CMMC Final Rule: Time to Comply
The Cybersecurity Maturity Model Certification (CMMC) Final Rule has been released, bringing significant updates and clarifications for organizations within the Defense Industrial Base (DIB).
The Final Rule, published in late 2024, has timing and compliance implications for the thousands of companies that provide products and services within the DIB.
Recommitment to the 110 Score
One of the critical aspects of the CMMC Final Rule is the recommitment to the 110 score. This score represents the full implementation of the NIST SP 800-171 controls, which are essential for protecting Controlled Unclassified Information (CUI). Organizations must achieve and maintain this score to demonstrate their cybersecurity maturity and readiness for CMMC certification.
Established Timelines
The CMMC Final Rule outlines a clear timeline for implementation. The rule became effective on December 16, 2024. The phased rollout is designed to provide ample time for organizations to understand and implement the requirements. Here are the key phases:
- Phase 1 (2025): Self-assessment and attestation for all new contracts.
- Phase 2 (2026): Introduction of third-party assessment requirements for applicable Level 2 contracts.
- Phase 3 (2027): Inclusion of third-party assessments for all Level 2 contracts, renewals, or extensions. Introduction of DoD assessments for all Level 3 contracts.
- Phase 4 (2028): Full implementation, with CMMC requirements included in all DoD solicitations and contracts .
The phased rollout has been adjusted to address ramp-up issues and provide sufficient time for training assessors and preparing organizations. . Each phase will start consecutively one calendar year after the preceding phase. This extension ensures that organizations have the necessary time to comply with the new requirements and that there are enough qualified assessors to conduct the evaluations.
Time to Comply for the DIB
The updated timelines and expectations in the CMMC Final Rule provide clarity in the path to achieving cybersecurity compliance. By understanding the established timelines and the 110 score, organizations can ensure they are well-prepared for the upcoming requirements.
Start your preparation today to stay ahead of the deadlines and protect your valuable contracts.
