On Dec. 26, 2023, the U.S. Department of Defense released a proposed rule and guidance documents implementing the Cybersecurity Maturity Model Certification 2.0 Program.

As proposed, CMMC 2.0 would require federal contractors and subcontractors competing for DOD contracts to demonstrate continued compliance with a range of cybersecurity measures to maintain eligibility for performing and winning new federal awards.

The new requirements would apply to all contractors and subcontractors that process, store or transmit information on contractor servers that meet the standards for Federal Contract Information or Controlled Unclassified Information. Requirements vary from a self-assessment of compliance with cybersecurity measures to triennial assessment and certification of compliance by third-party contractors or the DOD, dependent on the data involved in a specific contract.

More than 200,000 companies in the defense industrial base could be affected by the rule.

The Pentagon is planning for a phased implementation. It intends to include CMMC requirements in all solicitations issued on or after Oct. 1, 2026, when applicable, although waivers could be issued in certain cases before solicitations are issued.

Experts expect aspects of this rule to be eventually implemented by additional federal agencies as well as state and local governments.

On Jan. 25, 2023, ABC hosted a webinar, “Cybersecurity Maturity Model Requirements for ABC Members Doing Federal Work,” with two cybersecurity experts who provided practical tips and best practices for businesses to assess their cybersecurity readiness in advance of complying with CMMC 2.0. Additional information and resources are available on ABC’s Cybersecurity Resource Guide website.

Comments on the proposed rule are due to the DOD by Feb. 26.

To inform ABC’s comments on the proposal, ABC members are encouraged to submit feedback to Michael Altman at [email protected].

In the interim, ABC will continue to review the proposed rule and plans to provide additional analysis for ABC member DOD contractors.