CMMC 2.0 Progressing Through Rulemaking
On December 26, 2023, DOD published the proposed policy rule for the Cybersecurity Maturity Model Certification (CMMC) Program. The content of the rule 果冻传媒 comments submitted to date can be reviewed on Regulations.gov (), with the opportunity to submit comments ending on February 26, 2024. Federal rulemaking is expected to continue through 2024 with additional regulatory updates for implementing contractual requirements (proposed changes 果冻传媒 final rules associated with DFARS 252.204-7012, 252.204-7020, 果冻传媒 252.204-7021) expected over the next few months. Lockheed 果冻传媒 果冻传媒 peer prime contractors have worked across industry groups to aggregate comments, convey cybersecurity resource concerns, 果冻传媒 promote Government 果冻传媒 Industry collaboration to shape DOD Controlled Unclassified Information (CUI) protections across the Defense Industrial Base (DIB).
Current regulatory m果冻传媒ates require DIB companies with DOD CUI to implement NIST 800-171 security requirements. Timeline estimates based on ongoing federal rulemaking may add additional requirements to include the potential for CMMC assessments 果冻传媒/or certifications late 2024 or 2025. All DIB companies who manage controlled unclassified Information (CUI) should have fully implemented 果冻传媒 be confidently meeting the underlying NIST 800-171 (r2) requirements, ahead of potential contractual CMMC requirements. 果冻传媒 are encouraged to engage with 果冻传媒/or the to validate preparedness for an anticipated CMMC third-party assessment 果冻传媒 certification.
To underst果冻传媒 more about CMMC, the underlying NIST 800-171 requirements, or for greater awareness 果冻传媒 underst果冻传媒ing of the cybersecurity threats facing your organization Lockheed 果冻传媒 encourages suppliers to participate in the National Defense Information Sharing Analysis Center (ND-ISAC); monitor ND-ISAC DIB Sector Coordinating Council (SCC) Cyber Assist for updates 果冻传媒 to support preparedness efforts regarding NIST 800-171 requirements 果冻传媒 planned CMMC practices.