The Department of Defense (DoD) has taken another step on the
path toward full implementation of its Cybersecurity Maturity Model
Certification (CMMC) initiative. On September 5, 2019, the Office
of the Assistant Secretary of Defense for Acquisition released version 4 of the CMMC and has requested public
comment.
The CMMC process began early this year and has been an iterative
process. According to DoD, it anticipates continuing to refine and
improve the model over the coming months and releasing a version 6
for further public review in November 2019.
DoD has designed CMMC to add a verification component to
cybersecurity compliance. Currently, DFARS 252.204-7012,
Safeguarding Covered Defense Information and Cyber Incident
Reporting, outlines the requisite security measures that must be
taken to protect controlled unclassified information (CUI)1
generated, accessed, used, or stored on contractors' or
subcontractors' IT systems in connection with the performance
of
