Department Of Defense Publishes Final Rule On Cybersecurity Maturity Model Certification

On October 15, 2024, the Department of Defense (DoD) published the long-anticipated first part of its final rule (the Final Rule) for the Cybersecurity Maturity Model Certification (CMMC) program. After the implementation of the entire program, the CMMC program and accompanying regulations will attach a minimum cybersecurity requirement to almost all DoD contracts. The specific tiered Level of cyber security requirements for a contract will vary depending on the sensitivity of the information handled under the contract. The program will require third-party verification for contractors working with controlled unclassified information (CUI) confirming that contractors are meeting existing DoD cybersecurity standards and a self-assessment by contractors that have Federal Contract Information (FCI) showing that they are in compliance with the 15 controls in Federal Acquisition Regulation (FAR) 52.204-21.