.svg)
Cybersecurity experts have been advising companies looking to work on contracts with the Department of Defense (DoD) to expedite their CMMC compliance activities, and a new development has accelerated the need for decisive action. In this article, we will explain the latest status of CMMC compliance requirements on DoD contracts and discuss why your small business should already be taking the necessary steps toward CMMC compliance.
CMMC Background
CMMC, the Cybersecurity Maturity Model Certification Program, was first introduced in 2020 to give companies involved in the DoD’s supply chain guidance on how to optimally protect unclassified information. The implementation of Title 32 of the Code of Federal Regulations (CFR) on December 16, 2024, resulted in the replacement of CMMC 1.0 with CMMC 2.0.
CMMC 2.0 is now the framework and certification that assesses information systems for compliance with security standards published by the National Institute of Standards and Technology (NIST).
The CMMC Rule Has Entered the Final Review Process
The next important milestone has been reached in the area of CMMC compliance: the CMMC Rule under 48 CFR has officially moved into the Office of Management and Budget’s (OMB) final regulatory review process. CMMC is now in the final stage where CMMC compliance will immediately become a contractual requirement for companies involved in DoD contracts.
One crucial difference in the review process for the final CMMC Rule under 48 CFR from the 32 CFR Rule is that the OMB has deemed the changes in 48 CFR to be “not financially significant.” This critical distinction means that the final 48 CFR Rule will have no required 60-day waiting period like the 32 CFR Rule did. This designation means that as soon as the 48 CFR Rule is published, the enforceable CMMC compliance requirements will take effect.
Because there will be no waiting period, security and government contracting experts are estimating that the final 48 CFR Rule could go into effect as early as October 2025 and by the end of 2025 at the latest.
Your Company and CMMC Preparation
As we have discussed in previous articles, there have already been important changes with the replacement of CMMC 1.0 with CMMC 2.0. The main changes in CMMC 2.0 were trimming CMMC compliance levels from five to three for clarity and a greater focus by CMMC assessors on seeing companies prove CMMC maturity as opposed to merely passing temporary requirements.
As a result of the heightened CMMC requirements, your company should already be almost finished with your System Security Plan (SSP), and you should have already engaged in an internal review of your NIST 800-171 controls to meet CMMC Level 1 requirements. The requirements for CMMC Level 2 and Level 3 will be increasingly difficult to reach, but attaining CMMC Level 1 will provide the necessary framework to achieve these more advanced compliance levels.
Working with a CMMC expert to help you in the preliminary CMMC phases would have been advisable, but at the current and upcoming stages it is a necessity if you want to meet CMMC compliance requirements.
The Availability of CMMC Assessors Will Be Reduced
Time is even more of the essence as CMMC compliance requirements are rapidly becoming mandatory, and there are not enough accredited CMMC 2.0 assessors, known as C3PAOs, available to perform the required audits and grant CMMC certifications. The latest development involving CMMC Rule under 48 CFR will serve as a dramatic wake-up call for many companies, which will result in even more limited availability for accredited C3PAOs.
Work with a CMMC Expert
To meet the challenges of CMMC compliance, we recommend you work closely with a CMMC Registered Practitioner Organization (RPO), like Network Depot, who has the CMMC expertise to guide you through the assessment process.
Your trusted RPO will conduct a CMMC gap assessment and will construct a Plan of Action and Milestones (POAM) that will lay out specific remediation steps and timelines for addressing the security issues found during the assessment. Your CMMC partner will also assign the right personnel to complete tasks and draw up a realistic budget for the entire process.
Working with a dependable RPO like Network Depot will enable your company to quickly address any security issues and assist you in achieving a successful CMMC assessment on the first attempt.
After attaining the important IT security compliance credential of CMMC, your organization will be able to freely participate on DoD contracts and work effectively and securely on all your projects.
