1. Home
  2. |Insights
  3. |Cybersecurity Maturity Model Matures: DoD Adds New Requirements to Draft Cybersecurity Certification

Cybersecurity Maturity Model Matures: DoD Adds New Requirements to Draft Cybersecurity Certification

Client Alert | 1 min read | 09.10.19

The Defense Department has released Revision 0.4 of its Cybersecurity Maturity Model Certification (CMMC) that, starting next year, independent auditors are to use to certify contractor compliance with DoD cybersecurity requirements.  Revision 0.4 more than doubles the number of cybersecurity controls across the CMMC’s five maturity “Levels.”  But the DoD emphasizes that it will further down-select these controls and that mature contractor processes may counteract gaps in the final controls’ implementation.  In addition to NIST SP 800-171 (the default standard under DFARS 252.204-7012), Revision 0.4 now incorporates requirements from the NIST Cybersecurity Framework, ISO 27001, and CIS Critical Security Controls, as well as from “additional DIB inputs.”  Notably missing is NIST SP 800-171B, which remains under review.

The DoD is requesting feedback on Revision 0.4 through September 25, 2019, and plans on releasing Revision 0.6 for comment in November 2019.   The final CMMC is expected in January 2020. 

Contacts

Insights

Client Alert | 3 min read | 11.12.25

EPA Proposes Important Revisions to its PFAS Reporting Regulations

On November 10, 2025, the U.S. Environmental Protection Agency (EPA) released proposed regulations that, if adopted, would substantially alter the reporting obligations of companies that manufacture or import products containing per- or polyfluoroalkyl substances (PFAS). The proposed regulations would significantly reduce reporting burdens by exempting numerous products that currently trigger reporting requirements under EPA’s PFAS reporting regulations.  The proposed regulations would also delay the current deadline for reporting....

View All Insights