Cybersecurity Maturity Model Certification: An Idea Whose Time Has Not Come And Never May CMMC represents a new approach to improving industry resilience to cyber-attack and protecting sensitive but unclassified information. CMMC is a deeply flawed way to achieve this objective.  The Defense Department should at least delay CMMC implementation, and probably cancel it altogether.