On January 30, 2020, the US Department of Defense (DoD) released
version 1.0 of the Cybersecurity Maturity Model Certification
(CMMC) framework, which is available here, with
appendices available here. This highly
anticipated 390-page release supersedes the prior draft versions,
the last of which was released in December 2019. The DoD will begin
requiring contractors to obtain certification under the CMMC later
this year, giving companies in the supply chain little time to
assess their obligations, identify and remediate cybersecurity
weaknesses that might preclude their desired certification, retain
an appropriate certification vendor and obtain the
certification.
This certification process raises a host of legal
considerations. For instance, the identification of cyber
weaknesses requires a candid and thorough assessment that will
result in a list of the areas where the contractor's
cybersecurity is lacking. This list may be critical in mitigating
cyber risks,
