Saturday, October 4, 2025
An interim rule released this week by the Pentagon raises issues about the transparency around audit results from assessors and who will have access to the information under the Defense Department's landmark cyber certification program, according to supply chain attorneys.
The Defense Department has released the interim final rule for its Cybersecurity Maturity Model Certification program, marking a major shift in how the Pentagon will evaluate cybersecurity for contractors who make up the defense industrial base.
Rep. Jim Langevin (D-RI), a cybersecurity leader in Congress, says he is monitoring the Defense Department's work to "operationalize" the Cybersecurity Maturity Model Certification program, which is facing criticism over the rollout of the accreditation process for assessors.
The Defense Department is working on a guide to help industry and the acquisition community understand how to handle controlled unclassified information, addressing a foundational component of the Pentagon's Cybersecurity Maturity Model Certification program.
Recent developments at the independent authority overseeing accreditation of assessors for the Pentagon's cyber certification program are raising concerns at one of the nation's largest defense associations, which represents a wide variety of contractors who make up the defense industrial base.
The Defense Department expects to have a proposed acquisition rule needed to implement its cyber certification program out for public comment by November, according to Pentagon acquisition Chief Information Security Officer Katie Arrington, with the final regulation probably pushed into 2021.
The Pentagon has issued a second interim rule on how contractors who want to do business with the federal government need to provide details on Huawei and ZTE equipment and services in their systems.
The Defense Department is working on a no-cost contract with the independent authority that oversees the accreditation process for its Cybersecurity Maturity Model Certification program.
A leading professor at the Defense Acquisition University is urging Defense Department commands and acquisition offices to hold off on adding requirements related to the Pentagon's cyber certification program into their contract opportunities.
Members of the Cyberspace Solarium Commission are urging Congress to consider expanding the Pentagon's Defend Forward strategy to review the current state of military cyber capabilities and incorporate new ways to engage with the defense industrial base.
The Defense Department has issued guidance for its procurement units on how to process and review waiver requests for contractors who wish to continue using banned equipment and services from Chinese companies Huawei and ZTE.
Booz Allen Hamilton is working with clients and its own subcontractors to help prepare for the Pentagon's Cybersecurity Maturity Model Certification program through identifying gaps and assisting with remediation.
The independent accreditation body behind the Pentagon's Cybersecurity Maturity Model Certification program has formally opened up applications for a range of certifications, after a month-long soft launch which generated approximately 300 organization and 775 individual registrations.
The Defense Department is expected to publish a proposed acquisition rule in July that is needed to implement the Cybersecurity Maturity Model Certification program, according to a DOD official, although it's unclear whether a planned public hearing will be held on the proposal.
The Defense Department has issued an interim rule to ban contractors who use equipment and services from Chinese companies Huawei and ZTE from obtaining government contracts.
The General Services Administration has released a final request for proposals for small businesses that want to provide IT services to agencies that could have lasting repercussions for contractors wanting to do business with the Defense Department and civilian agencies, according to a leading contract lawyer.
The National Institute of Standards and Technology has released a new draft to guide the Defense Department on how to define controlled unclassified information requirements for industry, in line with the maturity levels of the Pentagon's cyber certification program.
The Cyberspace Solarium Commission is advocating for getting up to 20 recommendations from the group's report included in this year's defense policy bill, according to commission Executive Director Mark Montgomery, who says the creation of a national cyber director and a Joint Cyber Planning Cell within the Cybersecurity and Infrastructure Security Agency are among the top priorities.
The Army is looking for industry solutions that are able to meet requirements of the Cybersecurity Maturity Model Certification program in a solicitation for its Assault Breacher Vehicle Remote Control System program, months ahead of when the first Defense Department contract solicitations with CMMC language will be released.
More work is needed to define the policies and procedures behind the Pentagon's Cybersecurity Maturity Model Certification program that go beyond a memorandum of understanding with its accreditation body, according to a leading tech industry association.