32 CFR Part 170: Difference between revisions

From CMMC Toolkit Wiki
Jump to navigation Jump to search
(Importing content from PDF File: https://www.govinfo.gov/content/pkg/FR-2024-10-15/pdf/2024-22905.pdf)
 
No edit summary
Line 1: Line 1:
= PART 170—CYBERSECURITY MATURITY MODEL CERTIFICATION (CMMC) PROGRAM =


 
== Subpart A—General Information ==
 
Sec.
 
170.1 Purpose.
'''83092 '''
170.2 Incorporation by reference.
 
170.3 Applicability.
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
170.4 Acronyms and definitions.
 
170.5 Policy.
1
 
[http://www.federalregister.gov/citation/75-FR-68675 ''www.federalregister.gov/citation/75-FR-68675 '']
 
(November 4, 2010).
 
2
 
[http://www.federalregister.gov/citation/75-FR-707 ''www.federalregister.gov/citation/75-FR-707 '']
 
(December 29, 2009).
 
3
 
[http://www.govinfo.gov/link/uscode/42/2011 ''www.govinfo.gov/link/uscode/42/2011, et seq. '']
 
4
 
[http://www.federalregister.gov/documents/2020/09/29/2020-21123/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of ''www.federalregister.gov/documents/2020/09/ '']
 
[http://www.federalregister.gov/documents/2020/09/29/2020-21123/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of ''29/2020-21123/defense-federal-acquisition- <br />
regulation-supplement-assessing-contractor- <br />
implementation-of. '']
 
5
 
[http://www.federalregister.gov/documents/2024/08/15/2024-18110/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of ''www.federalregister.gov/documents/2024/08/ '']
 
[http://www.federalregister.gov/documents/2024/08/15/2024-18110/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of ''15/2024-18110/defense-federal-acquisition- <br />
regulation-supplement-assessing-contractor- <br />
implementation-of. '']
 
6
 
[http://www.sprs.csd.disa.mil/ ''www.sprs.csd.disa.mil/ '']under OMB control
 
number 0750–0004.
 
'''DEPARTMENT OF DEFENSE '''
 
'''Office of the Secretary '''
 
'''32 CFR Part 170 '''
 
'''[Docket ID: DoD–2023–OS–0063] '''
 
'''RIN 0790–AL49 '''
 
'''Cybersecurity Maturity Model <br />
Certification (CMMC) Program '''
 
'''AGENCY'''
 
''': '''
 
Office of the Department of
 
Defense Chief Information Officer (CIO), <br />
Department of Defense (DoD). <br />
'''ACTION'''
 
''': '''
 
Final rule.
 
'''SUMMARY'''
 
''': '''
 
With this final rule, DoD
 
establishes the Cybersecurity Maturity <br />
Model Certification (CMMC) Program in <br />
order to verify contractors have <br />
implemented required security <br />
measures necessary to safeguard Federal <br />
Contract Information (FCI) and <br />
Controlled Unclassified Information <br />
(CUI). The mechanisms discussed in <br />
this rule will allow the Department to <br />
confirm a defense contractor or <br />
subcontractor has implemented the <br />
security requirements for a specified <br />
CMMC level and is maintaining that <br />
status (meaning level and assessment <br />
type) across the contract period of <br />
performance. This rule will be updated <br />
as needed, using the appropriate <br />
rulemaking process, to address evolving <br />
cybersecurity standards, requirements, <br />
threats, and other relevant changes. <br />
'''DATES'''
 
''': '''
 
This rule is effective December
 
16, 2024. The incorporation by reference <br />
of certain material listed in this rule is <br />
approved by the Director of the Federal <br />
Register as of December 16, 2024. <br />
'''FOR FURTHER INFORMATION CONTACT'''
 
''': '''
 
Ms.
 
Diane Knight, Office of the DoD CIO at <br />
[mailto:osd.pentagon.dod-cio.mbx.cmmc-inquiries@mail.mil ''osd.pentagon.dod-cio.mbx.cmmc- <br />
inquiries@mail.mil '']or 202–770–9100. <br />
'''SUPPLEMENTARY INFORMATION'''
 
''': '''
 
'''History of the Program '''
 
The beginnings of CMMC start with
 
the November 2010, Executive Order <br />
(E.O.) 13556,1 ''Controlled Unclassified <br />
Information. ''The intent of this Order <br />
was to ‘‘establish an open and uniform <br />
program for managing [unclassified] <br />
information that requires safeguarding <br />
or dissemination controls.’’ Prior to this <br />
E.O., more than 100 different markings <br />
for this information existed across the <br />
executive branch. This ad hoc, agency- <br />
specific approach created inefficiency <br />
and confusion, led to a patchwork <br />
system that failed to adequately <br />
safeguard information requiring
 
protection, and unnecessarily restricted <br />
information-sharing.
 
As a result, the E.O. established the
 
CUI Program to standardize the way the <br />
executive branch handles information <br />
requiring safeguarding or dissemination <br />
controls (excluding information that is <br />
classified under E.O. 13526, Classified <br />
National Security Information 2 or any <br />
predecessor or successor order; or the <br />
Atomic Energy Act of 1954,3 as <br />
amended).
 
In 2019, DoD announced the
 
development of CMMC in order to move <br />
away from a ‘‘self-attestation’’ model of <br />
security. It was first conceived by the <br />
Office of the Under Secretary of Defense <br />
for Acquisition and Sustainment <br />
(OUSD(A&amp;S)) to secure the Defense <br />
Industrial Base (DIB) sector against <br />
evolving cybersecurity threats. In <br />
September 2020, DoD published the 48 <br />
CFR CMMC interim final rule, ''Defense <br />
Federal Acquisition Regulation <br />
Supplement (DFARS): Assessing <br />
Contractor Implementation of <br />
Cybersecurity Requirements ''(DFARS <br />
Case 2019–D041 85 FR 48513, <br />
September 9, 2020),4 which <br />
implemented the DoD’s vision for the <br />
initial CMMC Program and outlined the <br />
basic features of the framework (tiered <br />
model of practices and processes, <br />
required assessments, and <br />
implementation through contracts) to <br />
protect FCI and CUI. The 48 CFR CMMC <br />
interim final rule became effective on 30 <br />
November 2020, establishing a five-year <br />
phase-in period. In response to <br />
approximately 750 public comments on <br />
the 48 CFR CMMC interim final rule, in <br />
March 2021, the Department initiated an <br />
internal review of CMMC’s <br />
implementation.
 
In November 2021, the Department
 
announced the revised CMMC Program, <br />
an updated program structure and <br />
requirements designed to achieve the <br />
primary goals of the internal review:
 
• Safeguard sensitive information to
 
enable and protect the warfighter
 
• Enforce DIB cybersecurity standards
 
to meet evolving threats
 
• Ensure accountability while
 
minimizing barriers to compliance <br />
with DoD requirements
 
• Perpetuate a collaborative culture of
 
cybersecurity and cyber resilience
 
• Maintain public trust through high
 
professional and ethical standards <br />
The revised CMMC Program has three
 
key features:
 
• ''Tiered Model: ''CMMC requires
 
companies entrusted with Federal <br />
contract information and controlled <br />
unclassified information to implement <br />
cybersecurity standards at progressively <br />
advanced levels, depending on the type <br />
and sensitivity of the information. The <br />
program also describes the process for <br />
requiring protection of information <br />
flowed down to subcontractors.
 
• ''Assessment Requirement: ''CMMC
 
assessments allow the Department to <br />
verify the implementation of clear <br />
cybersecurity standards.
 
• ''Phased Implementation: ''Once
 
CMMC rules become effective, certain <br />
DoD contractors handling FCI and CUI <br />
will be required to achieve a particular <br />
CMMC level as a condition of contract <br />
award. CMMC requirements will be <br />
implemented using a 4-phase <br />
implementation plan over a three-year <br />
period.
 
'''Current Status of the CMMC Program '''
 
Separate from this rulemaking, DoD
 
has a proposed acquisition rule (48 CFR <br />
part 204 CMMC Acquisition rule) to <br />
amend the Defense Federal Acquisition <br />
Regulation Supplement (DFARS) to <br />
address procurement related <br />
considerations and requirements related <br />
to this program rule (32 CFR part 170 <br />
CMMC Program rule). The 48 CFR part <br />
204 CMMC Acquisition rule also <br />
partially implements a section of the <br />
National Defense Authorization Act for <br />
Fiscal Year 2020 directing the Secretary <br />
of Defense to develop a consistent, <br />
comprehensive framework to enhance <br />
cybersecurity for the U.S. defense <br />
industrial base.5 The 48 CFR part 204 <br />
CMMC Acquisition rule, when <br />
finalized, will allow DoD to require a <br />
specific CMMC level in a solicitation or <br />
contract. When CMMC requirements are <br />
applied to a solicitation, Contracting <br />
officers will not make award, exercise <br />
an option, or extend the period of <br />
performance on a contract, if the offeror <br />
or contractor does not have the passing <br />
results of a current certification <br />
assessment or self-assessment for the <br />
required CMMC level, and an <br />
affirmation of continuous compliance <br />
with the security requirements in the <br />
Supplier Performance Risk System <br />
(SPRS) 6 for all information systems that <br />
process, store, or transmit FCI or CUI <br />
during contract performance. <br />
Furthermore, the appropriate CMMC <br />
certification requirements will flow <br />
down to subcontractors at all tiers when
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00002
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83093 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
7
 
[http://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting ''www.acquisition.gov/dfars/252.204-7012- '']
 
[http://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting ''safeguarding-covered-defense-information-and- <br />
cyber-incident-reporting. '']
 
8
 
[http://www.acquisition.gov/dfars/252.204-7020-nist-sp-800-171dod-assessment-requirements ''www.acquisition.gov/dfars/252.204-7020-nist- '']
 
[http://www.acquisition.gov/dfars/252.204-7020-nist-sp-800-171dod-assessment-requirements ''sp-800-171dod-assessment-requirements. '']
 
9
 
Required since November 2016, NIST SP 800–
 
171 R2 security requirement 3.12.4 states
 
organizations must ‘‘develop, document, and <br />
periodically update system security plans that <br />
describe system boundaries, system environments <br />
of operation, how security requirements are <br />
implemented, and the relationships with or <br />
connections to other systems.’’
 
10
 
[https://media.defense.gov/2024/Mar/28/2003424523/-1/-1/1/DOD_DOB_CS_STRATEGY_DSD_SIGNED_20240325.PDF ''https://media.defense.gov/2024/Mar/28/ '']
 
[https://media.defense.gov/2024/Mar/28/2003424523/-1/-1/1/DOD_DOB_CS_STRATEGY_DSD_SIGNED_20240325.PDF ''2003424523/-1/-1/1/DOD'']
 
[https://media.defense.gov/2024/Mar/28/2003424523/-1/-1/1/DOD_DOB_CS_STRATEGY_DSD_SIGNED_20240325.PDF _''DOB''_''CS''_''STRATEGY''_]
 
[https://media.defense.gov/2024/Mar/28/2003424523/-1/-1/1/DOD_DOB_CS_STRATEGY_DSD_SIGNED_20240325.PDF ''DSD'']
 
[https://media.defense.gov/2024/Mar/28/2003424523/-1/-1/1/DOD_DOB_CS_STRATEGY_DSD_SIGNED_20240325.PDF _''SIGNED''_''20240325.PDF. '']
 
the subcontractor processes, stores, or <br />
transmits FCI or CUI. It should be noted <br />
the Department may include CMMC <br />
requirements on contracts awarded <br />
prior to 48 CFR part 204 CMMC <br />
Acquisition rule becoming effective, but <br />
doing so will require bilateral contract <br />
modification after negotiations.
 
To date, the DoD has relied on offeror
 
representation that the security <br />
requirements of National Institute of <br />
Standards and Technology (NIST) <br />
Special Publication (SP) 800–171, <br />
‘‘''Protecting Controlled Unclassified <br />
Information in Nonfederal Systems and <br />
Organizations''’’ have been met, as <br />
described by 48 CFR 252.204–7008. In <br />
some instances, the DoD has verified <br />
contractor implementation of NIST SP <br />
800–171 through assessment by the <br />
Defense Contract Management Agency <br />
(DCMA) Defense Industrial Base <br />
Cybersecurity Assessment Center <br />
(DIBCAC). As part of this responsibility, <br />
DCMA DIBCAC assesses DIB companies <br />
to ensure they are meeting contractually <br />
required cybersecurity standards and to <br />
ensure contractors have the ability to <br />
protect CUI for government contracts <br />
they are awarded. DCMA DIBCAC <br />
conducts NIST SP 800–171 assessments <br />
in support of 48 CFR 252.204–7012 <br />
(DFARS clause 252.204–7012), <br />
''Safeguarding Covered Defense <br />
Information and Cyber Incident <br />
Reporting,''7 and 48 CFR 252.204–7020 <br />
(DFARS clause 252.204–7020), ''NIST SP <br />
800–171 DoD Assessment <br />
Requirements.''8 The DCMA DIBCAC <br />
prioritization process is designed to <br />
adjust as DoD’s cyber priorities evolve <br />
based on ongoing threats. DCMA <br />
DIBCAC collects and analyzes data on <br />
DoD contractors to include:
 
• Mission critical programs,
 
technologies, and infrastructure and the <br />
contractors (prime or lower tier) that <br />
support DoD capabilities.
 
• Cyber threats, vulnerabilities, or
 
incidents.
 
• DoD Leadership requests.
 
