According to a Department of Defense (DOD) official as confirmed to Inside Cybersecurity, DOD is planning to publish the proposed acquisition rule required for the implementation of the Cybersecurity Maturity Model Certification (CMMC) program in the next few weeks.
The proposed rule change, titled “Strategic Assessment and Cybersecurity Certification Requirements” under Defense Federal Acquisition Regulation Supplement (DFARS), is required for the Pentagon to award contracts containing CMMC language. Final timing is a decision for the White House Office of Management and Budget’s Office of Information and Regulatory Affairs, but the proposed timing aligns with the tremendous push forward for CMMC across the DOD.
This news should continue to melt away any doubts that the train has left the station and getting compliant with DFARS 252.204-7012 and NIST 800-171 for current contracts and planning for CMMC implementation for future contracts is a major priority for all DOD suppliers.
How to Prepare for Cybersecurity Maturity Model Certification
Compliance with ever-evolving DOD cybersecurity mandates like DFARS 252.204-7012, NIST 800-171, and CMMC is complicated and confusing. It can be hard to understand the outcomes that you should focus on and how to measure success. What does success even look like? How can I partner with a Managed Services provider to deliver measurable outcomes that ensure compliance?
Access our latest webinar, NIST 800-171 Case Study: Surviving a DOD Audit, to prepare your organization for CMMC. Go behind the scenes through a defense contractor’s journey from 35% compliance to a successful audit and “low-risk rating” by the DOD.