DoD Issues The Final Rule For The CMMC Program In Advance Of The Transition To A New Administration

In an earlier alert, Taft discussed some of the higher-level details of the DoD's Oct. 15, 2024, Final Rule for the program requirements of the forthcoming Cybersecurity Maturity Model Certification (CMMC). Below are a few more specifics on what contractors that will be seeking the CMMC can expect in the new standard:

• Record-Keeping Requirements: Though the Rule is clear that Contracting Officers do not have to review anything used as evidence for a CMMC assessment and must instead focus only on the resulting scores and certificate validity period, contractors receiving a certification must retain such "artifacts" for the duration of the validity period of the certificate of assessment, and at minimum, for six years from the date of certification assessment. The Rule expanded this requirement to apply even to Level 1 and Level 2-type self-assessments. It also stated that it is up to the certified entity to determine the best way to ensure artifact