The Cybersecurity Maturity Model Certification framework, now in its revamped form known as CMMC 2.0, has crossed the threshold from regulatory aspiration to enforceable reality.
Phase 1 went live on November 10, meaning CMMC requirements are already appearing in new Department of War solicitations and contracts. The next deadline in the multi-year rollout -- November 10, 2026 -- is less than six months away.
Complying with CMMC 2.0’s new requirements may require months of effort (such as mandatory audits from a third-party assessor) in order to maintain or win new contracts, meaning the window to act is swiftly closing. Noncompliance has significant consequences for both businesses and individuals, as demonstrated by a December 2025 indictment of a former contractor. Organizations should act now.
Our latest bulletin, which is the first in a multi-part series, has two aims for all those who sign off on cybersecurity: (1) sharpen awareness among organizations subject to CMMC 2.0 specifically, and (2) alert organizations across all sectors that attestation-based compliance is rapidly being replaced by stricter standards for independent assessments backed by aggressive enforcement from stringent regulators.
PartnerAndrew works with Constangy’s cyber litigation practice, defending organizations in complex class action litigation arising from data security incidents and privacy-related claims. He brings more than two decades of ...
PartnerJohn brings more than a decade of experience counseling multinational organizations and highly regulated financial institutions on global privacy and information security compliance. His practice focuses on data protection ...
The Constangy Cyber Advisor posts regular updates on legislative developments, data privacy, and information security trends. Our blog posts are informed through the Constangy Cyber Team's experience managing thousands of data breaches, providing robust compliance advisory services, and consultation on complex data privacy and security litigation.
