The Department of Defense’s CMMC 2.0

The Department of Defense’s CMMC 2.0 program rule was published on December 26th, 2023 in the Federal Register. This kicked off a 60-day comment period on the Title 32 Rule. The Title 48 Rule should be published in March 2024, and we expect CMMC to be in contracts during the fourth quarter of 2024 or the first quarter of 2025. This will be a phased-in approach with an increasing percentage of new contracts over three years containing the CMMC language. 

A question that has come up is about NIST SP 800-171 R3. Currently, DFARS 252.204-7012 requires the contract holder to adhere to NIST SP 800-171 but does not specify which version. The current CMMC rule specifies R2. This will have to be worked out in the future. 

The rule seems to specify that Prime Contractors will be held accountable to ensure that all their subcontractors and their subcontractors, etc., hold the applicable CMMC certification. So, subcontractors can expect more pressure and inquiries from their primes. 

The rule also seems to specify that contracting companies’ MSP will need to be certified as CMMC Level 2 or Level 3 before the contracting company is assessed. This is an area where we expect many comments to be made during this comment period. 

The DoD estimates that only 5% of companies will be able to self-assess. This means an external audit will be necessary to help companies prepare for CMMC certification. Needling Worldwide’s experienced auditors are ready to provide the support your company needs while preparing for this necessary process.