Government Accountability Office report on CMMC raises issues over initial pilots, communication with industry

The Pentagon should develop a plan to “measure the effectiveness” of its pilot efforts for the Cybersecurity Maturity Model Certification program, according to a report from the Government Accountability Office, which identifies deficiencies in the pilot review process and directs the Defense Department to provide “sufficient and timely communication” with industry.

“DOD’s plan to roll out the CMMC pilot does not reflect GAO’s leading practices for designing a pilot, and the department does not yet have a plan in place...