standard and certification
program for all U.S. Department of Defense (DoD)
contractors. On January 31, 2020, DoD's Office of the Under
Secretary of Defense for Acquisition & Sustainment
(OUSD(A&S)) released CMMC v1.0. DoD intends to continuously
update the model to adjust to evolving threats.
Who is subject to CMMC?
All U.S. DoD contractors and subcontractors, including
commercial item contractors, are subject to CMMC. Currently the
model is limited to DoD-only, but may be adopted by other U.S.
civilian agencies in the future.
Is compliance with current DoD cybersecurity standards
enough?
No, CMMC is a new standard that builds upon and goes beyond the
current DoD requirements such as National Institute of Standards
and Technology (NIST) Special Publication (SP) 800-171, Protecting
Controlled Unclassified Information in Nonfederal Systems and
Organizations, and DFARS 252.204-7012, Safeguarding Covered
