1. Home
  2. |Insights
  3. |Immaturity of the Cybersecurity Maturity Model: Revisions Omit Higher-Level Updates

Immaturity of the Cybersecurity Maturity Model: Revisions Omit Higher-Level Updates

Client Alert | 1 min read | 11.13.19

Last week, the Defense Department (DoD) released Revision 0.6 to the Cybersecurity Maturity Model Certification (CMMC). Notably absent were revisions to Levels 4 – 5, which DoD promises in the next public release. While the final version of the CMMC is due in late January, Revision 0.6 updated CMMC Levels 1 – 3 by:

  • Condensing the CMMC requirements;
  • Modifying the practices and processes; and
  • Providing clarifications and examples for CMMC Level 1 requirements.

Revision 0.6 also distilled the core requirements for Levels 1 – 3 into the following categories:

  • Level 1 -- Basic cyber hygiene: Implementation of security controls in FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems;
  • Level 2 -- Intermediate cyber hygiene: Implementation of select NIST SP 800-171 controls; and
  • Level 3 -- Good cyber hygiene: Full implementation of NIST SP 800-171 controls.

Industry will benefit from reviewing this latest draft and preparing for DoD’s pending implementation of the CMMC.

Contacts

Insights

Client Alert | 3 min read | 11.13.26

Massachusetts Trade Secret Preliminary Injunctions: Prove the Harm, Tailor the Relief

A strong trade secret claim is not a substitute for proof of irreparable harm. In Daikin Applied Americas Inc. v. Russo, No. SJC-13881 (Mass. Oct. 14, 2026), the Massachusetts Supreme Judicial Court held that likely success on a misappropriation claim does not create a presumption of irreparable harm. The court grounded its ruling in both the Massachusetts Uniform Trade Secrets Act and the traditional equitable principles the statute incorporates. It required a case-specific showing that the requested relief would prevent harm that a final judgment could not adequately remedy. ...

View All Insights