Procurement group urges Pentagon to clarify how contracting officers will set CMMC maturity level requirements

By Sara Friedman  / November 1, 2024

The Coalition for Government Procurement is asking the Defense Department to provide guidance on when requirements under the Cybersecurity Maturity Model Certification program will go into effect for specific contracts, in response to a proposed rule to make changes to the Pentagon’s acquisition regulations.

“The 48 CFR Proposed Rule, at DFARS 252.204-7021(b)(1)(i), calls upon the [contracting officer] to ‘fill in the required CMMC level.’ Proposed clause 242.204-7YYYY provides for notification to suppliers of the required certification level. The 48 CFR final rule should provide further clarity on the factors to consider in setting the CMMC level and accommodate contractor participation,” the Coalition says in an Oct. 15 filing to DOD.

DOD released a proposed rule on Aug. 15 to amend the Defense Federal Acquisition Regulation Supplement to make changes for CMMC 2.0. DOD announced a CMMC revamp in November 2021 following an internal review of the program.

The Coalition says the proposed rule is “unclear” on how the “correct” CMMC maturity level is to be determined.

“This leaves DIB partners in the dark on decisions that could affect greatly the time available, or even the feasibility, of meeting CMMC security requirements,” the filing says.

The filing says, “DOD also should consider changing the rule to enable COs to make inquiries of contractors, and have consultations, before the CO sets the CMMC level. Because a CO may set a CMMC level that does not reflect the actual possession or use of information by a supplier, or the level or risk involved, it is advisable for the CO to be authorized to conduct fact-finding as needed before the CMMC level is set.”

“We therefore would recommend that DOD clearly outline and publish the methodology for determining CMMC levels, making further changes as outlined above. Consultation with potentially affected suppliers could improve the outcome,” the Coalition says.

The Coalition is a “non-profit association of firms selling commercial services and products to the Federal Government,” according to the filing.

The Coalition raises several issues in its filing including asking for the proposed rule to “be improved and clarified so that Defense Industrial Base suppliers better understand what is expected of them in requirements to flow down CMMC obligations to their suppliers.”

The group also wants DOD to provide clarity on what factors will be considered when setting a CMMC level in a contract and to “accommodate contractor participation.”

“At present, it is unclear how the ‘correct’ level is to be determined. This leaves DIB partners in the dark on decisions that could affect greatly the time available, or even the feasibility, of meeting CMMC security requirements. DoD also should consider changing the rule to enable COs to make inquiries of contractors, and have consultations, before the CO sets the CMMC level,” the filing says.

The Coalition calls for DOD to provide formal waiver procedures.

The filing says, “The Coalition recognizes that full articulation of waiver authority, process, and guidelines could require a separate rulemaking beyond the pending 32 CFR and 48 CFR rules. The Coalition strongly urges that DoD’s CMMC leadership to include near-term waiver provisions and start on rulemaking for broader purposes. In the prospective waiver rules, we urge DoD to incorporate risk assessment and outcome comparison into the waiver decisions.”

The filing also addresses requirements in the proposed rule for notifications of lapses in information security that come up in several other filings to DOD on the DFARS rule and asks DOD to provide clarification on its definition of commercially off-the-shelf items.