Regulatory Rule Published
On September 29, the Department of Defense (DOD) released the that will amend the Defense Federal Acquisition Regulation Supplement (DFARS) marking a key milestone that will eventually require a (CMMC) in all defense contracts phased in completely by 2026. For defense contractors CMMC certification is a 鈥済o/no go鈥 requirement. The rule was originally slated to be released in the spring but was delayed. Disappointingly, the interim rule will take immediate effect at the end of the 60-day comment period giving regulators little time to make any adjustments. The rule comes on the heels of the announcing that it had selected the first batch of 73 provisional CMMC Third Party Assessment Organization (C3PAO) who will undergo training.
The purpose of CMMC is to become the 鈥渦nified cybersecurity standard鈥 for all DOD contractors, including subcontractors. Under this model, Defense contractors, including subcontractors, will be required to be certified among the different CMMC levels (1-5) in order to be eligible for contract award. The level of security is determined based on the security requirements needs for each defense contract. This differs from previous cybersecurity mandates as CMMC will require contractors to obtain a third-party accreditation.
51风流 has communicated the difficulty many contractors have had implementing these new cybersecurity requirements and the challenges that the CMMC model brings. 51风流 of America has previously filed comments on CMMC as it was developed and will file comments on the new interim rule. On December 19, 51风流 hosted a that discussed CMMC and how contractors should begin to prepare.
For more information, contact jordan.howard@agc.org or (703) 837-5368.