CMMC Program Now in Force for DoD

Important notes:

1. This does not mean that all DoD contractors have to be compliant with CMMC today.
2. The Title 48 part of the rule, which enumerates the specific contract clauses to be added to contracts won’t be final until this summer.
3. BUT, a company can be assessed and certified as of today.
4. Most importantly, if you assume it will take a year to get ready to be assessed and the assessor backlog is 6-9 months AND GROWING, if you are not actively working on getting ready, you are behind the power curve.
5. For those people hoping CMMC was going to go away, this is another nail in the coffin for that dream.
6. Even though no “mandatory” CMMC requirements will be in contracts until Title 48 is final, contracting offices apparently disagree with that. A client showed me a statement in an RFI today that says that if you don’t have a score of 110 in SPRS, you will not be awarded a contract, even if you are the lowest cost bidder who meets the contract requirements.

Contact us if you need assistance

*** NOTICE TO THE CMMC ECOSYSTEM ***

16 December 2024

CMMC Reaches Significant Program Milestone Today

Updated guidance for the Ecosystem and defense contractors as

CMMC Title 32 Final Rule enters into force

The Cyber AB is recognizing today’s effective date of the Department of Defense’s codification of the Cybersecurity Maturity Model Certification (CMMC) Program in the Code of Federal Regulations (32 CFR part 170) with updated information on operational preparations for the commencement of CMMC Level 2 certification assessments.

32 CFR part 170 establishes CMMC as a Department of Defense (DoD) program and as of today’s effective date allows for the commencement of numerous CMMC Ecosystem functions and activities.

The impending CMMC Title 48 Proposed Rule, which would implement CMMC requirements in the Defense Federal Acquisition Regulation Supplement (DFARS), remains in the Federal rulemaking process. No mandatory CMMC contractual requirements for defense contractors can take effect until the CMMC Title 48 Final Rule is approved and becomes effective.

by