To date, DCMA DIBCAC has assessed
 
357 entities including DoD’s major <br />
prime contractors. In accordance with <br />
NIST SP 800–171, titled ‘‘''Protecting <br />
Controlled Unclassified Information in <br />
Nonfederal Systems and <br />
Organizations,''’’ Revision 2, February <br />
2020 (includes updates as of January 28, <br />
2021) (NIST SP 800–171 R2), <br />
contractors must describe in a System <br />
Security Plan (SSP) 9 how the security
 
requirements are met or how the <br />
organizations plan to meet the <br />
requirements and address known and <br />
anticipated threats. In the event <br />
companies cannot establish full <br />
compliance, they must develop plans of <br />
action that describe how <br />
unimplemented security requirements <br />
will be met and how any planned <br />
mitigations will be implemented. <br />
Although an explicit time limit for <br />
mitigation is not specified in NIST SP <br />
800–171 R2, contractors that fail to <br />
reasonably comply with applicable <br />
requirements may be subject to standard <br />
contractual remedies. The CMMC <br />
Program’s assessment phase-in plan, as <br />
described in § 170.3, does not preclude <br />
entities from immediately seeking a <br />
CMMC certification assessment prior to <br />
the 48 CFR part 204 CMMC Acquisition <br />
rule being finalized and the clause being <br />
added to new or existing DoD contracts.
 
The Department estimates 8350
 
medium and large entities will be <br />
required to meet CMMC Level 2 C3PAO <br />
assessment requirements as a condition <br />
of contract award. CMMC Level 2 <br />
requirements will apply to all <br />
contractors that process, store, or <br />
transmit CUI, and will provide DoD <br />
with a means to assess that CUI <br />
safeguarding requirements prescribed in <br />
32 CFR part 2002 have been met. DoD <br />
estimates 135 CMMC Third-Party <br />
Assessment Organization (C3PAO)-led <br />
certification assessments will be <br />
completed in the first year, 673 C3PAO <br />
certification assessments in year 2, <br />
2,252 C3PAO certification assessments <br />
in year 3, and 4,452 C3PAO certification <br />
assessments in year four.
 
Any DoD component can request
 
DCMA DIBCAC to initiate an <br />
assessment and these requests will take <br />
priority in the assessment scheduling <br />
process. Once identified for assessment, <br />
DCMA DIBCAC determines the <br />
assessment date and notifies the <br />
company to begin the pre-assessment <br />
process. Typically, planning and <br />
scheduling takes place 3 to 6 months in <br />
advance of a DCMA DIBCAC assessment <br />
to allow DCMA DIBCAC and the DIB <br />
company time to prepare, however, <br />
DoD’s identified priorities may expedite <br />
the execution of an assessment. As <br />
discussed in more detail in the <br />
regulatory text, assessment results are <br />
reported to DoD, including key <br />
stakeholders via SPRS and made <br />
available to the DIB company. Please see <br />
the DCMA DIBCAC website at
 
[http://www.dcma.mil/DIBCAC/ ''www.dcma.mil/DIBCAC/ '']that includes <br />
links to the pre-assessment documents; <br />
a publicly releasable version of the <br />
assessment database; FAQs; an <br />
informational video; a link to <br />
Procurement Integrated Enterprise <br />
Environment (PIEE), the primary <br />
enterprise procure-to-pay application <br />
for the DoD; a link to SPRS where <br />
assessment scores are posted; and links <br />
to other reference materials.
 
As discussed in more detail later in
 
the regulatory text, all requirements that <br />
are scored as NOT MET are identified in <br />
a Plan of Action and Milestones <br />
(POA&amp;M) to meet the CMMC <br />
requirement. Organizations Seeking <br />
Assessment (OSAs) satisfy the CMMC <br />
requirements needed for contract award <br />
by successfully meeting all 110 security <br />
requirements of NIST SP 800–171 R2 or <br />
by receiving a Conditional CMMC <br />
Status when achieving the minimum <br />
passing score of 80 percent and only <br />
including permittable NOT MET <br />
requirements as described in § 170.21 <br />
on the POA&amp;M. All requirements that <br />
were scored ‘‘NOT MET’’ and placed on <br />
the POA&amp;M must be remedied within <br />
180 days of receiving their Conditional <br />
CMMC Status. Proper implementation <br />
of these requirements must be verified <br />
by a second assessment, called a <br />
POA&amp;M closeout assessment. If the <br />
POA&amp;M closeout assessment finds that <br />
all requirements have been met, then <br />
the OSA will achieve a CMMC Status of <br />
Final Level 2 (Self) or Final Level 2 <br />
(C3PAO) as applicable. However, if the <br />
POA&amp;M closeout assessment does not <br />
validate all requirements have been met <br />
by the end of the 180 days, then the <br />
CMMC Status of Conditional Level 2 <br />
(Self) or Conditional Level 2 (C3PAO) <br />
will expire and at this point, standard <br />
contractual remedies will apply for any <br />
current contract.
 
DoD has created a series of guidance
 
documents to assist organizations in <br />
better understanding the CMMC <br />
Program and the assessment process and <br />
scope for each CMMC level. These <br />
guidance documents are available on <br />
[https://dodcio.defense.gov/CMMC/Documentation/ the DoD CMMC website at ''https://<br />
dodcio.defense.gov/CMMC/ <br />
Documentation/ '']and on the DoD Open <br />
Government website at [https://open.defense.gov/Regulatory-Program/Guidance-Documents/ ''https://<br />
open.defense.gov/Regulatory-Program/ <br />
Guidance-Documents/. '']The CMMC <br />
Program has also been incorporated in <br />
the Department’s 2024 Defense <br />
Industrial Base Cybersecurity Strategy.10 <br />
The strategy requires the Department to <br />
coordinate and collaborate across <br />
components to identify and close gaps
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00003
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83094 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
11
 
[http://www.govinfo.gov/content/pkg/FR-2020-12-21/pdf/2020-27698.pdf ''www.govinfo.gov/content/pkg/FR-2020-12-21/ '']
 
[http://www.govinfo.gov/content/pkg/FR-2020-12-21/pdf/2020-27698.pdf ''pdf/2020-27698.pdf''). ]
 
12
 
[http://www.dcsa.mil/Industrial-Security/National-Industrial-Security-Program-Oversight/32-CFR-Part-117-NISPOM-Rule/ ''www.dcsa.mil/Industrial-Security/National- '']
 
[http://www.dcsa.mil/Industrial-Security/National-Industrial-Security-Program-Oversight/32-CFR-Part-117-NISPOM-Rule/ ''Industrial-Security-Program-Oversight/32-CFR-Part- <br />
117-NISPOM-Rule/. '']
 
13
 
[http://www.acquisition.gov/far/52.204-21 ''www.acquisition.gov/far/52.204-21. '']
 
14
 
[http://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting ''www.acquisition.gov/dfars/252.204-7012- '']
 
[http://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting ''safeguarding-covered-defense-information-and- <br />
cyber-incident-reporting. '']
 
15
 
Required since November 2016, NIST SP 800–
 
171 R2 security requirement 3.12.4 states <br />
organizations must ‘‘develop, document, and <br />
periodically update system security plans that <br />
describe system boundaries, system environments <br />
of operation, how security requirements are <br />
implemented, and the relationships with or <br />
connections to other systems.’’
 
16
 
[http://www.sprs.csd.disa.mil/ ''www.sprs.csd.disa.mil/ '']under OMB control
 
number 0750–0004.
 
17
 
The plan of action requirement described under
 
DFARS clause 252.204–7020 is different from a <br />
Plan of Action and Milestones (POA&amp;M) <br />
requirement in CMMC as plans of action do not <br />
require milestones.
 
18
 
[http://www.federalregister.gov/documents/2020/09/29/2020-21123/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of ''www.federalregister.gov/documents/2020/09/ '']
 
[http://www.federalregister.gov/documents/2020/09/29/2020-21123/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of ''29/2020-21123/defense-federal-acquisition- <br />
regulation-supplement-assessing-contractor- <br />
implementation-of. '']
 
19
 
[http://www.acq.osd.mil/asda/dpc/cp/cyber/docs/safeguarding/NIST-SP-800-171-Assessment-Methodology-Version-1.2.1-6.24.2020.pdf ''www.acq.osd.mil/asda/dpc/cp/cyber/docs/ '']
 
[http://www.acq.osd.mil/asda/dpc/cp/cyber/docs/safeguarding/NIST-SP-800-171-Assessment-Methodology-Version-1.2.1-6.24.2020.pdf ''safeguarding/NIST-SP-800-171-Assessment- <br />
Methodology-Version-1.2.1-6.24.2020.pdf. '']
 
in protecting DoD networks, supply <br />
chains, and other critical resources. <br />
Other prongs of the Department’s <br />
cybersecurity strategy are described in <br />
the Department’s National Industrial <br />
Security Program Operating Manual <br />
(NISPOM) which address <br />
implementation of the Security <br />
Executive Agent Directive (SEAD) 3 11 <br />
procedures for the protection and <br />
reproduction of classified information; <br />
controlled unclassified information <br />
(CUI); National Interest Determination <br />
(NID) requirements for cleared <br />
contractors operating under a Special <br />
Security Agreement for Foreign <br />
Ownership, Control, or Influence; and <br />
eligibility determinations for personnel <br />
security clearance processes and <br />
requirements.12
 
'''Overview of Revised CMMC Program '''
 
'''Current Requirements for Defense <br />
Contractors and Subcontractors '''
 
Currently, Federal contracts
 
(including defense contracts) involving <br />
the transfer of FCI to a non-Government <br />
organization follow the requirements <br />
specified in 48 CFR 52.204–21 (Federal <br />
Acquisition Regulation (FAR) clause <br />
52.204–21), ''Basic Safeguarding of <br />
Covered Contractor Information <br />
Systems.''13 FAR clause 52.204–21 <br />
requires compliance with 15 security <br />
requirements, FAR clause 52.204–21 <br />
(b)(1), items (i) through (xv). These <br />
requirements are the minimum <br />
necessary for any entity wishing to <br />
receive FCI from the US Government <br />
(USG).
 
Defense contracts involving the
 
development or transfer of CUI to a non- <br />
Government organization require <br />
applicable requirements of DFARS <br />
clause 252.204–7012.14 This clause <br />
requires defense contractors to provide <br />
adequate security on all covered <br />
contractor information systems by <br />
implementing the 110 security <br />
requirements specified in NIST SP 800– <br />
171. This clause includes additional <br />
requirements; for example, defense <br />
contractors must confirm that any Cloud <br />
Service Providers (CSPs) used by the <br />
contractor to handle CUI meet Federal <br />
Risk and Authorization Management <br />
Program (FedRAMP) Moderate Baseline <br />
or the equivalent requirements. It also <br />
requires defense contractors to flow <br />
down all the requirements to their
 
subcontractors who process, store, or <br />
transmit CUI. The CMMC Program <br />
currently does not include any <br />
requirements for contractors operating <br />
systems on behalf of the DoD.
 
To comply with DFARS clause
 
252.204–7012, contractors are required <br />
to develop a SSP 15 detailing the policies <br />
and procedures their organization has in <br />
place to comply with NIST SP 800–171. <br />
The SSP serves as a foundational <br />
document for the required NIST SP <br />
800–171 self-assessment. To comply <br />
with 48 CFR 252.204–7019 (DFARS <br />
provision 252.204–7019) and DFARS <br />
clause 252.204–7020, self-assessment <br />
scores must be submitted.16 The highest <br />
score is 110, meaning all 110 NIST SP <br />
800–171 security requirements have <br />
been fully implemented. If a contractor’s <br />
Supplier Performance Risk System <br />
(SPRS) score is less than 110, indicating <br />
security gaps exist, then the contractor <br />
must create a plan of action 17 <br />
identifying security tasks that still need <br />
to be accomplished. In essence, an SSP <br />
describes the cybersecurity plan the <br />
contractor has in place to protect CUI. <br />
The SSP needs to address each NIST SP <br />
800–171 security requirement and <br />
explain how the requirement is <br />
implemented. This can be through <br />
policy, technology, or a combination of <br />
both.
 
In November 2020, the DoD released
 
its 48 CFR CMMC interim final rule, the <br />
''Defense Federal Acquisition Regulation <br />
Supplement: Assessing Contractor <br />
Implementation of Cybersecurity <br />
Requirements ''18 (DFARS Case 2019– <br />
D041, 85 FR 61505, November 30, <br />
2020). The goal of this rule was to <br />
increase compliance with its <br />
cybersecurity regulations and improve <br />
security throughout the DIB. This rule <br />
introduced one new provision and two <br />
new clauses—DFARS provision <br />
252.204–7019, DFARS clause 252.204– <br />
7020, and 48 CFR 252.204–7021 <br />
(DFARS clause 252.204–7021).
 
• DFARS provision 252.204–7019
 
complements DFARS clause 252.204–
 
7012 by requiring contractors to have a <br />
NIST SP 800–171 assessment (basic, <br />
medium, or high) according to NIST SP <br />
800–171 DoD Assessment <br />
Methodology.19 Assessment scores must <br />
be reported to the Department via SPRS. <br />
SPRS scores must be submitted by the <br />
time of contract award and not be more <br />
than three years old.
 
• DFARS clause 252.204–7020
 
notifies contractors that DoD reserves <br />
the right to conduct a higher-level <br />
assessment of contractors’ cybersecurity <br />
compliance, and contractors must give <br />
DoD assessors full access to their <br />
facilities, systems, and personnel. <br />
Further, DFARS clause 252.204–7020 <br />
complements DFARS clause 252.204– <br />
7012’s flow down requirements by <br />
holding contractors responsible for <br />
confirming their subcontractors have <br />
SPRS scores on file prior to awarding <br />
them contracts.
 
• DFARS clause 252.204–7021 paves
 
the way for rollout of the CMMC <br />
Program. Once CMMC is implemented, <br />
the required CMMC Level and <br />
assessment type will be specified in the <br />
solicitation and resulting contract. <br />
Contractors handling FCI or CUI will be <br />
required to meet the CMMC requirement <br />
specified in the contract. DFARS clause <br />
252.204–7021 also stipulates contractors <br />
will be responsible for flowing down the <br />
CMMC requirements to their <br />
subcontractors.
 
