Expanding CMMC Beyond Defense Contractors

The Cybersecurity Maturity Model Certification program is still very early in its implementation, and may not have been able to prevent incidents such as the recent SolarWinds attacks. But some observers argue that the program could be expanded to contractors beyond the Defense Department, and that doing so would still be an improvement from the status quo. Eric Crusius of Holland and Knight’s government contracts practice describes use of the CMMC as “a check-the-box scenario” but says that “with present-day technology it’s difficult to get beyond that.” David Simpson, former chief of the FCC’s Public Safety and Homeland Security Bureau, argues that it would need to be made easier for small tech companies to implement.

Source:

• Federal Computer Week: Is It Time to Test the Limits – and Potential – of Expanding CMMC?