Pentagon releases CMMC scoping guidance, updated maturity model

The Defense Department has released long-awaited scoping guidance for its Cybersecurity Maturity Model Certification program that will help defense companies determine what assets will be included under the assessment process, along with a new overview document describing key changes to the program.

The Pentagon announced major changes to the CMMC program on Nov. 4, including consolidating the program into three maturity levels, removing 20 practices and three processes from the new level two, and allowing contractors to submit a...