'''CFR Part 170'''
 
'''Additional '''
 
'''Requirements for Defense Contractors <br />
and Subcontractors Discussed in This <br />
Final Rule '''
 
When this 32 CFR part 170 CMMC
 
Program rule and the complementary 48 <br />
CFR part 204 CMMC Acquisition rule <br />
are finalized and following a phased <br />
implementation plan, solicitations and <br />
resulting defense contracts involving the <br />
processing, storing, or transmitting of <br />
FCI or CUI on a non-Federal system <br />
will, unless waived, have a CMMC level <br />
and assessment type requirement that a <br />
contractor must meet to be eligible for <br />
a contract award. The four phases of the <br />
implementation plan add CMMC level <br />
requirements incrementally, starting in <br />
Phase 1 with self-assessments, and <br />
ending in Phase 4, which represents full <br />
implementation of program <br />
requirements. The DoD elected to base <br />
the phase-in plan on the level and type <br />
of assessment to provide time to train <br />
the necessary number of assessors, and <br />
to allow companies time to understand <br />
and implement CMMC requirements. <br />
Details of each phase are addressed in
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00004
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83095 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
§ 170.3(e). In Phases 2 and 3, DoD will <br />
implement CMMC Level 2 and Level 3 <br />
certification requirements, respectively. <br />
At full implementation (Phase 4), DoD
 
will include CMMC requirements in all <br />
applicable DoD contracts and option <br />
periods on contracts awarded after the <br />
beginning of Phase 4.
 
Table 1 defines the requirements for
 
each CMMC level and assessment type.
 
TABLE 1—CMMC LEVEL AND ASSESSMENT REQUIREMENTS
 
CMMC status
 
Source &amp; number of security
 
reqts.
 
Assessment reqts.
 
Plan of action &amp; milestones
 
(POA&amp;M) reqts.
 
Affirmation reqts.
 
Level 1 (Self) ...
 
• 15 required by FAR clause
 
52.204–21.
 
• Conducted by Organization Seeking As-
 
sessment (OSA) annually.
 
• Results entered into SPRS (or its suc-
 
cessor capability).
 
• Not permitted ........................ • After each assessment.
 
• Entered into SPRS.
 
Level 2 (Self) ...
 
• 110 NIST SP 800–171 R2 re-
 
quired by DFARS clause <br />
252.204–7012.
 
• Conducted by OSA every 3 years ............
 
• Results entered into SPRS (or its suc-
 
cessor capability).
 
• CMMC Status will be valid for three years
 
from the CMMC Status Date as defined in <br />
§ 170.4.
 
• Permitted as defined in
 
§ 170.21(a)(2) and must be <br />
closed out within 180 days.
 
• Final CMMC Status will be
 
valid for three years from the <br />
Conditional CMMC Status <br />
Date.
 
• After each assessment and
 
annually thereafter.
 
• Assessment will lapse upon
 
failure to annually affirm.
 
• Entered into SPRS (or its
 
successor capability).
 
Level 2
 
(C3PAO).
 
• 110 NIST SP 800–171 R2 re-
 
quired by DFARS clause <br />
252.204–7012.
 
• Conducted by C3PAO every 3 years ........
 
• Results entered into CMMC Enterprise
 
Mission Assurance Support Service <br />
(eMASS) (or its successor capability).
 
• CMMC Status will be valid for three years
 
from the CMMC Status Date as defined in <br />
§ 170.4.
 
• Permitted as defined in
 
§ 170.21(a)(2) and must be <br />
closed out within 180 days.
 
• Final CMMC Status will be
 
valid for three years from the <br />
Conditional CMMC Status <br />
Date.
 
• After each assessment and
 
annually thereafter.
 
• Assessment will lapse upon
 
failure to annually affirm.
 
• Entered into SPRS (or its
 
successor capability).
 
Level 3
 
(DIBCAC).
 
• 110 NIST SP 800–171 R2 re-
 
quired by DFARS clause <br />
252.204–7012.
 
• 24 selected from NIST SP
 
800–172 Feb2021, as de-<br />
tailed in table 1 to <br />
§ 170.14(c)(4).
 
• Pre-requisite CMMC Status of Level 2
 
(C3PAO) for the same CMMC Assess-<br />
ment Scope, for each Level 3 certification <br />
assessment.
 
• Conducted by Defense Contract Manage-
 
ment Agency (DCMA) Defense Industrial <br />
Base Cybersecurity Assessment Center <br />
(DIBCAC) every 3 years.
 
• Results entered into CMMC eMASS (or its
 
successor capability).
 
• CMMC Status will be valid for three years
 
from the CMMC Status Date as defined in <br />
§ 170.4.
 
• Permitted as defined in
 
§ 170.21(a)(3) and must be <br />
closed out within 180 days.
 
• Final CMMC Status will be
 
valid for three years from the <br />
Conditional CMMC Status <br />
Date.
 
• After each assessment and
 
annually thereafter.
 
• Assessment will lapse upon
 
failure to annually affirm.
 
• Level 2 (C3PAO) affirmation
 
must also continue to be <br />
completed annually.
 
• Entered into SPRS (or its
 
successor capability).
 
'''Program Walkthrough—Contractor <br />
Perspective '''
 
This section will provide a simplified
 
walkthrough of the CMMC Program <br />
from the perspective of an Organization <br />
Seeking Assessment (OSA) seeking to <br />
comply with program requirements.
 
'''CMMC Level Selection '''
 
An OSA will select the CMMC level
 
it desires to attain. Once the CMMC <br />
Program is implemented, a DoD <br />
solicitation will specify the minimum <br />
CMMC Status required to be eligible for <br />
award. One of four CMMC Statuses will <br />
be specified:
 
• Level 1 (Self) is a self-assessment to
 
secure FCI processed, stored, or <br />
transmitted in the course of fulfilling <br />
the contract. The OSA must comply <br />
with the 15 security requirements set by <br />
FAR clause 52.204–21. All 15 <br />
requirements must be met in full—no <br />
exceptions are allowed.
 
• Level 2 (Self) is a self-assessment to
 
secure CUI processed, stored, or <br />
transmitted in the course of fulfilling <br />
the contract. The OSA must comply <br />
with the 110 Level 2 security <br />
requirements derived from NIST SP <br />
800–171 R2.
 
• Level 2 (C3PAO) differs from Level
 
2 (Self) in the method of verifying <br />
compliance. OSAs must hire a C3PAO <br />
to conduct an assessment of the OSA’s <br />
compliance with the 110 security <br />
requirements of NIST SP 800–171 R2. <br />
OSAs can shop for C3PAOs on the <br />
CMMC Accreditation Body (AB) <br />
Marketplace.
 
• Level 3 (DIBCAC) is a government
 
assessment of 24 additional <br />
requirements derived from NIST SP <br />
800–172, titled ‘‘''Enhanced Security <br />
Requirements for Protecting Controlled <br />
Unclassified Information: A Supplement <br />
to NIST Special Publication 800–171,''’’ <br />
February 2021 (NIST SP 800–172 <br />
Feb2021). The OSA must ensure that <br />
they have already achieved a CMMC <br />
Status of Final Level 2 (C3PAO) before <br />
seeking CMMC Status of Final Level 3 <br />
(DIBCAC). Once this is done, an OSA <br />
should then initiate a Level 3 <br />
certification assessment by emailing a <br />
request to Defense Contract <br />
Management Agency (DCMA) Defense <br />
Industrial Base Cybersecurity <br />
Assessment Center (DIBCAC) point of <br />
[http://www.dcma.mil/DIBCAC contact found at ''www.dcma.mil/ <br />
DIBCAC'', being sure to include the Level <br />
]2 (C3PAO) certification unique <br />
identifier in the email.
 
'''Scoping '''
 
In order to achieve a specified CMMC
 
Status, OSAs must first identify which <br />
information systems, including systems <br />
or services provided by External Service <br />
Providers (ESPs), will process, store, or <br />
transmit FCI, for Level 1 (Self), and CUI <br />
for all other CMMC Statuses. These <br />
information systems constitute the <br />
scope of the assessment.
 
Within these information systems, for
 
Level 2 and Level 3 the assets should be <br />
further broken down into asset <br />
categories: Contractor Risk Managed <br />
Assets (Level 2), Security Protection <br />
Assets (Level 2 and 3), and Specialized <br />
Assets (Level 2 and 3). For Level 1 all <br />
assets, with the exclusion of Specialized <br />
Assets, are simply identified as either <br />
in-scope or out-of-scope based on <br />
whether they process, store, or transmit <br />
FCI. Definitions and treatment of these <br />
categories as they relate to assessment <br />
scoping, treatment of ESPs, and <br />
treatment of assets which cannot be <br />
secured due to their inherent design, <br />
can be found at § 170.19.
 
'''Assessment and Affirmation '''
 
a. OSAs that meet all 15 Level 1
 
requirements have achieved CMMC <br />
Status of Final Level 1 (Self). The OSA
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00005
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83096 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
must submit an affirmation of <br />
compliance with FAR clause 52.204–21 <br />
requirements in SPRS. At this point, <br />
OSAs have satisfied the CMMC <br />
requirements needed for award of <br />
contracts requiring a CMMC Status of <br />
Final Level 1 (Self). To maintain a <br />
CMMC Status of Final Level 1 (Self), <br />
this entire process must be repeated in <br />
full on an annual basis, including both <br />
self-assessment and affirmation.
 
b. For Level 2 assessments, if all 110
 
requirements are satisfied, the <br />
assessment score will be 110 and the <br />
OSA will have achieved a CMMC Status <br />
of Final Level 2 (Self) or Final Level 2 <br />
(C3PAO) as applicable and is eligible for <br />
contract award as long as all other <br />
contractual requirements are met.
 
Not all requirements must
 
immediately be MET to be eligible for <br />
contract award. If the minimum score is <br />
achieved on the assessment (equal to <br />
80% of the maximum score) and certain <br />
critical requirements are met, OSAs will <br />
achieve a CMMC Status of Conditional <br />
Level 2 (Self) or Conditional Level 2 <br />
(C3PAO) as applicable. All NOT MET <br />
requirements must be noted in an <br />
assessment Plan of Action and <br />
Milestones (POA&amp;M). At this point the <br />
OSA will have satisfied the CMMC <br />
requirements needed for contract award <br />
OSAs must have met all 110 security <br />
requirements of NIST SP 800–171 R2 <br />
within 180 days of receiving their <br />
Conditional CMMC Status, which must <br />
be verified with a second assessment, <br />
called a POA&amp;M closeout assessment. If <br />
the POA&amp;M closeout assessment finds <br />
that all requirements have been met, <br />
then the OSA will achieve a CMMC <br />
Status of Final Level 2 (Self) or Final <br />
Level 2 (C3PAO) as applicable. <br />
However, if a POA&amp;M closeout <br />
assessment does not find that all <br />
requirements have been met by the end <br />
of 180 days, then the CMMC Status of <br />
Conditional Level 2 (Self) or <br />
Conditional Level 2 (C3PAO) will <br />
expire. At this point, standard <br />
contractual remedies will apply.
 
The OSA should submit an
 
affirmation into SPRS after achieving a <br />
CMMC Status of Conditional Level 2
 
(Self) or CMMC Status of Conditional <br />
Level 2 (C3PAO) as applicable. OSAs <br />
should submit an affirmation once a <br />
CMMC Status of Final Level 2 (Self) or <br />
Final Level 2 (C3PAO) as applicable is <br />
achieved. Being eligible for contracts <br />
subject to CMMC Level 2 (Self) also <br />
indicates eligibility for contracts subject <br />
to Level 1 (Self), and being eligible for <br />
contracts subject to CMMC Level 2 <br />
(C3PAO) also indicates eligibility for <br />
contracts subject to Level 1 (Self) and <br />
Level 2 (Self), assuming all other <br />
contractual requirements are met. OSAs <br />
must reaffirm in SPRS their compliance <br />
with CMMC Level 2 requirements <br />
annually but need only conduct a new <br />
assessment every three years. These <br />
deadlines are based on the CMMC <br />
Status Date of the Conditional Status if <br />
a POA&amp;M was required or the Final <br />
Status if the assessment resulted in a <br />
score of 110. CMMC Status date is not <br />
based on the date of a POA&amp;M closeout <br />
assessment.
 
c. For Level 3 assessments, OSAs
 
should note that asset categories are <br />
assessed against security requirements <br />
differently than they are at Level 2. In <br />
particular, Contractor Risk Managed <br />
Assets identified in a Level 2 scope are <br />
treated as CUI Assets if they reside <br />
within a Level 3 scope. Definitions and <br />
treatment of these assets at Level 3 as <br />
they relate to scoping of the assessment, <br />
in addition to treatment of ESPs, are <br />
described in § 170.19(d).
 
During the course of assessment,
 
DCMA DIBCAC will focus on assessing <br />
compliance with all 24 selected <br />
requirements derived from NIST SP <br />
800–172 Feb2021, but limited checks <br />
may be performed on the 110 <br />
requirements from NIST SP 800–171 R2. <br />
If DCMA DIBCAC identifies that all 24 <br />
requirements from NIST SP 800–172 <br />
Feb2021 are satisfied, the OSA will have <br />
achieved a CMMC Status of Final Level <br />
3 (DIBCAC) and is eligible for contract <br />
award as long as all other contractual <br />
requirements are met. Not all <br />
requirements must immediately be MET <br />
to be eligible for contract award. If the <br />
minimum score is achieved on the <br />
assessment (equal to 80% of the
 
maximum score of 24) and certain <br />
critical requirements are met, OSAs will <br />
achieve a CMMC Status of Conditional <br />
Level 3 (DIBCAC), and all NOT MET <br />
requirements must be noted in a <br />
POA&amp;M. At this point the OSA will <br />
have satisfied the CMMC requirements <br />
needed for contract award.
 
