CMMC Final Rule Published: What It Means for Defense Contractors

Blog Author: Adam Kangiser, Compliance Analyst at Iviry

The Cybersecurity Maturity Model Certification (CMMC) 2.0 program is nearing full implementation following the release of the final rule, published in the federal register on October 15, 2024. This rule, codified under 32 CFR, will officially take effect in December 2024, marking a critical step in ensuring that defense contractors demonstrate compliance with necessary cybersecurity practices.

The CMMC 2.0 program is the Department of Defense’s (DoD) answer to an ever-growing cybersecurity threat landscape. The new rule outlines how the DoD will verify that contractors handling Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) meet the appropriate CMMC levels. The final rule represents a critical effort to secure sensitive information across the Defense Industrial Base (DIB) and safeguard national security interests.

What Is the CMMC Program?

The Cybersecurity Maturity Model Certification (CMMC) is a framework designed to protect sensitive data by setting specific cybersecurity standards for contractors working within the defense supply chain. The program includes three levels of certification, each addressing different cybersecurity needs:

Level 1 (Foundational): Focused on basic cybersecurity hygiene practices required for protecting FCI. This is the most basic level, and contractors can conduct self-assessments to meet these requirements.

Level 2 (Advanced): Designed for contractors handling CUI, Level 2 introduces enhanced security measures. Companies at this level are subject to third-party assessments to verify their compliance.

Level 3 (Expert): This level is for contractors dealing with high-value assets and requires the highest level of cybersecurity maturity. Contractors at this level will undergo government-led assessments.

CMMC 2.0 simplifies the original CMMC framework, reducing the number of levels from five to three. It focuses on making compliance more achievable, particularly for small businesses, while maintaining robust standards to ensure that all contractors handling sensitive defense information can protect it from cyber threats.

Key Highlights of the CMMC Final Rule

The final rule lays out how the DoD will assess and enforce CMMC requirements across the defense contractor community. Here are the most significant takeaways from the rule:

• Phased Implementation: CMMC 2.0 will be rolled out in phases to minimize disruptions. This allows contractors to prepare and transition smoothly into the new requirements.
• Self-Assessment for Level 1: Contractors handling only FCI will be able to conduct self-assessments, making it easier and less costly for small businesses to comply.
• Third-Party and Government-Led Assessments: Contractors at Level 2 and Level 3 will be required to undergo third-party and government-led assessments, respectively, to verify compliance. This process ensures that organizations dealing with more sensitive information adhere to higher standards of cybersecurity.
• Recertification Requirements: Contractors will need to undergo periodic reassessments to maintain their CMMC certification, ensuring that their cybersecurity practices remain up to date with evolving threats.

DFARS 48 CFR and CMMC Contract Clauses

In addition to the final rule, the DoD proposed another rule in August 2024 that integrates CMMC requirements into defense contracts through amendments to the Defense Federal Acquisition Regulation Supplement (DFARS) under 48 CFR. This proposal outlines specific requirements for contract clauses and compliance, formalizing how CMMC will be applied in defense procurement processes.

1. Public Comment Period: The 60-day public comment period for the proposed 48 CFR rule ended on October 15, 2024. The DoD will review the feedback before finalizing the rule.
2. Finalization and Phased Rollout: The final version of the CMMC contract clauses is expected by early 2025, with a phased rollout to follow. CMMC requirements will be selectively applied to contracts over the next three years to minimize disruption for contractors, especially small businesses.
3. Full Integration by 2028: By 2025, defense contractors bidding for DoD contracts will need to prove CMMC compliance at the time of the contract award. The phased rollout will ensure that all relevant contracts include mandatory CMMC requirements by 2028.

How CMMC Affects Defense Contractors

The CMMC program directly impacts contractors that work with the DoD or are part of its broader supply chain. Compliance with CMMC standards will soon become a prerequisite for bidding on contracts, making cybersecurity a critical competitive differentiator.

For businesses in the Defense Industrial Base (DIB), the implications are clear:

• Mandatory Compliance: By 2025, contractors bidding for DoD contracts must demonstrate compliance with the appropriate CMMC level. This requirement will become increasingly important as the phased rollout progresses, ensuring that only compliant contractors can participate in defense projects.
• Security of Sensitive Data: For contractors handling FCI and CUI, meeting the appropriate CMMC level will ensure that sensitive data is protected from cyber threats, reducing the risk of data breaches that could compromise national security.
• Competitive Advantage: Early compliance can give businesses a competitive edge, as the CMMC certification will become a critical factor in qualifying for future DoD contracts.

Challenges for Small Businesses

While the DoD has designed CMMC 2.0 to be more streamlined and flexible, compliance can still be a challenge for small and medium-sized businesses. However, phased implementation allows smaller companies time to build up their capabilities and achieve compliance before the requirements become mandatory for all contracts.

How Iviry Can Help

Navigating the complexities of the CMMC final rule can be overwhelming for many businesses. This is where Iviry comes in. We specialize in guiding organizations through the entire compliance process, from understanding the CMMC levels to preparing for third-party assessments and maintaining compliance long-term.

As a CMMC Registered Practitioner Organization (RPO), Iviry provides expert assistance tailored to the needs of small and medium-sized defense contractors. Whether you’re preparing for a Level 1 self-assessment or require more advanced support for Level 2 or 3 certification, we’re here to help. Our team of experts can perform a gap analysis to review your current cybersecurity posture, implement necessary controls, and ensure your business is prepared for the new CMMC requirements.

Contact Iviry Today

The countdown to mandatory CMMC compliance has begun. Don’t wait until it’s too late—start preparing your business now to secure your place in the Defense Industrial Base (DIB). Contact Iviry today for expert guidance on navigating the CMMC process and safeguarding your business.

CONTACT US FORM: