<body><div><figure><img src="https://img.particlenews.com/image.php?type=thumbnail_580x000&amp;url=0uubVj_0wLnsqWZ00" alt="https://img.particlenews.com/image.php?url=0uubVj_0wLnsqWZ00" width="640" height="427" ></figure><p>The Department of Defense (DoD) has officially published the Cybersecurity Maturity Model Certification (CMMC) Program to ensure defense contractors meet rigorous security standards when handling Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). This new CMMC rule represents a crucial step to safeguard national security by verifying that defense contractors maintain robust cybersecurity practices throughout the contract lifecycle.</p><p>Under the finalized CMMC rule, contractors will need to meet designated cybersecurity levels and undergo regular assessments to confirm compliance. The DoD’s recent actions align with efforts to counter growing cyber threats against the Defense Industrial Base (DIB), a sector increasingly targeted by adversaries. The rule will evolve over time, adapting to advances in cybersecurity requirements, emerging threats, and updated national defense priorities.</p><h2>Background of the CMMC Program</h2><p>The roots of the CMMC program trace back to Executive Order 13556 issued in November 2010, which aimed to create a standardized system for managing sensitive unclassified information across government agencies. Previously, more than 100 different data classification standards across executive agencies led to inconsistent protection, resulting in vulnerabilities. The CUI Program was born to centralize information security practices across federal agencies, laying the groundwork for the current CMMC framework.</p><p>The CMMC model was officially launched in 2019 by the Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&amp;S)), moving the industry away from a “self-attestation” approach. This initiative underscored the necessity for a verified, structured model to protect sensitive data within the DIB. The initial CMMC interim rule, published in September 2020, outlined the framework’s features and began a five-year phase-in period. Following stakeholder feedback, DoD further refined the program, resulting in today’s finalized rule.</p><h2>Key Features of the CMMC Program</h2><p>The revised CMMC framework consists of three primary components:</p><p>1. Tiered Model: Contractors must meet progressively stringent security standards based on the sensitivity of information handled. Levels range from basic cybersecurity practices to advanced measures, with the goal of protecting sensitive government data against sophisticated cyber threats. Companies are also required to extend these protections to their subcontractors when handling FCI or CUI.</p><p>2. Assessment Requirements: The CMMC mandates assessments to confirm contractors’ adherence to cybersecurity standards. Depending on the type and sensitivity of information, companies will need to undergo self-assessments, third-party assessments, or government-led evaluations.</p><p>3. Phased Implementation: The DoD will roll out CMMC requirements over four phases, spanning three years. Contractors handling sensitive information must achieve the designated CMMC level to be eligible for contract awards. In addition, assessments by third-party evaluators—CMMC Third-Party Assessment Organizations (C3PAOs)—will verify contractor compliance.</p><h2>Revised Defense Regulations for Cybersecurity</h2><p>The new rulemaking supplements existing Defense Federal Acquisition Regulation Supplement (DFARS) provisions. For instance, the 48 CFR part 204 CMMC Acquisition Rule ties contract eligibility directly to CMMC compliance, meaning that contractors must meet specified CMMC levels before receiving awards or renewing contracts. These measures are designed to address cyber threats targeting DoD supply chains and include strict guidelines for subcontractors.</p><p>Additionally, defense contractors must align with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, a foundational security standard for protecting CUI. Contractors must provide a System Security Plan (SSP) detailing security measures and create Plans of Action and Milestones (POA&amp;Ms) to address any security gaps. Failure to comply could result in the loss of contract eligibility and other contractual remedies.</p><h2>Timeline and Implementation Plan</h2><p>The DoD has initiated a robust timeline for CMMC implementation. Starting immediately, larger contractors processing CUI must undergo third-party assessments. The department projects that in the program’s initial years, roughly 135 C3PAO-led assessments will occur, scaling to over 4,000 annual assessments by the fourth year. As part of its phased approach, the DoD will continually assess its contractors’ cybersecurity practices and adjust the CMMC model as needed to address new security threats.</p><h2>Broader Impact on National Security</h2><p>The CMMC program is a core component of the 2024 Defense Industrial Base Cybersecurity Strategy, reinforcing the DoD’s commitment to securing U.S. defense operations. This new certification standard, which applies to all tiers of the defense supply chain, seeks to foster a collaborative culture of cybersecurity, where both prime contractors and subcontractors uphold strong security practices. By implementing CMMC, DoD aims to enhance national security resilience while ensuring that the DIB meets the rising cybersecurity demands of modern defense operations.</p><p>For further details, including the full CMMC text from the DOD click here.</p></div></body>

Mountain View, CA

NewsBreak

DoD Releases Final Rule for CMMC Program to Strengthen Cybersecurity in Defense Contracts

The Department of Defense (DoD) has officially published the Cybersecurity Maturity Model Certification (CMMC) Program to ensure defense contractors meet rigorous security standards when handling Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). This new CMMC rule represents a crucial step to safeguard national security by verifying that defense contractors maintain robust cybersecurity practices throughout the contract lifecycle.