OSAs must have met all 24 selected
 
security requirements of NIST SP 800– <br />
172 Feb2021 within 180 days of <br />
receiving their Conditional CMMC <br />
Status, which must be verified with a <br />
POA&amp;M closeout assessment by DCMA <br />
DIBCAC. If the POA&amp;M closeout <br />
assessment finds that all requirements <br />
have been met, then the OSA will <br />
achieve a CMMC Status of Final Level <br />
3 (DIBCAC). However, if a POA&amp;M <br />
closeout assessment does not find that <br />
all requirements have been met by the <br />
end of 180 days, then the CMMC Status <br />
of Conditional Level 3 (DIBCAC) will <br />
expire. At this point, standard <br />
contractual remedies will apply.
 
The OSA should submit an
 
affirmation into SPRS after achieving a <br />
CMMC Status of Conditional Level 3 <br />
(DIBCAC) if applicable and once a <br />
CMMC Status of Final Level 3 (DIBCAC) <br />
is achieved. Being eligible for contracts <br />
subject to CMMC Level 3 (DIBCAC) also <br />
indicates eligibility for contracts subject <br />
to Level 1 (Self), Level 2 (Self), and <br />
Level 2 (C3PAO), assuming all other <br />
contractual requirements are met. To <br />
maintain CMMC Level 3 (DIBCAC) <br />
status, an OSA must undergo both a <br />
Level 2 certification assessment ''and ''a <br />
Level 3 certification assessment every <br />
three years and separately affirm <br />
compliance with Level 2 and Level 3 <br />
requirements in SPRS annually. These <br />
deadlines are based on the CMMC <br />
Status Date of the Conditional <br />
certification if applicable or the CMMC <br />
Status Date of the Final determination. <br />
CMMC Status Date is not based on the <br />
date of a POA&amp;M closeout assessment.
 
'''Flow-Down '''
 
If the OSA employs subcontractors to
 
fulfill the contract, those subcontractors <br />
must also have a minimum CMMC <br />
Status as shown in table 2.
 
TABLE 2—MINIMUM FLOW-DOWN REQUIREMENTS
 
Prime contractor requirement
 
Minimum subcontractor requirement
 
If the subcontractor will process, store, or transmit
 
FCI CUI
 
Level 1 (Self) ......................................................
 
Level 1 (Self) ....................................................
 
N/A.
 
Level 2 (Self) ......................................................
 
Level 1 (Self) ....................................................
 
Level 2 (Self).
 
Level 2 (C3PAO) ................................................
 
Level 1 (Self) ....................................................
 
Level 2 (C3PAO).
 
Level 3 (DIBCAC) ...............................................
 
Level 1 (Self) ....................................................
 
Level 2 (C3PAO).
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00006
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83097 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
'''Summary of Provisions Contained in <br />
This Rule '''
 
''Section 170.1''
 
''Purpose ''
 
Section 170.1 addresses the purpose
 
of this rule. It describes the CMMC <br />
Program and establishes policy for <br />
requiring the protection of FCI and CUI <br />
that is processed, stored, or transmitted <br />
on defense contractor and subcontractor <br />
information systems. The security <br />
standards utilized in the CMMC <br />
Program are from the FAR clause <br />
52.204–21; DFARS clause 252.204–7012 <br />
that implements NIST SP 800–171 R2; <br />
and selected requirements from the <br />
NIST SP 800–172 Feb2021, as <br />
applicable. The purpose of the CMMC <br />
Program is for contractors and <br />
subcontractors to demonstrate that FCI <br />
and CUI being processed, stored, or <br />
transmitted is adequately safeguarded <br />
through the methodology provided in <br />
the rule.
 
''Section 170.2''
 
''Incorporation by ''
 
''Reference ''
 
Section 170.2 addresses the standards
 
and guidelines that are incorporated by <br />
reference. The Director of the Federal <br />
Register under 5 U.S.C. 552(a) and 1 <br />
CFR part 51 approves any materials that <br />
are incorporated by reference. Materials <br />
that are incorporated by reference in <br />
this rule are reasonably available. <br />
Information on how to access the <br />
documents is detailed in § 170.2. <br />
Materials that are incorporated by <br />
reference in this rule are from the NIST <br />
(see § 170.2(a)), the Committee on <br />
National Security Systems (see <br />
§ 170.2(b)), and the International <br />
Organization for Standardization/ <br />
International Electrotechnical <br />
Commission (ISO/IEC) (see § 170.2(c)) <br />
which may require payment of a fee.
 
'''Note: '''While the ISO/IEC standards are
 
issued jointly, they are available from the ISO <br />
Secretariat (see § 170.2(c)).
 
The ''American National Standards ''
 
''Institute (ANSI) ''IBR Portal provides <br />
access to standards that have been <br />
incorporated by reference in the U.S. <br />
Code of Federal Regulations at [https://ibr.ansi.org ''https:// <br />
ibr.ansi.org''. These standards <br />
]incorporated by the U.S. government in <br />
rulemakings are offered at no cost in <br />
‘‘read only’’ format and are presented <br />
for online reading. There are no print or <br />
download options. All users will be <br />
required to install the ''FileOpen plug-in <br />
''and accept an online end user license <br />
agreement prior to accessing any <br />
standards.
 
The materials that are incorporated by
 
reference are summarized below.
 
(a) Federal Information Processing
 
Standard (FIPS) Publication (PUB) 200
 
(FIPS PUB 200), titled ‘‘Minimum <br />
Security Requirements for Federal <br />
Information and Information Systems,’’ <br />
is the second of two security standards <br />
mandated by the Federal Information <br />
Security Management Act (FISMA). It <br />
specifies minimum security <br />
requirements for information and <br />
information systems supporting the <br />
executive agencies of the Federal <br />
government and a risk-based process for <br />
selecting the security controls necessary <br />
to satisfy the minimum-security <br />
requirements. This standard promotes <br />
the development, implementation, and <br />
operation of more secure information <br />
systems within the Federal Government <br />
by establishing minimum levels of due <br />
diligence for information security and <br />
facilitating a more consistent, <br />
comparable, and repeatable approach <br />
for selecting and specifying security <br />
controls for information systems that <br />
meet minimum security requirements. <br />
This document is incorporated by <br />
reference as a source for definitions.
 
(b) FIPS PUB 201–3, titled ‘‘Personal
 
Identity Verification (PIV) of Federal <br />
Employees and Contractors,’’ establishes <br />
a standard for a PIV system that meets <br />
the control and security objectives of <br />
Homeland Security Presidential <br />
Directive-12. It is based on secure and <br />
reliable forms of identity credentials <br />
issued by the Federal Government to its <br />
employees and contractors. These <br />
credentials are used by mechanisms that <br />
authenticate individuals who require <br />
access to federally controlled facilities, <br />
information systems, and applications. <br />
This Standard addresses requirements <br />
for initial identity proofing, <br />
infrastructure to support <br />
interoperability of identity credentials, <br />
and accreditation of organizations and <br />
processes issuing PIV credentials. This <br />
document is incorporated by reference <br />
as a source for definitions.
 
(c) NIST SP 800–37, titled ‘‘Risk
 
Management Framework for Information <br />
Systems and Organizations: A System <br />
Life Cycle Approach for Security and <br />
Privacy,’’ Revision 2 (NIST SP 800–37 <br />
R2), describes the Risk Management <br />
Framework (RMF) and provides <br />
guidelines for applying the RMF to <br />
information systems and organizations. <br />
The RMF provides a disciplined, <br />
structured, and flexible process for <br />
managing security and privacy risk that <br />
includes information security <br />
categorization; control selection, <br />
implementation, and assessment; <br />
system and common control <br />
authorizations; and continuous <br />
monitoring. The RMF includes activities <br />
to prepare organizations to execute the <br />
framework at appropriate risk <br />
management levels. The RMF also
 
promotes near real-time risk <br />
management and ongoing information <br />
system and common control <br />
authorization through the <br />
implementation of continuous <br />
monitoring processes; provides senior <br />
leaders and executives with the <br />
necessary information to make efficient, <br />
cost-effective, risk management <br />
decisions about the systems supporting <br />
their missions and business functions; <br />
and incorporates security and privacy <br />
into the system development life cycle. <br />
Executing the RMF tasks links essential <br />
risk management processes at the <br />
system level to risk management <br />
processes at the organization level. In <br />
addition, it establishes responsibility <br />
and accountability for the controls <br />
implemented within an organization’s <br />
information systems and inherited by <br />
those systems. This document is <br />
incorporated by reference as a source for <br />
definitions.
 
(d) NIST SP 800–39, titled ‘‘Managing
 
Information Security Risk: Organization, <br />
Mission, and Information System <br />
View,’’ March 2011 (NIST SP 800–39 <br />
Mar2011), provides guidance for an <br />
integrated, organization-wide program <br />
for managing information security risk <br />
to organizational operations (''i.e., <br />
''mission, functions, image, and <br />
reputation), organizational assets, <br />
individuals, other organizations, and the <br />
Nation resulting from the operation and <br />
use of Federal information systems. <br />
NIST SP 800–39 Mar2011 provides a <br />
structured, yet flexible approach for <br />
managing risk that is intentionally <br />
broad-based, with the specific details of <br />
assessing, responding to, and <br />
monitoring risk on an ongoing basis <br />
provided by other supporting NIST <br />
security standards and guidelines. The <br />
guidance provided in this publication is <br />
not intended to replace or subsume <br />
other risk-related activities, programs, <br />
processes, or approaches that <br />
organizations have implemented or <br />
intend to implement addressing areas of <br />
risk management covered by other <br />
legislation, directives, policies, <br />
programmatic initiatives, or mission/ <br />
business requirements. Rather, the risk <br />
management guidance described herein <br />
is complementary to and should be used <br />
as part of a more comprehensive <br />
Enterprise Risk Management (ERM) <br />
program. This document is incorporated <br />
by reference as a source for definitions.
 
(e) NIST SP 800–53, titled ‘‘Security
 
and Privacy Controls for Information <br />
Systems and Organizations,’’ Revision 5 <br />
(NIST SP 800–53 R5), provides a catalog <br />
of security and privacy controls for <br />
information systems and organizations <br />
to protect organizational operations and <br />
assets, individuals, other organizations,
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00007
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83098 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
and the Nation from a diverse set of <br />
threats and risks, including hostile <br />
attacks, human errors, natural disasters, <br />
structural failures, foreign intelligence <br />
entities, and privacy risks. The controls <br />
are flexible and customizable and <br />
implemented as part of an organization- <br />
wide process to manage risk. The <br />
controls address diverse requirements <br />
derived from mission and business <br />
needs, laws, executive orders, <br />
directives, regulations, policies, <br />
standards, and guidelines. Finally, the <br />
consolidated control catalog addresses <br />
security and privacy from a <br />
functionality perspective (''i.e., ''the <br />
strength of functions and mechanisms <br />
provided by the controls) and from an <br />
assurance perspective (''i.e., ''the measure <br />
of confidence in the security or privacy <br />
capability provided by the controls). <br />
Addressing functionality and assurance <br />
helps to ensure that information <br />
technology products and the systems <br />
that rely on those products are <br />
sufficiently trustworthy. This document <br />
is incorporated by reference as a source <br />
for definitions.
 
(f) NIST SP 800–82r3, titled ‘‘Guide to
 
Operational Technology (OT) Security,’’ <br />
September 2023 (NIST SP 800–82r3), <br />
provides guidance on how to secure <br />
ICS, including Supervisory Control and <br />
Data Acquisition (SCADA) systems, <br />
Distributed Control Systems (DCS), and <br />
other control system configurations <br />
such as Programmable Logic Controllers <br />
(PLC), while addressing their unique <br />
performance, reliability, and safety <br />
requirements. The document provides <br />
an overview of ICS and typical system <br />
topologies, identifies typical threats and <br />
vulnerabilities to these systems, and <br />
provides recommended security <br />
countermeasures to mitigate the <br />
associated risks. This document is <br />
incorporated by reference as a source for <br />
definitions.
 
(g) NIST SP 800–115, titled
 
‘‘Technical Guide to Information <br />
Security Testing and Assessment,’’ <br />
September 2008 (NIST SP 800–115 <br />
Sept2008), assists organizations in <br />
planning and conducting technical <br />
information security tests and <br />
examinations, analyzing findings, and <br />
developing mitigation strategies. The <br />
guide provides practical <br />
recommendations for designing, <br />
implementing, and maintaining <br />
technical information security test and <br />
examination processes and procedures. <br />
These can be used for several purposes, <br />
such as finding vulnerabilities in a <br />
system or network and verifying <br />
compliance with a policy or other <br />
requirements. The guide is not intended <br />
to present a comprehensive information <br />
security testing and examination
 
program but rather an overview of key <br />
elements of technical security testing <br />
and examination, with an emphasis on <br />
specific technical techniques, the <br />
benefits and limitations of each, and <br />
recommendations for their use. This <br />
document is incorporated by reference <br />
as a source for definitions.
 
(h) NIST SP 800–160, Volume 2, titled
 
‘‘Developing Cyber-Resilient Systems: A <br />
Systems Security Engineering <br />
Approach,’’ Revision 1, December 2021 <br />
(NIST SP 800–160 V2R1), focuses on <br />
cyber resiliency engineering—an <br />
emerging specialty systems engineering <br />
discipline applied in conjunction with <br />
systems security engineering and <br />
resilience engineering to develop <br />
survivable, trustworthy secure systems. <br />
Cyber resiliency engineering intends to <br />
architect, design, develop, implement, <br />
maintain, and sustain the <br />
trustworthiness of systems with the <br />
capability to anticipate, withstand, <br />
recover from, and adapt to adverse <br />
conditions, stresses, attacks, or <br />
compromises that use or are enabled by <br />
cyber resources. From a risk <br />
management perspective, cyber <br />
resiliency is intended to help reduce the <br />
mission, business, organizational, <br />
enterprise, or sector risk of depending <br />
on cyber resources. This document is <br />
incorporated by reference as a source for <br />
definitions.
 
