https://infosecstandards.org/standards/cmmc News about Cybersecurity Maturity Model Certification (CMMC), including major updates to our page on it. en-us https://infosecstandards.org/news/who-decides-what-to-ask https://infosecstandards.org/news/who-decides-what-to-ask Thu, 03 Sep 2026 00:00:00 GMT The HIPAA, PCI DSS, CMMC, and SOC 2 pages each gained a section naming the party that actually sets your obligation and the questions to put to them in writing. HIPAA and SOC 2 also gained a first-decision picker. https://infosecstandards.org/news/risk-assessment-tool https://infosecstandards.org/news/risk-assessment-tool Wed, 02 Sep 2026 00:00:00 GMT Infosec Standards now has a guided, NIST SP 800-30 based risk assessment tool. Everything stays in your browser; you leave with a JSON file to resume from, a spreadsheet register, and a printable report. https://infosecstandards.org/news/cmmc-phase-2-suspended https://infosecstandards.org/news/cmmc-phase-2-suspended Mon, 13 Jul 2026 00:00:00 GMT The Defense Department suspended the November 2026 ramp-up of CMMC Level 2 third-party assessments and opened a short review of the program. Phase 1 self-assessment rules stay in force. https://infosecstandards.org/news/cmmc-final-rule https://infosecstandards.org/news/cmmc-final-rule Tue, 15 Oct 2024 00:00:00 GMT On October 15, 2024, DoD published the CMMC Program final rule. It took effect December 16, 2024 and is the current CMMC 2.0 program regulation.