Introduction
The Cybersecurity Maturity Model Certification (CMMC) has been a hot topic in the federal contracting world for years, and the latest updates to the model are no exception. With the goal of improving the cybersecurity posture of the Defense Industrial Base (DIB), the CMMC aims to establish a single, uniform standard for cybersecurity across the industry. However, the model has faced numerous challenges and criticisms since its inception, and the latest updates have done little to quell the controversy.
A Brief History of CMMC
The CMMC was first introduced in 2019 as a response to the rising threat of cyber attacks on the DIB. The model is based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework and is designed to assess an organization’s cybersecurity maturity level, ranging from Level 1 (Basic) to Level 5 (Advanced/Proactive). The initial version of the CMMC was met with skepticism by many in the industry, who felt that the model was overly complex and burdensome.