(i) NIST SP 800–171, titled
 
‘‘Protecting Controlled Unclassified <br />
Information in Nonfederal Systems and <br />
Organizations,’’ Revision 2, February <br />
2020 (includes updates as of January 28, <br />
2021) (NIST SP 800–171 R2), provides <br />
agencies with recommended security <br />
requirements for protecting the <br />
confidentiality of CUI when the <br />
information is resident in nonfederal <br />
systems and organizations; when the <br />
nonfederal organization is not collecting <br />
or maintaining information on behalf of <br />
a Federal agency or using or operating <br />
a system on behalf of an agency; and <br />
where there are no specific safeguarding <br />
requirements for protecting the <br />
confidentiality of CUI prescribed by the <br />
authorizing law, regulation, or <br />
governmentwide policy for the CUI <br />
category listed in the CUI Registry. The <br />
requirements apply to all components of <br />
nonfederal systems and organizations <br />
that process, store, and/or transmit CUI, <br />
or that provide protection for such <br />
components. The security requirements <br />
are intended for use by Federal agencies <br />
in contractual vehicles or other <br />
agreements established between those <br />
agencies and nonfederal organizations. <br />
This document is incorporated by <br />
reference as a foundational source for <br />
definitions and security requirements.
 
(j) NIST SP 800–171A, titled
 
‘‘Assessing Security Requirements for <br />
Controlled Unclassified Information,’’ <br />
June 2018 (NIST SP 800–171A Jun2018), <br />
provides Federal and non-Federal <br />
organizations with assessment <br />
procedures and a methodology that can <br />
be employed to conduct assessments of <br />
the CUI security requirements in NIST <br />
SP 800–171 R2. The assessment <br />
procedures are flexible and can be <br />
customized to the needs of the <br />
organizations and the assessors <br />
conducting the assessments. Security <br />
assessments can be conducted as self- <br />
assessments; independent, third-party <br />
assessments; or government-sponsored <br />
assessments and can be applied with <br />
various degrees of rigor, based on <br />
customer-defined depth and coverage <br />
attributes. The findings and evidence <br />
produced during the security <br />
assessments can facilitate risk-based <br />
decisions by organizations related to the <br />
CUI requirements. This document is <br />
incorporated by reference as a <br />
foundational source for definitions and <br />
assessment.
 
(k) NIST SP 800–172, titled
 
‘‘Enhanced Security Requirements for <br />
Protecting Controlled Unclassified <br />
Information: A Supplement to NIST <br />
Special Publication 800–171,’’ February <br />
2021 (NIST SP 800–172 Feb2021), <br />
provides Federal agencies with <br />
recommended enhanced security <br />
requirements for protecting the <br />
confidentiality of CUI: (1) when the <br />
information is resident in nonfederal <br />
systems and organizations; (2) when the <br />
nonfederal organization is not collecting <br />
or maintaining information on behalf of <br />
a Federal agency or using or operating <br />
a system on behalf of an agency; and (3) <br />
where there are no specific safeguarding <br />
requirements for protecting the <br />
confidentiality of CUI prescribed by the <br />
authorizing law, regulation, or <br />
government-wide policy for the CUI <br />
category listed in the CUI Registry. The <br />
enhanced requirements apply only to <br />
components of nonfederal systems that <br />
process, store, or transmit CUI or that <br />
provide security protection for such <br />
components when the designated CUI is <br />
associated with a critical program or <br />
high value asset. The enhanced <br />
requirements supplement the basic and <br />
derived security requirements in NIST <br />
SP 800–171 R2 and are intended for use <br />
by Federal agencies in contractual <br />
vehicles or other agreements established <br />
between those agencies and nonfederal <br />
organizations. This document is <br />
incorporated by reference as a <br />
foundational source for security <br />
requirements.
 
(l) NIST SP 800–172A, titled
 
‘‘Assessing Enhanced Security
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00008
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83099 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
Requirements for Controlled <br />
Unclassified Information,’’ March 2022 <br />
(NIST SP 800–172A Mar2022), provides <br />
Federal agencies and nonfederal <br />
organizations with assessment <br />
procedures that can be used to carry out <br />
assessments of the requirements in NIST <br />
SP 800–172 Feb2021. The assessment <br />
procedures are flexible and can be <br />
tailored to the needs of organizations <br />
and assessors. Assessments can be <br />
conducted as (1) self-assessments; (2) <br />
independent, third-party assessments; <br />
or (3) government-sponsored <br />
assessments. The assessments can be <br />
conducted with varying degrees of rigor <br />
based on customer-defined depth and <br />
coverage attributes. The findings and <br />
evidence produced during the <br />
assessments can be used to facilitate <br />
risk-based decisions by organizations <br />
related to the CUI enhanced security <br />
requirements. This document is <br />
incorporated by reference as a <br />
foundational source for definitions and <br />
assessment.
 
(m) ISO/IEC 17011:2017(E), titled
 
‘‘Conformity assessment—Requirements <br />
for accreditation bodies accrediting <br />
conformity assessment bodies,’’ Second <br />
edition, November 2017 (ISO/IEC <br />
17011:2017(E)), specifies requirements <br />
for the competence, consistent operation <br />
and impartiality of accreditation bodies <br />
assessing and accrediting conformity <br />
assessment bodies. This document is <br />
incorporated by reference as a source for <br />
requirements on the CMMC Ecosystem.
 
(n) ISO/IEC 17020:2012(E), titled
 
‘‘Conformity assessment—Requirement <br />
for the operation of various types of <br />
bodies performing inspection,’’ Second <br />
edition, March 1, 2012 (ISO/IEC <br />
17020:2012(E)), specifies requirements <br />
for the competence of bodies performing <br />
inspection and for the impartiality and <br />
consistency of their inspection <br />
activities. It applies to inspection bodies <br />
of type A, B or C, as defined in ISO/IEC <br />
17020:2012(E), and it applies to any <br />
stage of inspection.’’ This document is <br />
incorporated by reference as a source for <br />
requirements on the CMMC Ecosystem.
 
(o) ISO/IEC 17024:2012(E), titled
 
‘‘Conformity assessment—General <br />
requirements for bodies operating <br />
certification of persons,’’ Second <br />
edition, July 1, 2012 (ISO/IEC <br />
17024:2012(E)), contains principles and <br />
requirements for a body certifying <br />
persons against specific requirements <br />
and includes the development and <br />
maintenance of a certification scheme <br />
for persons.’’ This document is <br />
incorporated by reference as a source for <br />
requirements on the CMMC Ecosystem.
 
''Section 170.3''
 
''Applicability ''
 
Section 170.3 identifies entities to
 
which the rule applies and how the <br />
Department intends to implement the <br />
rule. The rule applies to defense <br />
contractors and subcontractors that will <br />
process, store, or transmit FCI or CUI in <br />
performance of a DoD contract, and <br />
private-sector businesses or other <br />
entities that are specified in Subpart C. <br />
This rule does not apply to Federal <br />
information systems operated by <br />
contractors and subcontractors in <br />
support of the Government. CMMC <br />
Program requirements apply to DoD <br />
solicitations and contracts requiring <br />
defense contractors and subcontractors <br />
to process, store, or transmit FCI or CUI. <br />
Exceptions to the applicability of this <br />
rule are addressed in § 170.3(c)(1) and <br />
(2). Department Program Managers or <br />
requiring activities will determine <br />
which CMMC Level and assessment <br />
type will apply to a contract or <br />
procurement. Applicability of the <br />
required CMMC Level and assessment <br />
type to subcontractors is addressed in <br />
§ 170.23.
 
Section 170.3 addresses the four-
 
phased implementation plan of the <br />
CMMC Program requirements in <br />
solicitations and contracts. Phase 1 <br />
begins on the effective date of this <br />
CMMC 32 CFR part 170 CMMC Program <br />
rule or the complementary 48 CFR part <br />
204 CMMC Acquisition rule, whichever <br />
occurs later. More information regarding <br />
Phase 1 can be found in § 170.3(e)(1). <br />
Phase 2 begins one calendar year after <br />
the start date of Phase 1. More <br />
information regarding Phase 2 can be <br />
found in § 170.3(e)(2). Phase 3 begins <br />
one calendar year after the start date of <br />
Phase 2. More information regarding <br />
Phase 3 can be found in § 170.3(e)(3). <br />
Phase 4, or full implementation, begins <br />
one calendar year after the start date of <br />
Phase 3. More information regarding <br />
Phase 4 can be found in § 170.3(e)(4).
 
''Section 170.4''
 
''Acronyms and ''
 
''Definitions ''
 
Section 170.4 includes acronyms and
 
definitions used in the rule text and can <br />
be used as a reference while reading the <br />
text and tables. CMMC introduces new <br />
terms and associated definitions, and <br />
customizes definitions for existing <br />
terms, as applied to the CMMC Program. <br />
CMMC-custom terms and definitions are <br />
clearly marked to distinguish from <br />
terms sourced externally. CMMC also <br />
utilizes terms created by other <br />
authoritative sources, including NIST. <br />
Terms from other authoritative sources <br />
are also listed in § 170.4 and are <br />
properly sourced.
 
The Department developed the
 
following CMMC-custom terms to <br />
enhance understanding of the <br />
requirements and elements of the <br />
CMMC Program: <br />
• Accreditation
 
• Accreditation Body
 
• Affirming Official
 
• Assessment
 
• Level 1 self-assessment
 
• Level 2 self-assessment
 
• Level 2 certification assessment
 
• Level 3 certification assessment
 
• POA&amp;M closeout self-assessment
 
• POA&amp;M closeout certification
 
assessment
 
• Assessment Findings Report
 
• Assessment Team
 
• Asset Categories
 
• Authorized
 
• Cloud Service Provider
 
• CMMC Assessment and Certification
 
Ecosystem
 
• CMMC Assessment Scope
 
• CMMC Assessor and Instructor
 
Certification Organization (CAICO)
 
• CMMC instantiation of eMASS
 
• CMMC Status
 
• Final Level 1 (Self)
 
• Conditional Level 2 (Self)
 
• Final Level 2 (Self)
 
• Conditional Level 2 (C3PAO)
 
• Final Level 2 (C3PAO)
 
• Conditional Level 3 (DIBCAC)
 
• Final Level 3 (DIBCAC)
 
• CMMC Status Date
 
• CMMC Third-Party Assessment
 
Organization (C3PAO)
 
• Contractor Risk Managed Assets
 
• Controlled Unclassified Information
 
(CUI) Assets
 
• Enduring Exception
 
• External Service Provider (ESP)
 
• Operational plan of action
 
• Organization-defined
 
• Organization Seeking Assessment
 
(OSA)
 
• Organization Seeking Certification
 
(OSC)
 
• Out-of-Scope Assets
 
• Periodically
 
• Process, store, or transmit
 
• Restricted Information Systems
 
• Security Protection Assets
 
• Security Protection Data
 
• Specialized Assets
 
• Temporary Deficiency
 
• Test Equipment. <br />
''Section 170.5''
 
''Policy ''
 
Section 170.5 addresses the policy
 
underlying the rule. The protection of <br />
FCI and CUI on defense contractor <br />
information systems is crucial to the <br />
continuity of the missions and functions <br />
of the DoD. To that end, this rule <br />
requires that contractors and <br />
subcontractors implement the specified <br />
security requirements for the applicable
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00009
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83100 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
20
 
[http://www.iso.org/standard/67198.html ''www.iso.org/standard/67198.html''. ]
 
21
 
[http://www.iso.org/standard/52993.html ''www.iso.org/standard/52993.html''. ]
 
22
 
This system is accessible only to authorized
 
users.
 
CMMC Level. For CMMC Level 3, the <br />
selected security requirements are <br />
defined in NIST SP 800–172 Feb2021 <br />
with the applicable DoD Organization- <br />
Defined Parameters (ODPs) defined in <br />
table 1 to § 170.14(c)(4).
 
Program Managers and requiring
 
activities identify the applicable CMMC <br />
Level and assessment type. Factors used <br />
to determine which CMMC Level and <br />
assessment type will be applied are <br />
included but not limited to the list <br />
found in § 170.5(b)(1–5). CMMC <br />
Program requirements will flow down to <br />
subcontractors, as applicable (see <br />
§ 170.23). A DoD Service Acquisition <br />
Executive or a Component Acquisition <br />
Executive may elect to waive inclusion <br />
of CMMC Program requirements in a <br />
solicitation or contract.
 
Section 170.5 addresses that the
 
CMMC Program does not alter the <br />
requirements imposed on contractors <br />
and subcontractors in FAR clause <br />
52.204–21, DFARS clause 252.204– <br />
7012, or any other applicable <br />
safeguarding of information <br />
requirement. The CMMC Program <br />
verifies implementation of security <br />
requirements in FAR clause 52.204–21, <br />
NIST SP 800–171 R2, and selected <br />
security requirements in NIST SP 800– <br />
172 Feb2021, as applicable.
 
''Section 170.6''
 
''CMMC PMO ''
 
Section 170.6 addresses the CMMC
 
Program Management Office (PMO) <br />
functions that are performed within the <br />
Department of Defense Chief <br />
Information Officer (DoD CIO).
 
''Section 170.7''
 
''DCMA DIBCAC ''
 
Section 170.7 addresses how DCMA
 
DIBCAC will support the CMMC <br />
Program by conducting CMMC Level 2 <br />
certification assessments of the <br />
Accreditation Body and C3PAOs; <br />
conducting CMMC Level 3 certification <br />
assessments for OSCs; and recording <br />
results, issuing certificates, tracking <br />
appeals, and retaining records as <br />
required.
 
