Summary and dates.
Publication and effective dates
What the rule codifies
32 CFR Part 170 establishes the three CMMC levels (Level 1 / 2 / 3), the assessment types associated with each level (self-assessment for Level 1, third-party assessment for Level 2 conducted by an authorized C3PAO for most contracts, and government-led assessment for Level 3), and the program governance structure.
Level 2 alignment is to the 110 security requirements in NIST SP 800-171 Rev. 2, with the associated assessment objectives in NIST SP 800-171A.
What the rule does not do
The Program rule itself does not amend DFARS contract clauses. The companion DFARS amendment (proposed under DFARS Case 2019-D041) handles the contract-level implementation. Until that DFARS amendment becomes effective, CMMC requirements do not automatically appear in new solicitations.
Sources and citations.
- Federal Register — CMMC Program final rule (15 Oct 2024)
- DoD CIO — CMMC program page
- NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems
- NIST SP 800-171A — Assessment objectives
DBIT Defense does not interpret control intent or republish substantive control text. All claims above link to primary sources for verification.
Related insights.
CMMC phased rollout: Phase 1 through Phase 4
DoD has published a four-phase rollout schedule for CMMC, beginning when the DFARS implementation rule becomes effective and ramping over three years. The phase…
The C3PAO ecosystem: who they are, where they are
Authorized CMMC Third Party Assessment Organizations (C3PAOs) conduct Level 2 certification assessments. The Cyber-AB maintains the authoritative marketplace li…
NIST SP 800-171: Rev. 2 vs Rev. 3
NIST published Revision 3 of SP 800-171 in May 2024. The CMMC Program rule (32 CFR Part 170) currently references Revision 2 as the underlying control catalog. …
DFARS 252.204-7012: history and current applicability
DFARS 252.204-7012 — "Safeguarding Covered Defense Information and Cyber Incident Reporting" — has been in DoD contracts since 2015 and remains the underlying a…