Defense Department Proposed Rule

2023-27280: Cybersecurity Maturity Model Certification (CMMC) Program

Comment Period Closed

Public comment closed .

Get alerted when the next rule lands

New rules open for comment on their own schedule. Pick how you want to hear about them — we email you when one appears.

Alert me on new Defense Department rules or alert me on a subject

Publishing to members? Embed a live rule tracker on your own site — the proposed rules in your area and the comment deadlines closing on them, updating themselves. Free, one line of HTML.

Create a free account & build one →

Summary

DoD is proposing to establish requirements for a comprehensive and scalable assessment mechanism to ensure defense contractors and subcontractors have, as part of the Cybersecurity Maturity Model Certification (CMMC) Program, implemented required security measures to expand application of existing security requirements for Federal Contract Information (FCI) and add new Controlled Unclassified Information (CUI) security requirements for certain priority programs. DoD currently requires covered defense contractors and subcontractors to implement the security protections set forth in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Rev 2 to provide adequate security for sensitive unclassified DoD information that is processed, stored, or transmitted on contractor information systems and to document their implementation status, including any plans of action for any NIST SP 800-171 Rev 2 requirement not yet implemented, in a System Security Plan (SSP). The CMMC Program provides the Department the mechanism needed to verify that a defense contractor or subcontractor has implemented the security requirements at each CMMC Level and is maintaining that status across the contract period of performance, as required.

The agency’s own summary, as published.

What this changes

Amends 1 part of the Code of Federal Regulations — the standing rules this notice rewrites.

Don't miss the comment window

One Click Politics alerts you on every deadline, hearing, and rule change.

See all rules with comments due soon →