Alert: CMMC Program's Companion DFARSÂ Rule Sent to OMB for Final Review
- Joshua Duvall
- Jul 23
- 2 min read
Yesterday, the Department of Defense ("DOD") submitted its final rule, Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041), to the Office of Management and Budget ("OMB") for final review. DOD's final rule is the Department's companion rule to its Cybersecurity Maturity Model Certification ("CMMC") program regulation, which became effective in December 2024 (discussed here).
Briefly, when finalized, the Assessing Contractor Implementation of Cybersecurity Requirements rule will amend the Defense Federal Acquisition Regulation Supplement ("DFARS") to incorporate the contractual requirements for DOD's CMMC program. Importantly, the submission of the DFARS rule to OMB marks a significant milestone in the evolution of the CMMC program because once the companion DFARS rule takes effect, the first phase of the CMMC program rollout will officially begin. See 32 C.F.R. § 170.3.
Section 170.3 provides as follows:
Phase 1. Begins on the effective date of the complementary 48 CFR part 204 CMMC Acquisition final rule. DoD intends to include the requirement for CMMC Statuses of Level 1 (Self) or Level 2 (Self) for all applicable DoD solicitations and contracts as a condition of contract award. DoD may, at its discretion, include the requirement for CMMC Status of Level 1 (Self) or Level 2 (Self) for applicable DoD solicitations and contracts as a condition to exercise an option period on a contract awarded prior to the effective date. DoD may also, at its discretion, include the requirement for CMMC Status of Level 2 (C3PAO) in place of the Level 2 (Self) CMMC Status for applicable DoD solicitations and contracts.
Takeaway
The submission of DOD's companion DFARS rule to OMB means that the CMMC program requirements are right around the corner. Indeed, we expect that the DFARS rule likely will be published in the Federal Register as early as late summer or early fall (possibly before the new Fiscal Year). In light of this recent development, defense contractors – large and small – should take notice and plan accordingly.
. . .
