The Defense Department and Office of Management and Budget have announced that the proposed Cybersecurity Maturity Model Certification (CMMC) rule will be released in September. Originally expected in June, the release was delayed, but a recent update on the OMB’s website now confirms the September release date.
CMMC aims to enhance cybersecurity in the defense industry by moving away from self-attestations for compliance with National Institute of Standards and Technology (NIST) guidelines. Instead, third-party assessors will audit contractors for compliance with NIST-Standard 800-171, ensuring the protection of controlled but unclassified data on industry networks.
An important milestone indicating progress is that the OMB received the proposed rule on July 24, allowing for OMB’s review. Once officially released, there will be a public comment period, during which the Defense Department will collect and respond to comments. This process is expected to add at least six months, possibly extending into 2024, before a final rule is established.
The CMMC rule has faced multiple delays as the DOD refines its approach, transitioning to a longer proposed rulemaking process. Initially, it was anticipated that CMMC would be introduced as an interim final rule, which would become final within 60 days. However, the decision to pursue a proposed rule indicates that the DOD considers this rule to be significant and warrants a more comprehensive comment and feedback process.
The industry has eagerly awaited the CMMC rule, with some companies proceeding with CMMC plans while others adopt a wait-and-see approach. In the meantime, the DOD has allowed third-party assessors certified by Cyber AB, an industry group, to conduct joint assessments with the Defense Industry Base Cybersecurity Assessment Center. These assessments, conducted through the Joint Surveillance Voluntary Assessment program, validate compliance with NIST 800-171 and are expected to align with CMMC Level 2 once the rule is finalized.