CMMC Final Rule Includes M&A Trigger For New Assessment

As Crowell covered in a recent alert, the Department of Defense (DoD) on October 11, 2024 released a final rule (the "Final Program Rule") formalizing the requirements, assessment processes, and related governance for its Cyber Maturity Model Certification Program (CMMC).

One aspect of CMMC that may have gotten lost in the shuffle of the Final Program Rule's 470 pages is that when a contractor undergoes a merger or acquisition (M&A), the transaction may trigger a requirement for a new CMMC assessment. As the groundwork for this requirement, the Final Program Rule states that "CMMC Level 2 self-assessment, Level 2 certification assessment, and Level 3 certification assessment are valid for a defined CMMC Assessment Scope." CMMC Assessment Scope means the set of all assets in the Organization Seeking Assessment's (i.e., the contractor's) environment that will be assessed against CMMC security requirements. Under CMMC, in-scope assets will not only consist of IT