''Section 170.8''
 
''Accreditation Body ''
 
Section 170.8 addresses the roles and
 
responsibilities of the Accreditation <br />
Body, as well as requirements that the <br />
Accreditation Body must meet. The <br />
Accreditation Body must be US-based <br />
and be and remain a member in good <br />
standing with the Inter-American <br />
Accreditation Cooperation (IAAC) and <br />
become an International Laboratory <br />
Accreditation Cooperation (ILAC) <br />
Mutual Recognition Arrangement <br />
(MRA) signatory, with a signatory status <br />
scope of ISO/IEC 17020:2012(E) and be <br />
compliant with ISO/IEC
 
17011:2017(E) 20. There is only one <br />
Accreditation Body for the DoD CMMC <br />
Program at any given time, and its <br />
primary mission is to authorize and <br />
accredit the C3PAOs. The Accreditation <br />
Body authorizes and accredits C3PAOs <br />
in accordance with the requirements in <br />
section 170.8(b).
 
The Accreditation Body also oversees
 
the CAICO to ensure compliance with <br />
ISO/IEC 17024:2012(E) 21 and to ensure <br />
all training products, instruction, and <br />
testing materials are of high quality.
 
Section 170.8 addresses specific
 
requirements for the Accreditation Body <br />
with regards to national security <br />
background checks, foreign ownership, <br />
reporting, information protection, and <br />
appeals. The Accreditation Body will <br />
also develop policies for Conflict of <br />
Interest (CoI), Code of Professional <br />
Conduct (CoPC), and Ethics that comply <br />
with all ISO/IEC 17011:2017(E) and DoD <br />
requirements. These policies will apply <br />
to the Accreditation Body as well as to <br />
all other individuals, entities, and <br />
groups within the CMMC Ecosystem. <br />
The information systems used by the <br />
Accreditation Body to process CMMC <br />
information have to meet all of the <br />
security requirements for CMMC Level <br />
2 and will be assessed by DCMA’s <br />
Defense Industrial Base Cybersecurity <br />
Assessment Center (DIBCAC).
 
''Section 170.9''
 
''CMMC Third-Party ''
 
''Assessment Organizations (C3PAOs) ''
 
Section 170.9 addresses the roles,
 
responsibilities, and requirements for <br />
C3PAOs, which are the organizations <br />
that perform CMMC Level 2 certification <br />
assessments for OSCs. The C3PAOs will <br />
submit assessment data into the CMMC <br />
instantiation of government owned and <br />
operated system called eMASS,22 a <br />
CMMC instance of the Enterprise <br />
Mission Assurance Support Service. <br />
C3PAOs issue Certificates of CMMC <br />
Status, in accordance with the <br />
requirements in § 170.17 of this part.
 
Section 170.9 addresses detailed
 
requirements for C3PAOs with regards <br />
to national security background checks, <br />
foreign ownership, reporting, records <br />
management, information protection, <br />
quality assurance, and appeals. The <br />
information systems used by C3PAOs to <br />
process Level 2 certification assessment <br />
information have to meet all of the <br />
security requirements for CMMC Level <br />
2 and will be assessed by DCMA <br />
DIBCAC. C3PAOs need to comply with <br />
ISO/IEC 17020:2012(E), as well as with
 
the Accreditation Body’s policies for <br />
CoI, CoPC, and Ethics.
 
Prior to a C3PAO being compliant
 
with ISO/IEC 17020:2012(E), the C3PAO <br />
may be authorized but not accredited. <br />
After a C3PAO is compliant with ISO/ <br />
IEC 17020:2012(E), the C3PAO may be <br />
accredited.
 
''Section 170.10''
 
''CMMC Assessor and ''
 
''Instructor Certification Organization <br />
(CAICO) ''
 
Section 170.10 addresses the roles,
 
responsibilities, and requirements for <br />
the CAICO, the organization that trains, <br />
tests, designates Provisional Instructors <br />
(PIs), and certifies CMMC Certified <br />
Professionals (CCPs), CMMC Certified <br />
Assessors (CCAs), CMMC Certified <br />
Instructors (CCIs). There is only one <br />
CAICO for the DoD CMMC Program at <br />
any given time. The CAICO must <br />
comply with ISO/IEC 17024:2012(E), as <br />
well as with the Accreditation Body’s <br />
policies for CoI, CoPC, and Ethics. <br />
Section 170.10 addresses detailed <br />
requirements for the CAICO with <br />
regards to certification examinations, <br />
quality assurance, appeals, records <br />
management, reporting, separation of <br />
duties, and information protection.
 
''Section 170.11''
 
''CMMC Certified ''
 
''Assessor (CCA) ''
 
Section 170.11 addresses the roles
 
and responsibilities of a CMMC <br />
Certified Assessor (CCA) who conduct <br />
Level 2 certification assessments. In <br />
order to be a CCA, a candidate must first <br />
be a CCP, must adhere to the <br />
requirements set forth in § 170.10, <br />
§ 170.8(b)(17), and complete a Tier 3 <br />
background investigation or equivalent. <br />
The required cybersecurity experience <br />
for different CCA roles is addressed in <br />
§ 170.11(b)(6) and (10). Section 170.11 <br />
addresses CCA requirements with <br />
respect to security breaches; completion <br />
of a Tier 3 background investigation or <br />
equivalent; reporting; sharing <br />
assessment information; and permitted <br />
use of C3PAO equipment, devices, and <br />
services.
 
''Section 170.12''
 
''CMMC Instructor ''
 
Section 170.12 addresses the roles
 
and responsibilities of a CMMC <br />
Provisional Instructor (PI) and CMMC <br />
Certified Instructor (CCI) to teach <br />
CMMC assessor candidates. Candidate <br />
PIs and CCIs are trained and tested per <br />
the requirements set forth in § 170.12(c). <br />
Section 170.12(c) also provides <br />
candidate PIs and CCIs with the <br />
requirements to obtain and maintain <br />
designation or certification (as <br />
applicable), compliance with <br />
Accreditation Body policies, work <br />
activity exclusions, confidentiality
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00010
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83101 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
expectations, non-disclosure clause, <br />
non-public training related information, <br />
forbidden consulting services, and <br />
reporting requirements.
 
''Section 170.13''
 
''CMMC Certified ''
 
''Professional (CCP) ''
 
Section 170.13 addresses the roles
 
and responsibilities of a CMMC <br />
Certified Professional (CCP) required to <br />
provide advice, consulting, and <br />
recommendations to clients. The CAICO <br />
trains and tests candidate CCPs per the <br />
requirements set forth in § 170.13(b) <br />
with CCP certification issued upon <br />
successful completion. A CCP can <br />
participate on CMMC Level 2 <br />
certification assessments with CCA <br />
oversight, however CCAs are <br />
responsible for making final assessment <br />
determinations for a CMMC Status of <br />
Conditional or Final Level 2 (C3PAO). A <br />
list of CCP requirements is provided for <br />
obtaining and maintaining certification, <br />
compliance with Accreditation Body <br />
policies, completion of a Tier 3 <br />
background investigation or equivalent, <br />
sharing assessment specific information, <br />
and reporting requirements.
 
''Section 170.14''
 
''CMMC Model ''
 
Section 170.14 addresses the
 
structure, security requirement contents, <br />
organization, sourcing, and numbering <br />
of the security requirements that <br />
comprise the CMMC Model. It also <br />
provides an overview of the assessment <br />
process. The CMMC Model consists of <br />
three (3) levels, each containing security <br />
requirements taken directly from <br />
existing regulations and guidelines. <br />
Firstly, § 170.14(2) defines CMMC Level <br />
1 as the 15 security requirements listed <br />
in the FAR clause 52.204–21(b)(1). <br />
Secondly, § 170.14(3) defines CMMC <br />
Level 2 as the 110 security requirements <br />
from the NIST SP 800–171 R2. Lastly, <br />
§ 170.14(4) defines CMMC Level 3 as 24 <br />
selected security requirements from the <br />
NIST SP 800–172 Feb2021.
 
The CMMC security requirements are
 
organized into domains following the <br />
approach taken in NIST SP 800–171 R2. <br />
The numbering of the CMMC security <br />
requirements, addressed in <br />
§ 170.14(c)(1), is of the form DD.L#-REQ <br />
where the ‘DD’ is the two-letter domain <br />
abbreviation, the ‘L#’ is the CMMC <br />
Level, and the ‘REQ’ is based directly on <br />
the numbering in the source. <br />
Assessment criteria for these security <br />
requirements, as described in <br />
§ 170.14(d), is based on security <br />
requirement assessment guidance <br />
provided in NIST SP 800–171A Jun2018 <br />
and NIST SP 800–172A Mar2022.
 
''Section 170.15''
 
''CMMC Level 1 Self- ''
 
''Assessment and Affirmation <br />
Requirements ''
 
Section 170.15 addresses how an OSA
 
will achieve and maintain compliance <br />
with the CMMC Status of Level 1 (Self). <br />
The OSA must successfully implement <br />
the security requirements listed in <br />
§ 170.14(c)(2) within their Level 1 <br />
CMMC Assessment Scope as described <br />
in § 170.19(b). Successful <br />
implementation requires meeting all <br />
objectives defined in NIST SP 800–171A <br />
Jun2018 for the corresponding CMMC <br />
Level 1 security requirements as <br />
outlined in the mapping table 1 to <br />
§ 170.15(c)(1)(i).
 
After implementation, the OSA must
 
perform a Level 1 self-assessment to <br />
verify the implementation and score <br />
themselves using the scoring <br />
methodology provided in § 170.24. All <br />
objectives must be met in order for a <br />
security requirement to be considered <br />
fully implemented; no security <br />
requirements may be placed on a <br />
POA&amp;M for Level 1. The OSA must then <br />
input their results into SPRS as <br />
described in § 170.15(a)(1)(i) and submit <br />
an affirmation as described in § 170.22.
 
In order to be eligible for a contract
 
with a requirement for the CMMC Status <br />
of Level 1 (Self), the OSA must have <br />
achieved a CMMC Status of Final Level <br />
1 (Self) and have submitted an <br />
affirmation. These activities must be <br />
completed annually.
 
''Section 170.16''
 
''CMMC Level 2 Self- ''
 
''Assessment and Affirmation <br />
Requirements ''
 
Section 170.16 addresses how an OSA
 
will achieve and maintain compliance <br />
with the CMMC Status of Level 2 (Self). <br />
The OSA must successfully implement <br />
the security requirements listed in <br />
§ 170.14(c)(3) within its Level 2 CMMC <br />
Assessment Scope as described in <br />
§ 170.19(c). Successful implementation <br />
requires meeting all objectives defined <br />
in NIST SP 800–171A Jun2018 for the <br />
corresponding CMMC Level 2 security <br />
requirements. Requirements for ESPs <br />
and CSPs that process, store, transmit <br />
CUI are provided in § 170.16(c)(2) and <br />
(3).
 
After implementation, the OSA must
 
perform a Level 2 self-assessment to <br />
verify the implementation and score <br />
themselves using the scoring <br />
methodology provided in § 170.24. All <br />
objectives must be met in order for a <br />
security requirement to be considered <br />
fully implemented; in some cases, if not <br />
all objectives are met, some security <br />
requirements may be placed on a <br />
POA&amp;M as provided for in § 170.21. If <br />
the minimum score has been achieved
 
and some security requirements are in a <br />
POA&amp;M, the OSA has achieved the <br />
CMMC Status of Conditional Level 2 <br />
(Self); if all requirements are MET as <br />
defined in § 170.24(b), the OSA has <br />
achieved a CMMC Status of Final Level <br />
2 (Self). For Conditional Level 2 (Self), <br />
a POA&amp;M closeout must be conducted <br />
within 180 days as described in <br />
§ 170.21(b) or the Conditional Level 2 <br />
(Self) CMMC Status will expire.
 
After a Level 2 self-assessment, as
 
well as after a POA&amp;M closeout, the <br />
OSA must input their results into SPRS <br />
as described in § 170.16(a)(1)(i) and <br />
submit an affirmation as described in <br />
§ 170.22.
 
In order to be eligible for a contract
 
with a requirement for the CMMC Status <br />
of Level 2 (Self), the OSA must have <br />
achieved the CMMC Status of either <br />
Conditional Level 2 (Self) or Final Level <br />
2 (Self) and have submitted an <br />
affirmation. The Level 2 self-assessment <br />
must be completed every three years <br />
and the affirmation must be completed <br />
annually following the Final CMMC <br />
Status Date.
 
''Section 170.17''
 
''CMMC Level 2 ''
 
''Certification Assessment and <br />
Affirmation Requirements ''
 
Section 170.17 addresses how an OSC
 
will achieve and maintain compliance <br />
with the CMMC Status of Level 2 <br />
(C3PAO). The OSC must successfully <br />
implement the security requirements <br />
listed in § 170.14(c)(3) within its Level <br />
2 CMMC Assessment Scope as <br />
described in § 170.19(c). Successful <br />
implementation requires meeting all <br />
objectives defined in NIST SP 800–171A <br />
Jun2018 for the corresponding CMMC <br />
Level 2 security requirements. <br />
Requirements for ESPs and CSPs that <br />
process, store, transmit CUI are <br />
provided in § 170.17(c)(5) and (6).
 
