CMMC: Mora Frequently Asked Questions.

• Date: 01 June 2021
• Published date: 01 June 2021

The National Defense Industrial Association has held a series of webinars for members seeking information about the Defense Department's Cybersecurity Maturity Model Certification program. NDIA Senior Vice Principal of Strategy and Policy Wes Hallman, Principal Director of Strategy Corbin Evans and Director of Regulatory Policy Nick Jones answered questions for participants after an April 15 talk.

The questions and answers from that session have been edited for clarity and length.

Will CMMC be required in the Small Business Innovation Research/Small Business Technology Transfer programs?

All Defense Department contracts will have CMMC as a requirement by the start of fiscal year 2026. At this time, we don't know if any SBIR/STTR program contracts will include CMMC language prior to 2026 but it is likely that at least some of those contracts will be part of the pilot program.

The Defense Department in March announced an internal review of the program. Is there any hope that the review might reduce the complexity and cost for the CMMC certifications? This absolutely seems like...