CMMC Update - Part 2(a) - New Interim Rule
Ken Bloch, Director, Maine PTAC

When I wrote the first part of this last month, my plan was to write about the process of getting certified. Life has a way of messing with plans, though, and something more important came up in the meantime. I’ll give you the certification information in a future article. The big news is that DoD has finally issued a proposed rule change to implement CMMC and it could take effect as soon as November.
 
On September 29th, DoD issued an Interim Rule to the Defense Federal Acquisition Rules (DFARS) and opened it for public comment. As an Interim, rather than a Draft Interim, it will go into effect on November 30th, unless significant adverse public comments are received. Among other things, the rule creates three new DFARS clauses; two related to NIST 800-171 Assessments (giving the existing rules extra teeth) and 252-204.7021 providing the contractual basis for CMMC.
 
We’ve done a preliminary review of the proposed rule and it indicates the following:
  • CMMC certification will be required at award, not at bid or after award
  • If you have an approved 800-171 assessment, you will not need to get a CMMC assessment
  • CMMC won’t just magically appear in contracts. Until September 30th 2025 it will have to be approved by DoD for inclusion in any contract
  • CMMC will not apply for procurements of exclusively Commercial Off-The-Shelf (COTS) items
 
The rule provides estimated costs as well. For example, DoD estimates that a Level 1 assessment will cost around $3,000 every three years. The rule also confirms that Level 1 will be the most common level required, with 60% of Primes and Subs to only need Level 1 (and another 10% needing Level 2).
 
In the next month’s installment of this I’ll discuss the process to get certified. In the meantime, do NOT sign up with any company that tells you that they can certify you. That is coming, but its not here yet, so save your money.
 
Questions on CMMC? Please reach out to your local counselor or any of us with your questions or to request assistance. Maine PTAC will be ready to help you. Oh, and stay safe and wash your hands!