After implementation, the OSC must
 
hire a C3PAO to perform an assessment <br />
to verify the implementation. The <br />
C3PAO will score the OSC using the <br />
scoring methodology provided in <br />
§ 170.24. All objectives must be met in <br />
order for a security requirement to be <br />
considered fully implemented; in some <br />
cases, if not all objectives are met, some <br />
security requirements may be placed on <br />
a POA&amp;M as defined in § 170.21. If the <br />
minimum score has been achieved and <br />
some security requirements are in a <br />
POA&amp;M, the OSC has achieved the <br />
CMMC Status of Conditional Level 2 <br />
(C3PAO); if all requirements are MET as <br />
defined in § 170.24(b), the OSC has <br />
achieved the CMMC Status of Final <br />
Level 2 (C3PAO). For Conditional Level <br />
2 (C3PAO), a POA&amp;M closeout must be <br />
conducted within 180 days as described
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00011
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83102 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
in § 170.21(b) or the Conditional Level <br />
2 (C3PAO) CMMC Status will expire.
 
After a Level 2 certification
 
assessment, as well as after a POA&amp;M <br />
closeout, the C3PAO will input the <br />
OSC’s results into the CMMC <br />
instantiation of eMASS as described in <br />
§ 170.17(a)(1)(i). After a Level 2 <br />
certification assessment, as well as after <br />
a POA&amp;M closeout, the OSC must <br />
submit an affirmation as described in <br />
§ 170.22.
 
In order to be eligible for a contract
 
with a requirement for the CMMC Status <br />
of Level 2 (C3PAO), the OSC must have <br />
achieved the CMMC Status of either <br />
Conditional Level 2 (C3PAO) or Final <br />
Level 2 (C3PAO) and have submitted an <br />
affirmation. The Level 2 certification <br />
assessment must be completed every <br />
three years and the affirmation must be <br />
completed annually following the Final <br />
CMMC Status Date.
 
''Section 170.18''
 
''CMMC Level 3 ''
 
''Certification Assessment and <br />
Affirmation Requirements ''
 
Section 170.18 addresses how an OSC
 
will achieve and maintain compliance <br />
with the CMMC Status of Level 3 <br />
(DIBCAC). The OSC must have achieved <br />
the CMMC Status of Final Level 2 <br />
(C3PAO) for information systems within <br />
the Level 3 CMMC Assessment Scope as <br />
a prerequisite to undergo a Level 3 <br />
certification assessment. The OSC must <br />
successfully
 
implement the security requirements
 
listed in § 170.14(c)(4) and table 1 to <br />
§ 170.14(c)(4) within its Level 3 CMMC <br />
Assessment Scope as described in <br />
§ 170.19(d). Successful implementation <br />
requires meeting all objectives defined <br />
in NIST SP 800–172A Mar2022 for the <br />
corresponding CMMC Level 3 security <br />
requirements. Requirements for ESPs <br />
and CSPs that process, store, transmit <br />
CUI are provided in § 170.18(c)(5) and <br />
(6).
 
After implementation, the OSC must
 
contact DCMA DIBCAC to perform an <br />
assessment to verify the <br />
implementation. DCMA DIBCAC will <br />
score the OSC using the scoring <br />
methodology provided in § 170.24. All <br />
objectives must be met in order for a <br />
security requirement to be considered <br />
fully implemented; in some cases, if not <br />
all objectives are met, some security <br />
requirements may be placed on a <br />
POA&amp;M as defined in § 170.21. If the <br />
minimum score has been achieved and <br />
some security requirements are in a <br />
POA&amp;M, the OSC has achieved the <br />
CMMC Status of Conditional Level 3 <br />
(DIBCAC); if all requirements are MET <br />
as defined in § 170.24(b), the OSC has <br />
achieved the CMMC Status of Final <br />
Level 3 (DIBCAC). For Conditional
 
Level 3 (DIBCAC), a POA&amp;M closeout <br />
must be conducted within 180 days as <br />
described in § 170.21(b) or the <br />
Conditional Level 3 (DIBCAC) CMMC <br />
Status will expire.
 
After a Level 3 certification
 
assessment, as well as after a POA&amp;M <br />
closeout, DCMA DIBCAC will input the <br />
OSC’s results into the CMMC <br />
instantiation of eMASS as described in <br />
§ 170.18(a)(1)(i). After a Level 3 <br />
certification assessment, as well as after <br />
a POA&amp;M closeout, the OSC must <br />
submit an affirmation as described in <br />
§ 170.22.
 
In order to be eligible for a contract
 
with a requirement for the CMMC Status <br />
of Level 3 (DIBCAC), the OSC must have <br />
achieved the CMMC Status of either <br />
Conditional Level 3 (DIBCAC) or Final <br />
Level 3 (DIBCAC) and have submitted <br />
an affirmation. The Level 3 certification <br />
assessment must be completed every <br />
three years and the affirmation must be <br />
completed annually following the Final <br />
CMMC Status Date.
 
''Section 170.19''
 
''CMMC Scoping ''
 
Section 170.19 addresses the
 
requirements for the scoping of each <br />
CMMC Level and determines which <br />
assets are included in a given <br />
assessment and the degree to which <br />
each is assessed. The CMMC <br />
Assessment Scope is specified prior to <br />
any CMMC assessment, based on the <br />
CMMC Level being assessed. The Level <br />
2 CMMC Assessment Scope may also be <br />
affected by any intent to achieve a <br />
CMMC Level 3 Certification <br />
Assessment, as detailed in § 170.19(e).
 
Scoping for CMMC Level 1, as
 
detailed in § 170.19(b), consists of all <br />
assets that process, store, or transmit <br />
FCI. These assets are fully assessed <br />
against the applicable CMMC security <br />
requirements identified in § 170.14(c)(2) <br />
and following the procedures in <br />
§ 170.15(c). All other assets are out-of- <br />
scope and are not considered in the <br />
assessment.
 
Scoping for CMMC Level 2, as
 
detailed in § 170.19(c), consists of all <br />
assets that process, store, or transmit <br />
CUI, and all assets that provide security <br />
protections for these assets. These assets <br />
are fully assessed against the applicable <br />
CMMC security requirements identified <br />
in § 170.14(c)(3) and following the Level <br />
2 self-assessment procedures in <br />
§ 170.16(c) or the Level 2 certification <br />
assessment procedures in § 170.17(c). In <br />
addition, Contractor Risk Managed <br />
Assets, which are assets that can, but are <br />
not intended to, process, store, or <br />
transmit CUI because of security policy, <br />
procedures, and practices in place, are <br />
documented and are subject to a limited <br />
check that may result in the
 
identification of a deficiency, as <br />
addressed in table 3 to § 170.19(c)(1). <br />
Finally, Specialized Assets, which are <br />
assets that can process, store, or <br />
transmit CUI but are unable to be fully <br />
secured, including: Internet of Things <br />
(IoT) devices, Industrial Internet of <br />
Things (IIoT) devices, Operational <br />
Technology (OT), Government <br />
Furnished Equipment (GFE), Restricted <br />
Information Systems, and Test <br />
Equipment, are documented but are not <br />
assessed against other CMMC security <br />
requirements, as addressed in table 3 to <br />
§ 170.19(c)(1). All other assets are out- <br />
of-scope and are not considered in the <br />
assessment.
 
Scoping for CMMC Level 3, as
 
detailed in § 170.19(d), consists of all <br />
assets that can (whether intended to or <br />
not) or do process, store, or transmit <br />
CUI, and all assets that provide security <br />
protections for these assets. The CMMC <br />
Level 3 Assessment Scope also includes <br />
all Specialized Assets but allows an <br />
intermediary device to provide the <br />
capability for the Specialized Asset to <br />
meet one or more CMMC security <br />
requirements, as needed. These assets <br />
(or the applicable intermediary device, <br />
in the case of Specialized Assets) are <br />
fully assessed against the applicable <br />
CMMC security requirements identified <br />
in § 170.14(c)(4) and following the <br />
procedures in § 170.18(c). All other <br />
assets are out-of-scope and are not <br />
considered in the assessment.
 
If an OSA utilizes an ESP, including
 
a Cloud Service Provider (CSP), that <br />
does not process, store, or transmit CUI, <br />
the ESP does not require its own CMMC <br />
assessment. The services provided by <br />
the ESP are assessed as part of the OSC’s <br />
assessment as Security Protection <br />
Assets.
 
''Section 170.20''
 
''Standards Acceptance ''
 
Section 170.20 addresses how OSCs
 
that, prior to the effective date of this <br />
rule, have achieved a perfect score on a <br />
DCMA DIBCAC High Assessment with <br />
the same scope as a Level 2 CMMC <br />
Assessment Scope, will be given a <br />
CMMC Status of Level 2 (C3PAO).
 
''Section 170.21''
 
''Plan of Action and ''
 
''Milestones Requirements ''
 
Section 170.21 addresses rules for
 
having a POA&amp;M for the purposes of a <br />
CMMC assessment and satisfying <br />
contract eligibility requirements for <br />
CMMC. All POA&amp;Ms must be closed <br />
within 180 days of the Conditional <br />
CMMC Status Date. To satisfy CMMC <br />
Level 1 requirements, a POA&amp;M is not <br />
allowed. To satisfy CMMC Level 2 <br />
requirements, a POA&amp;M is allowed. <br />
Section 170.21 details the overall <br />
minimum score that must be achieved
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00012
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83103 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
and identifies the Level 2 security <br />
requirements that cannot have a <br />
POA&amp;M and must be fully met at the <br />
time of the assessment. To satisfy <br />
CMMC Level 3 requirements, a POA&amp;M <br />
is allowed. Section 170.21 details the <br />
overall minimum score that must be <br />
achieved and identifies the Level 3 <br />
security requirements that cannot have <br />
a POA&amp;M and must be fully met at the <br />
time of the assessment. Section 170.21 <br />
also established rules for closing <br />
POA&amp;Ms.
 
''Section 170.22''
 
''Affirmation ''
 
Section 170.22 addresses that the
 
OSA’s Affirming Official must affirm, in <br />
SPRS, compliance with the CMMC <br />
Status: upon completion of any self- <br />
assessment, certification assessment, or <br />
POA&amp;M closeout assessment (as <br />
applicable), and annually following a <br />
Final CMMC Status Date.
 
''Section 170.23''
 
''Application to ''
 
''Subcontractors ''
 
Section 170.23 addresses flow down
 
of CMMC requirements from the prime <br />
contractor to the subcontractors in the <br />
supply chain. Prime contractors shall <br />
comply and shall require subcontractor <br />
compliance throughout the supply <br />
chain at all tiers with the applicable <br />
CMMC Level for each subcontract as <br />
addressed in § 170.23(a).
 
''Section 170.24''
 
''CMMC Scoring ''
 
''Methodology ''
 
Section 170.24 addresses the
 
assessment finding types MET, NOT <br />
MET, and NOT APPLICABLE (N/A) in <br />
the context of CMMC assessments, and <br />
the CMMC Scoring Methodology used to <br />
measure the implementation status of <br />
security requirements for CMMC Level <br />
2 and CMMC Level 3. Scoring is not <br />
calculated for CMMC Level 1 since all <br />
requirements must be MET at the time <br />
of assessment.
 
For CMMC Level 2, the maximum
 
score is the total number of Level 2 <br />
security requirements and is the starting <br />
value for assessment scoring. Any <br />
security requirement that has one or <br />
more NOT MET objectives reduces the <br />
current score by the value of the specific <br />
security requirement. Values for each <br />
CMMC Level 2 requirement are <br />
enumerated in § 170.24(c)(2)(i)(B).
 
For CMMC Level 3, the maximum
 
score is the total number of Level 3 <br />
security requirements and is the starting <br />
value for assessment scoring. Any <br />
security requirement that has one or <br />
more NOT MET objectives reduces the <br />
current score by the value of the specific <br />
security requirement. CMMC Level 3 <br />
does not use varying values; the value
 
for each requirement is one (1), as <br />
described in § 170.24(c)(3).
 
''Appendix A to Part 170: Guidance ''
 
Appendix A lists the guidance
 
documents that are available to support <br />
defense contractors and the CMMC <br />
Ecosystem in the implementation and <br />
assessment of CMMC requirements.
 
'''Discussion of Public Comments and <br />
Resulting Changes '''
 
The Department of Defense published
 
the proposed rule, on December 26, <br />
2023 (88 FR 89058). Approximately 361 <br />
public submissions were received in <br />
response to the publication. Some <br />
comments were beyond the scope of the <br />
CMMC Program and are described but <br />
not addressed in this final rule. The <br />
majority of comments received were <br />
relevant and are summarized in the <br />
discussion and analysis section here. <br />
Additional comments were received in <br />
response to the CMMC supplemental <br />
documents published concurrently with <br />
the rule; the discussion and analysis of <br />
those comments is located at <br />
[http://www.regulations.gov ''www.regulations.gov''. Some comments <br />
]received lacked relevance to the rule’s <br />
content, which is limited to specific <br />
CMMC program requirements codified <br />
in the 32 CFR part 170 CMMC Program <br />
rule, responses for those comments are <br />
not provided.
 
Any contractual requirements related
 
to the CMMC Program rule will be <br />
implemented in the DFARS, as needed, <br />
which may result in revisions to the <br />
DFARS clause 252.204–7021, CMMC <br />
Requirements. DoD will address <br />
comments regarding the DFARS clause <br />
252.204–7021 in a separate 48 CFR part <br />
204CMMC Acquisition rulemaking.
 
''1. Extension of the Public Comment <br />
Period ''
 
''Comment: ''DoD received requests from
 
industry associations for an extension of <br />
the 60-day public comment period on <br />
the CMMC Proposed Rule that the <br />
Office of the Federal Register published <br />
on 26 December 2023. The length of <br />
extensions requested ranged from 30–60 <br />
days. Commenters argued that the <br />
proposed rule was initially published <br />
following a holiday, or more time was <br />
needed for associations to fully review <br />
member comments about the CMMC <br />
Proposed Rule prior to submitting. In <br />
addition, they argued that other rules <br />
pertaining to cyber incident reporting <br />
obligations and security of Federal <br />
Information Systems had also been <br />
published for public comment, which <br />
created a need for additional review <br />
time.
 
