Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

New York

Washington, D.C.

core/separator

core/heading

core/list

The Department of Defense (DOD) issued a <a href="https://www.federalregister.gov/documents/2024/08/15/2024-18110/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of">proposed rule</a> on August 16 addressing the agency’s implementation of the Cybersecurity Maturity Model Certification (CMMC) 2.0 program, which requires contractors to adhere to cybersecurity standards to protect certain types of unclassified information through the defense supply chain.

contentpilot/introduction

As background, two categories of federal rules will govern the CMMC program: (i) the “comprehensive and scalable assessment mechanisms” underlying the creation of the CMMC program, which are subject to <a href="https://www.federalregister.gov/documents/2023/12/26/2023-27280/cybersecurity-maturity-model-certification-cmmc-program">pending regulations issued December 26, 2023</a>, and (ii) the rule proposed on August 16, 2024, addressing contract clauses to be included within defense contracts, which incorporate the CMMC program rule. Specifically, this more recent proposed rule imposes specific requirements on both agencies and contractors regarding CMMC compliance and creates a three-year timetable for implementation.

core/paragraph

The proposed rule amends the DOD Federal Acquisition Regulation Supplement (DFARS) regulations, and it requires contractors to demonstrate at the time of contract award, either through a current CMMC certificate or self-assessment, compliance with the CMMC level mandated in the solicitation. Under the revised regulations, before awarding a contract or exercising an option, the agency must verify that the CMMC compliance results are posted in the Supplier Performance Risk System (SPRS) for each DOD unique identifier (UID) and that the apparently successful offeror affirms continuous compliance with the applicable security requirements.

The proposed rule includes a new DFARS clause that specifies that the agency must notify contractors of the CMMC level required by the solicitation. The DFARS clause also specifies the proof of CMMC compliance that the offeror must post in SPRS: (i) offerors must post CMMC Level 1 and 2 self-assessments in SPRS; (ii) third-party assessment organizations must post CMMC Level 2 certificate assessments in SPRS; and (iii) the DOD assessor must post CMMC Level 3 certificate in SPRS. The proposed rule further includes prescriptive DFARS language notifying apparently successful offerors that they will not be eligible for an award if they do not have the results of CMMC compliance posted in SPRS and do not affirm their continuous compliance with the applicable security requirements.

The proposed rule amends DFARS 252.204-7021, governing CMMC requirements, to several obligations upon contractors:

The proposed rule sets forth a phased roll-out process lasting three years following the issuance of the final rule. During the three-year phase-in period, the CMMC requirements would apply only to the extent a solicitation or contract requires a contractor to maintain a specified CMMC level. After the phase-in period, the CMMC requirements would apply to all contracts that require the contractor to process, transmit, or store CUI or FCI during performance.

Comments on the proposed rule are due by October 15, 2024.

<em>This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.</em>

<em>This document may be considered attorney advertising in some jurisdictions.</em>

https://admin.thompsonhine.com/wp-content/uploads/2024/09/DOD-Proposes-Rule-for-Implementing-Cybersecurity-Maturity-Model-Certification-2.0-Program.pdf

DOD Proposes Rule for Implementing Cybersecurity Maturity Model Certification 2.0 Program

Services