The Cybersecurity Maturity Model Certification framework, now in its revamped form known as CMMC 2.0, has crossed the threshold from regulatory aspiration to enforceable reality.
Phase 1 went live on November 10, meaning CMMC requirements are already appearing in new Department of War solicitations and contracts. The next deadline in the multi-year rollout -- November 10, 2026 -- is less than six months away.
Complying with CMMC 2.0’s new requirements may require months of effort (such as mandatory audits from a third-party assessor) in order to maintain or win new contracts, meaning the window to act is swiftly closing. Noncompliance has significant consequences for both businesses and individuals, as demonstrated by a December 2025 indictment of a former contractor. Organizations should act now.
Our latest bulletin, which is the first in a multi-part series, has two aims for all those who sign off on cybersecurity: (1) sharpen awareness among organizations subject to CMMC 2.0 specifically, and (2) alert organizations across all sectors that attestation-based compliance is rapidly being replaced by stricter standards for independent assessments backed by aggressive enforcement from stringent regulators.
PartnerHe brings more than two decades of combined legal, cybersecurity, and technology leadership experience to the team, including extensive courtroom experience with more than 60 jury trials and over 80 bench trials.
Prior to joining ...
PartnerJohn brings more than a decade of experience counseling multinational organizations and highly regulated financial institutions on global privacy and information security compliance. His practice focuses on data protection ...
PartnerHe advises clients on compliance with a wide range of state, federal, and international privacy laws, helping them develop and implement business-focused data protection strategies that reduce legal risk and align with ...
The Constangy Cyber Advisor posts regular updates on legislative developments, data privacy, and information security trends. Our blog posts are informed through the Constangy Cyber Team's experience managing thousands of data breaches, providing robust compliance advisory services, and consultation on complex data privacy and security litigation.
