The comment period for the CMMC rule is over and we have the finalized version of the CMMC rule. With an effective date of December 14th 2024, CMMC is just about upon us. There were approximately 361 public comments submitted in response to the proposed 32 CFR part 170 CMMC Program rule. We’ll quickly go over some of the most important responses and what changes to the rule were or weren’t made in response.
Unsurprisingly, there were many comments related to the mandate that Cloud Service Offerings used to process, store, or transmit Controlled Unclassified Information be FedRAMP Moderate Equivalent. The CMMC Program rule was updated to reflect the DoD CIO Policy memo on FedRAMP Moderate equivalency and those requirements were deemed beyond the scope of the CMMC Program rule to review or revise.
There seems to have been sufficient concerns about the timeline for the initial rollout of the CMMC Program that DoD has made updates to the timeline in response. In the final rule, the timeline for Phase 1 of the 4 phase rollout is now 1 year. Extending the period by 6 months and allowing more time to prepare for Phase 2 to begin. This may further frustrate C3PAOs as it means Level 2 C3PAO assessments won’t be required for contract award for another year. However for contractors, this likely buys them a little bit of breathing room if they were behind on their NIST 800-171 implementation. Still, it is well past time for alignment to NIST 800-171 and if you have DFARS 252.204-7012 in your contracts and are not adhering to NIST 800-171 you are violating the terms of that contract. In response to several questions unsure about how to determine the applicable assessment type for each contract, DoD clarified that each contract solicitation will specify the required CMMC level and assessment. The agency further refused recommendations to more clearly delineate between Level 2 Self Assessment and Level 2 Certification Assessments stating that the differing assessments are based on government identified risk.
Since the proposed final rule was unveiled many contractors have had questions about the process for receiving waivers to exclude CMMC requirements from contract requirements. While the DoD did respond to these questions, they did not further elaborate on CMMC waivers as there is no official process in the CMMC Program rule. Any waivers will be subject to DoD internal policies and procedures and will be provided in limited circumstances by Service or Component Acquisition Executives in the DoD. Receiving a waiver to CMMC requirements would only remove the requirement to achieve certification. It does not remove the obligation to meet the applicable cybersecurity and information security requirements.
One clarification to the scoping of assets will certainly change the calculations on how to proceed for many organizations. DoD clarified that the use of Virtual Desktop Infrastructure (VDI) that is “…configured to not allow any processing, storage, or transmission of CUI beyond the Keyboard/Video/Mouse sent to the VDI client…” removes that asset from scope. This is a huge development as it can significantly shrink the pool of assets that are within scope if leveraged correctly. Additionally, if the underlying infrastructure is owned by the Organization Seeking Assessment and their ESP only uses the VDI client to engage with the system, that ESP can be considered out of scope and will not be required to meet CMMC requirements. This may require some MSP to change their practices, but can potentially significantly lower the burden for smaller ESPs and contractors to continue their business relationships.
While the flow down requirement for subcontractors has been a point of contention for years, DoD did little to clarify their role in enforcement of flow down. The prime contractor will always be responsible for making sure that subcontractors are maintaining the relevant security requirements and necessary certification levels. Subcontractor certifications will be visible in the SPRS, but prime and sub relationships might not be established at time of contract award. The prime must determine the flow down requirements based on whether any CUI or FCI is shared with the subcontractor. DoD was quite hostile to the suggestion made by commenters that requirements should be modified for subcontractors and cited that these requirements have been in place with FAR clause 52.204-21 and DFARS clause 252.204-7012 for over 7 years.
When the proposed rule was released much of the attention was drawn to the burdens placed on Cloud Service Providers and External Service Providers to meet the requirements to provide services to contractors subject to CMMC requirements. DoD accepts that there will likely be insufficient capacity of ESPs and CSOs initially, but believes that the market will scale appropriately and chooses to not make changes to the requirements in the interim. This will likely be a source of headaches for many medium sized contractors as it will be common for a contractor’s established ESP to not be prepared or willing to navigate the CMMC process. This will lead to tough conversations and choices for all involved as the market realigns.
