Pentagon finalizes CMMC program rulemaking to formally launch certification initiative

By Sara Friedman  / October 11, 2024

The Defense Department has released the final rule to formally establish the Cybersecurity Maturity Model Certification program, marking a major step forward in the Pentagon's work to launch version 2.0 of the initiative nearly three years after an internal review.

“The purpose of CMMC is to verify that defense contractors are compliant with existing protections for federal contract information (FCI) and controlled unclassified information (CUI) and are protecting that information at a level commensurate with the risk from cybersecurity threats, including advanced persistent threats,” DOD says today in a release announcing publication of the final rulemaking.

“This rule streamlines and simplifies the process for small-and medium-sized businesses by reducing the number of assessment levels from the five in the original program to three under the new program,” DOD says.

The final rule will be published Oct. 15 in the Federal Register with 60 days until it goes into effect.

DOD launched a CMMC internal review in the early days of the Biden administration, putting on pause a portion of the 2020 interim final rule to amend the Pentagon’s acquisition rules. The review was completed in November 2021 with some major changes and the announcement of plans to pursue a second rulemaking to establish the CMMC program under Title 32 of the Code of Federal Regulations.

The 32 CFR proposed rule was published on Dec. 26 and received significant feedback from a wide range of stakeholders.

DOD said today: “With the publication of this updated 32 CFR rule, DOD will allow businesses to self-assess their compliance when appropriate. Basic protection of FCI will require self-assessment at CMMC Level 1. General protection of CUI will require either third-party assessment or self-assessment at CMMC Level 2.”

“A higher level of protection against risk from advanced persistent threats will be required for some CUI. This enhanced protection will require a Defense Industrial Base Cybersecurity Assessment Center led assessment at CMMC Level 3,” according to DOD.

The Pentagon also built on the 2020 interim final rule under CMMC 2.0 to establish new requirements under the Defense Federal Acquisition Regulation Supplement through a proposed rule published Aug. 15. The comment period for the DFARS proposed rule closes Oct. 15.

Under CMMC 2.0, DOD says there is an “an annual affirmation requirement that is a key element for monitoring and enforcing accountability of a company’s cybersecurity status.”

The Pentagon is also introducing the use of plans of action and milestones for CMMC, which DOD says “will be granted for specific requirements as outlined in the rule to allow a business to obtain conditional certification for 180 days while working to meet the NIST standards.”

The final rule is aligned with cybersecurity requirements in Federal Acquisition Regulation part 52.204-21 for federal contract information and National Institute of Standards and Technology Special Publications 800-171 Rev. 2 and 800-172.

DOD says the final rule “also clearly identifies the 24 NIST SP 800-172 requirements mandated for CMMC Level 3 certification.”

While NIST updated 800-171 to revision three in May, DOD will need another rulemaking to make the latest version of the NIST standard the CMMC requirement at level two.

DOD highlights the “benefits of CMMC” in the release including:

  • Safeguarding sensitive information to enable and protect the warfighter
  • Enforcing DIB cybersecurity standards to meet evolving threats
  • Ensuring accountability while minimizing barriers to compliance with DoD requirements
  • Perpetuating a collaborative culture of cybersecurity and cyber resilience
  • Maintaining public trust through high professional and ethical standards

“The Department understands the significant time and resources required for industry to comply with DOD’s cybersecurity requirements for safeguarding CUI and is intent upon implementing CMMC requirements to assess the degree to which they have done so,” the release says.

“The Department would like to thank all the businesses and industry associations that provided input during the public comment period. Without this collaboration, it would not have been possible to meet our goals of improving security of critical information and increasing compliance with cybersecurity requirements while simultaneously making it easier for small and medium-sized businesses to meet their contractual obligations,” according to the release.

DOD anticipates finalizing the DFARS rule in “early to mid-2025.” It says, “Once that rule is effective, DOD will include CMMC requirements in solicitations and contracts. Contractors who process, store, or transmit FCI or CUI must achieve the appropriate level of CMMC as a condition of contract award.”