CMMC Phase II Is Paused, But Contractors’ Data-Security Obligations Are Not

By John Grancarich, EVP, Head of Defense & Intelligence, Fortra The recent pause affecting the implementation of Cybersecurity Maturity Model Certification (CMMC) Phase II has understandably generated questions across the Defense Industrial Base (DIB). For many organizations, the immediate reaction has been to ask whether compliance timelines will shift, whether assessment preparation can be slowed, or whether security investments can be deferred until additional guidance emerges. Those questions are understandable. They are also focused on the wrong issue. While implementation timelines may evolve, the underlying security requirements that drove CMMC’s creation have not changed. The Department of Defense still...

Read the full article at the source.