CMMC DFARS 7021 Proposed Rule Published

The CMMC Title 48 DFARS 7021 proposed rule (DFARS Case 2019-D041) was published on 8/15/2024!

The proposed rule includes items, but the most notable is the modification of 𝗗𝗙𝗔𝗥𝗦 𝟮𝟱𝟮.𝟮𝟬𝟰-𝟳𝟬𝟮𝟭 which is the contractual clause that will require CMMC compliance/certification!

This proposed rule also adds a new DFARS provision titled 𝗗𝗙𝗔𝗥𝗦 𝟮𝟱𝟮.𝟮𝟬𝟰-𝟳𝗬𝗬𝗬, “Notice of Cybersecurity Maturity Model Certification Level Requirements.”

This provision (the “7YYY” is a placeholder) will be added into DoD solicitations and will let prospective contractors know what CMMC level will be required to win the contract.

This provision is very similar to DFARS 252.204-7019, “Notice of NISTSP 800-171 DoD Assessment Requirements,” which among other things requires the submission of a NIST 800-171 SPRS score to be eligible for contract award.

So what does this mean you ask?

The CMMC Title 32 program proposed rule was released in December of 2023. DoD just sent the final version to OIRA for review. Once the CMMC program rule is finalized, CMMC assessments can begin. The final rule should be published later this year.

Once this DFARS 7021 rule is finalized, DoD will begin to include CMMC requirements in contracts starting the 3-year phase in period.

The following video describes CMMC’s phase in strategy:

Need help on your CMMC journey? We offer CMMC training for defense contractors!

I’m also a VP of Cyber at a small defense contractor. I packaged what I learned over the years into comprehensive CMMC courses focused on the DIB!

• CMMC Overview Training (for practitioners)
• CMMC Awareness Training (for executives / managers)

If you are just starting your CMMC journey, don’t kno