Share on LinkedInShare on LinkedIn

ARTICLE · 26 JANUARY 2024

DoD Issues Proposed CMMC Rule For Contractors

Greenberg Traurig
Greenberg Traurig
Contributor
Greenberg Traurig

Greenberg Traurig

Greenberg Traurig, LLP has approximately 3,200 lawyers across 51 locations in the United States,...

View firm profile
Explore more from Greenberg Traurig

On Dec. 26, 2023, DoD published a proposed rule implementing the CMMC Program (the Proposed Rule). The regulations come more than three years after the release of the initial CMMC regulations (November 2020)...

United StatesGovernment, Public Sector
Go-To Guide:
  • If the Department of Defense (DoD)'s Proposed Rule is finalized, solicitations for defense contracts would, in most cases, assign a Cybersecurity Maturity Model Certification (CMMC) level and require a cybersecurity assessment for contractors to be eligible for contract award.
  • Organizations holding Federal Contract Information (FCI) would be required to self-assess annually against 15 cybersecurity controls in NIST SP 800-171 rev. 2 and mandated by FAR 52.204-21.
  • Organizations holding Controlled Unclassified Information (CUI) would, at a minimum, be required to self-assess every three years against the 110 controls in NIST SP 800-171 rev. 2. Some organizations would be required to obtain a third-party assessment of compliance with the 110 controls in NIST SP 800-171 rev. 2. Others may be required to obtain Level 3 CMMC Certifications for information systems holding sensitive CUI. The Level 3 certification is completed by DoD and

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

See more popular content from