The Cybersecurity Maturity Model Certification Accreditation Body (“CMMC-AB”) is an independent, nonprofit organization that has entered into a no-cost contract with the US Department of Defense to be the sole “Accreditation Body” under DoD’s CMMC program. The full terms of the CMMC-AB’s contract have not been made public, however a Statement of Work (“SOW”) that accompanies the contract was released after Sara Friedman of Inside Cybersecurity filed a Freedom of Information Act request to obtain details. The SOW outlines many of the details of the CMMC-AB’s relationship with DoD, as well as requirements DoD is imposing on other participants in the CMMC Ecosystem including C3PAOs and assessors. You can view a copy of the SOW via the link below.

CMMC-AB Statement of Work as PDF file.