CMMC Program Final Rule Published

I’ll keep this entry short and sweet; DoD has announced publication of the CMMC Program Final Rule. This is in regards to the 32 CFR update, no the 48 CFR update discussed in my previous CMMC Timeline post. The text can be viewed here on federalregister.gov.

Title 32 focus on National Defense, and its update will establish the rules and procedures for certifying contractor’s cybersecurity maturity levels. Title 48 focuses on procurement and acquisition, and its update will make CMMC requirements described in Title 32 enforceable in DoD contracts. The Title 48 update to DFARS is much shorter and can be expected to be finalized after October 15th, 2024 (this is the end of the comment period).