Jessica Maxwell, a spokeswoman for the Department of Defense (DOD), said the Pentagon is assessing the Cybersecurity Maturity Model Certification (CMMC) program to ensure that it is meeting goals without impeding industry participation, FedScoop reported Tuesday. Maxwell told the publication in a statement that the DOD routinely executes assessments at the early stages of major programs.
Robert Metzger, head of law firm Rogers Joseph O’Donnell's Washington, D.C. location, told FedScoop that it is “timely to consider” potential modifications to the CMMC initiative. Metzger noted that he expects the DOD review to address issues such as funding, staffing and the issuance of interim rules finalizing the program.
“It would not surprise me at all if the new administration would want to consider very carefully how best to get this objective achieved,” he added.
The Biden administration could look into potential changes to how the DOD coordinates with the CMMC Accreditation Body and the roles that third-party assessors must assume, according to Metzger.