More CMMC Concerns Highlighted In The New GAO Report

Last week, the US Government Accountability Office (GAO) issued a Report, evaluating the Department of Defense's (DoD) rollout of the Cybersecurity Maturity Model Certification (CMMC) program, and highlighting DoD's failure to systematically assess certain external factors that could impact the program's underlying information security goals. The identified gaps, such as the potential reliance on private sector assessors, could significantly impact DoD contractors, who nevertheless bear responsibility to meet DoD's CMMC compliance obligations.

As highlighted in a prior Alert, the CMMC program is designed to verify that defense contractors implement required cybersecurity controls when handling sensitive government information, including Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).