New CMMC Proposed Rule

Following the proposed CMMC regulatory framework by the Department of Defense (DoD), companies are advised to embark on compliance programs. The proposed rule articulates a well-structured four-phase implementation plan. The initial phase kicks off on the effective date of the CMMC rule, entailing CMMC Level 1 or Level 2 self-assessments as prerequisites for being considered for awards under pertinent solicitations and contracts.

Phase two, slated to commence six months after the initiation of phase one, involves CMMC Level 2 certification assessments. Subsequent to that, phase three, beginning one year after the commencement of phase two, introduces CMMC Level 3 certification requirements. The inclusion of CMMC requirements as award conditions will be determined at the discretion of DoD Program Managers until the full implementation in Phase 4. The DoD aims to incorporate CMMC requirements in all applicable solicitations starting from October 1, 2026.

Assessments

The proposed assessment requirements present a combination of self-assessments and third-party assessments, contingent upon the criticality of the data at stake. According to the proposed rule, CMMC Level 1 assessments are exclusively self-assessments, compelling contractors to validate their own compliance with CMMC security controls. These contractors must submit their assessment scores to the Department of Defense’s (DoD) Supplier Performance Risk System (SPRS) prior to contract award and on an annual basis thereafter.

For CMMC Level 2, either a self-assessment or a certification assessment conducted by a third-party assessment organization (C3PAO) is mandated. This assessment must be completed before contract award and repeated every three years. The proposed rule does not explicitly outline how the DoD will determine the contracts subject to self-assessments versus certification assessments. In the case of CMMC Level 3, certification assessments will be conducted by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), necessitating completion before contract award and recurrence every three years.

Plan of Action and Milestone (POA&M) Limitations

As per the proposed rule, the Cybersecurity Maturity Model Certification (CMMC) introduces the utilization of Plans of Action and Milestones (POA&Ms) for specific requirements and within defined time constraints. Notably, Level 1 assessments do not permit the use of POA&Ms.

For CMMC Level 2 assessments, the use of POA&Ms is generally restricted for security requirements with a point value exceeding 1, except in the case of Controlled Unclassified Information (CUI) Encryption under specific circumstances. However, allowances are made if the assessment score divided by the total number of security requirements is 0.8 or higher, and the control is not on the list of prohibited controls for POA&Ms.

In Level 3 assessments, the use of POA&Ms is allowed under the condition that the assessment score divided by the total number of security requirements is 0.8 or higher, and the control is not among the prohibited controls for POA&Ms. Each POA&M must be resolved, with all requirements fulfilled, within 180 days of the assessment. A closeout assessment, focusing solely on the unmet requirements identified by the POA&Ms, must confirm the closure. It is crucial to emphasize that CMMC does not entertain requests for waivers related to any CMMC security requirement.

Conditional and Final Certifications

According to the proposed rule, assessments can lead to either a Final Certification or a Conditional Certification, contingent on a contractor’s implementation of all necessary security controls. A contractor who achieves the minimum passing score and fully implements all required security controls will receive a final certification. However, if Plans of Action and Milestones (POA&Ms) persist at the end of an assessment, the contractor will be issued a Conditional Certification.

Contractors are mandated to address and complete their POA&Ms, ensuring the full implementation of pending controls within 180 days from the initial assessment. Failure to meet this requirement may result in contractual consequences, including termination, and render the contractor ineligible for future contracting opportunities that necessitate compliance with the Cybersecurity Maturity Model Certification (CMMC).

Senior Affirmations

In accordance with the proposed rule, an annual affirmation of compliance with mandated security requirements is required from both the prime contractor and any relevant subcontractor. Furthermore, at CMMC Levels 2 and 3, contractors are mandated to affirm their compliance post each CMMC assessment, whether it is a self-assessment or an assessment certification, as well as following the resolution of any Plans of Action and Milestones (POA&M) close-outs.

These CMMC affirmations, similar to self-assessment scores, must be electronically submitted through the Supplier Performance Risk System (SPRS). Contractors are ineligible for awards under solicitations stipulating Cybersecurity Maturity Model Certification (CMMC) compliance until their affirmations are submitted.

Contractors are urged to diligently verify their CMMC compliance status prior to affirmation submissions. Presenting an affirmation that inaccurately represents a contractor’s CMMC compliance status could be interpreted by the government as a false statement, potentially resulting in procurement consequences such as contract termination or debarment. Additionally, the False Claims Act (FCA) may entail damages and/or fines in such instances.