The US Department of Defense (DoD) published a final rule codifying the Cybersecurity
Maturity Model Certification (CMMC) Program. The final CMMC rule
will apply to all DoD contractors and subcontractors that will
process, store, or transmit Federal Contract Information
(FCI)1 or Controlled Unclassified Information
(CUI)2 on contractor information systems. The final CMMC
rule builds on the proposed CMMC rule that DoD published in
December 2023, which we discussed in depth here.
The final CMMC rule incorporates DoD's responses to 361
public comments submitted during the comment period and spans more
than 140 pages in the Federal Register. Many responses
address issues raised in our prior reporting, and DoD generally
appears to have been responsive to several concerns raised by the
industry. In the coming weeks, we expect to update our separate
summaries of CMMC Level 1, Level 2, and Level 3 to reflect the final rule. This OTS
summarizes the key changes to the CMMC