''Response: ''The DoD CIO denied
 
requests for an extension of the 60-day
 
public comment period. The DoD <br />
provided regular communication to the <br />
public through the DoD CMMC website <br />
and updates in the semiannual Unified <br />
Agenda in preparation for publication of <br />
the CMMC Proposed Rule to initiate the <br />
60-day public comment period. The <br />
Department has an urgent need to <br />
improve DIB cybersecurity by further <br />
enforcing compliance with security <br />
requirements that were to be <br />
implemented by the DIB ‘‘as soon as <br />
possible but not later than December <br />
2017.’’
 
''2. The CUI Program ''
 
a. CUI Program Guidance
 
''Comment: ''Many comments were
 
submitted related to the NARA CUI <br />
policies or the DoD CUI Program, and <br />
while relevant for understanding CMMC <br />
requirements, those are separate policies <br />
or programs beyond the scope of the <br />
CMMC program or this rule. However, <br />
several comments recommended that <br />
the CMMC rule be revised to address <br />
them.
 
Twenty-two comments requested the
 
government provide more guidance, <br />
preferably within RFPs or contracts, to <br />
better identify what will be considered <br />
CUI for that contract, and how it should <br />
be appropriately marked. One comment <br />
specifically noted a need for contractual <br />
instructions on whether data created in <br />
performance of a contract rises to the <br />
level of CUI. Another person asked <br />
when is does information created or <br />
possessed by a contractor become CUI. <br />
One comment asked whether digital or <br />
physical items derived from CUI are <br />
treated as CUI while another asked what <br />
specific information qualifies as CUI for <br />
OT and IoT assets. Another comment <br />
asked whether FCI and or CUI created <br />
or provided under a non-DoD agency <br />
contract, but which is also used in <br />
support of a DoD contract, would be <br />
subject to the applicable CMMC level <br />
requirement. Another comment noted <br />
that DoD focuses too narrowly on data <br />
security aspects of major system <br />
acquisition and largely fails to address <br />
securing data generated by operational <br />
and/or maintenance operations, such as <br />
invoices and bills of lading for <br />
operational support purchases.
 
One comment stated there was a need
 
for CUI policy guidance for the entire <br />
Federal Government. Another comment <br />
inferred, incorrectly, that the CMMC <br />
Accreditation Body makes <br />
determinations about what is and what <br />
is not CUI and stated that the <br />
Government should make those <br />
determinations. Another comment <br />
stated that to better address the needs of <br />
contractors tasked with safeguarding
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00013
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83104 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
CUI, NARA should initiate a public <br />
comment period to reevaluate its CUI <br />
Registry. The comment also noted that <br />
NARA should identify when a CUI <br />
designation automatically applies to <br />
contractor-created information and <br />
revise the CUI Registry to stipulate that <br />
a specific basis in statute (or a contract) <br />
is required for information to be <br />
considered CUI. Another comment <br />
recommended a study be conducted on <br />
protections for systems and data at <br />
Confidential and higher classification <br />
levels and should assess whether <br />
NARA’s CUI protection requirements <br />
(32 CFR part 2002) have yielded any <br />
real benefits in protecting critical data. <br />
Another comment stated that the CUI <br />
program is a costly proposition whose <br />
security value is questionable given data <br />
can still be compromised, even over <br />
systems with a CMMC assessment. The <br />
comment stated that if data is to be <br />
controlled for Critical Items, then the <br />
existing system used for <br />
CONFIDENTIAL information should <br />
suffice. Finally, another comment <br />
suggested that CUI information should <br />
be under the control of the Federal <br />
Government and access granted only to <br />
appropriately trained, and qualified <br />
contractors through a portal.
 
''Response: ''Neither the CUI program
 
(established in E.O. 13556) nor the <br />
safeguarding requirements codified in <br />
its implementing directives are changed <br />
by virtue of the compliance assessment <br />
framework established by this rule.
 
CMMC requirements apply to prime
 
contractors and subcontractors <br />
throughout the supply chain at all tiers <br />
that will process, store, or transmit any <br />
FCI or CUI on contractor information <br />
systems in the performance of the DoD <br />
contract or subcontract, irrespective of <br />
the origin of the information.
 
The executive branch’s CUI Program
 
is codified in 32 CFR part 2002 and <br />
establishes policy for designating, <br />
handling, and decontrolling information <br />
that qualifies as CUI. The definition of <br />
CUI and general requirements for its <br />
safeguarding are included in 32 CFR <br />
2002.4 and 2002.14, respectively. 32 <br />
CFR 2002.14(h)(2) specifically requires <br />
agencies to use NIST SP 800–171 when <br />
establishing security requirements to <br />
protect CUI’s confidentiality on non- <br />
Federal information systems. At the <br />
time of award, the DoD may have no <br />
visibility into whether the awardee will <br />
choose to further disseminate DoD’s <br />
CUI, but DFARS clause 252.204–7012 <br />
and DFARS clause 252.204–7021 <br />
require the prime contractor to flow <br />
down the information security <br />
requirement to any subcontractor with <br />
which the CUI will be shared. Decisions <br />
regarding which DoD information must
 
be shared to support completion of <br />
subcontractor tasks is between the <br />
prime contractor and the subcontractors. <br />
The DoD encourages prime contractors <br />
to work with subcontractors to lessen <br />
the burden of flowing down CUI. The <br />
DoD declines to adopt alternatives such <br />
as policy-based solutions that lack a <br />
rigorous assessment component or <br />
require sharing CUI only through DoD- <br />
hosted secure platforms. Suggested <br />
alternatives to implementing NIST SP <br />
800–171 and identifying what data is <br />
CUI are beyond the scope of the CMMC <br />
Program and this rule.
 
b. FCI and CUI Definitions
 
''Comment: ''Five comments stated that
 
what DoD considers CUI is not well <br />
defined. Another comment stated that <br />
companies should be provided a <br />
reference list of what the DoD considers <br />
CUI. Another recommended DoD use <br />
existing mechanisms like the DD Form <br />
254 architecture to clearly define the <br />
scope of CUI on a contract-by-contract <br />
basis. Seven comments recommended <br />
the CMMC rule mandate a Security <br />
Classification Guide (SCG) or similar <br />
document.
 
Nine comments stated there was too
 
much confusion and ambiguity <br />
regarding FCI and CUI and that the <br />
government needed to provide clear and <br />
standardized FCI and CUI definitions <br />
that are tailored to the specific <br />
requirements of the CMMC rule. One <br />
comment recommended rule edits to <br />
address this perceived ambiguity. One <br />
comment requested clarification and <br />
examples of differences between CUI <br />
Basic and Specialized CUI.
 
''Response: ''Federal Contract
 
Information is defined in FAR clause <br />
52.204–21, which also provides the <br />
security requirements applicable for <br />
basic safeguarding of such information. <br />
The DoD has no authority to modify <br />
definitions established in the FAR for <br />
application to all executive branch <br />
agencies. This rule makes no change to <br />
the definition or handling of CUI.
 
c. Marking Requirements
 
''Comment: ''Twenty-three comments
 
expressed concern with or requested <br />
clarification regarding CUI marking. <br />
Twelve comments specifically noted <br />
concern with CUI markings being <br />
applied to too many documents, in part <br />
because CUI was an ambiguous concept. <br />
They requested the DoD encourage <br />
personnel to mark documents as CUI <br />
only when appropriate and provide <br />
better guidance for managing flow-down <br />
clauses. Another comment noted that <br />
many small businesses are currently <br />
subject to NIST SP 800–171 <br />
requirements through DFARS contract
 
clause flow-down and cannot say with <br />
certainty that they have CUI in their <br />
possession. The comment further noted <br />
that small businesses regularly receive <br />
mismarked data. One comment stated <br />
there is an increased use of automatic <br />
CUI marking on DoD communications, <br />
seemingly without regard to content. <br />
One comment stated that the rule fails <br />
to outline a mechanism for reporting <br />
government mishandling, and that <br />
contractors should use a reporting <br />
system to minimize their own risk and <br />
liability. One comment requested the <br />
rule be edited to prevent Program <br />
Managers or requesting activities from <br />
assigning a CMMC Level 3 requirement <br />
unless they have high confidence that <br />
80+ percent of CUI and/or FCI under the <br />
relevant contract has complete CUI <br />
markings. Another comment stated that <br />
the Federal government should develop <br />
a marking schema to communicate <br />
information safeguarding requirements, <br />
while yet another stated that DoD must <br />
publish a training module for <br />
contracting officers so that they are <br />
properly classifying documents prior to <br />
finalization of this rule.
 
One comment stated CUI across the
 
DoD is diverse and what may be CUI for <br />
one system may not be for another. The <br />
comment then questioned how this <br />
proposed rule and SPRS would <br />
accommodate these facts without <br />
assuming and mandating that all <br />
defense contractor information systems <br />
meet the same architecture, security, <br />
and cybersecurity standards.
 
''Response: ''The CMMC Program will
 
not provide CUI guidance materials to <br />
industry as it is outside the scope of this <br />
CMMC rule. Relevant information <br />
regarding what to do when there are <br />
questions regarding appropriate marking <br />
of CUI may be found at 32 CFR <br />
2002.50—Challenges to designation of <br />
information as CUI. The DoD declined <br />
to incorporate suggested edits to the <br />
CMMC Level 3 requirements regarding <br />
confidence in proper CUI and/or FCI <br />
markings.
 
The DoD’s role as data owner is
 
documented in the CUI Program <br />
implementing policies and the <br />
requirements of 32 CFR part 2002. DoDI <br />
5200.48, states: The authorized holder <br />
of a document or material is responsible <br />
for determining, at the time of creation, <br />
whether information in a document or <br />
material falls into a CUI category. If so, <br />
the authorized holder is responsible for <br />
applying CUI markings and <br />
dissemination instructions accordingly. <br />
DoD Manual 5200.01 outlines DoD’s <br />
Information Security Program and <br />
includes Volume 2, Marking of <br />
Information. The DoD declines to <br />
incorporate by reference those
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00014
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83105 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
documents describing the Department’s <br />
data governance role because the <br />
content is beyond the scope of CMMC <br />
requirements. The DoD issued policy <br />
guidance to its program managers <br />
regarding programmatic indicators to <br />
consider when selecting CMMC <br />
requirements. Program managers have a <br />
vested interested in knowing whether a <br />
contractor can comply with these <br />
existing requirements to adequately <br />
safeguard CUI.
 
The DoD elected not to make any
 
recommended edits to the CMMC <br />
Program related to FCI or CUI marking <br />
requirements or provide clarifying <br />
examples of the differences between <br />
Basic CUI and Specified CUI, as these <br />
are beyond the scope of this rule. <br />
Mishandling of information by the <br />
government is beyond the scope of this <br />
rule. DCMA DIBCAC processes, stores, <br />
and transmits all data on DoD-approved <br />
networks. DoD’s adherence to NARA’s <br />
CUI Program policies is beyond the <br />
scope of this rule.
 
d. Applicability and Governance of CUI <br />
Requirements
 
''Comment: ''In addition, one utilities
 
sector representative submitted a <br />
lengthy analysis of data types often <br />
generated by electric or other utilities, <br />
with regulatory references and rationale <br />
for why such data would not likely be <br />
subject to DoD’s CUI safeguarding <br />
requirements or CMMC compliance <br />
assessments. Such rationale included <br />
the fact that some Government-Private <br />
CUI categories, such as DoD Critical <br />
Infrastructure Information, require <br />
explicit designation in that category <br />
which (according to the commenter) has <br />
not occurred in the electricity subsector. <br />
One contractor requested that CMMC <br />
clarify requirements around U.S. <br />
persons and foreign dissemination of <br />
CUI for both contractors, subcontractors’ <br />
employees, and contingent workers. <br />
Two comments suggested it would be <br />
appropriate to reference data <br />
governance in § 170.1 and the DoD’s <br />
role as the data owner of FCI and CUI <br />
across the ecosystem. Another comment <br />
stated the classification efforts must <br />
themselves be audited.
 
''Response: ''The quantity of FCI and
 
CUI a defense contractor possesses, <br />
including copies of the same material, is <br />
irrelevant to the CMMC assessment <br />
required. All copies of FCI or CUI <br />
related to the DoD contract must be <br />
safeguarded. The CMMC Program is not <br />
intended to validate compliance with <br />
cybersecurity requirements of non-DoD <br />
agencies’ contracts. The requirements <br />
for sharing of CUI with non-US persons <br />
is beyond the scope of this rule.
 
The CMMC program provides a
 
mechanism to assess contractor <br />
compliance with applicable security <br />
requirements for the safeguarding of FCI <br />
or CUI. CMMC program requirements <br />
make no change to existing policies for <br />
information security requirements <br />
implemented by DoD. Policies for CUI <br />
and creation of program documentation, <br />
to include Security Classification <br />
Guides, are separate from this rule. <br />
Discussion in this rule regarding DoD <br />
programs providing CUI training and <br />
the implementation of E.O. 13556 are <br />
beyond the scope of this rule.
 
CMMC program requirements are
 
applicable when DoD requires <br />
processing, storing, or transmitting of <br />
either FCI or CUI on a non-Federal <br />
contractor owned information system in <br />
the performance of a contract between <br />
DoD and the contractor. The DoD does <br />
not manage nor is it involved in data <br />
exchanges between contractors and <br />
subcontractors.
 
''3. Other DoD Policies and Programs ''
 
Many comments dealt with DoD
 
policies and programs that, while <br />
relevant for understanding CMMC <br />
requirements, are still entirely separate <br />
programs or policies that are not within <br />
the scope of the CMMC program. <br />
However, several commenters <br />
recommended that the rule be revised to <br />
address them. Key topics among such <br />
comments include:
 
a. Adaptive Acquisition Framework
 
''Comment: ''One commenter
 
misunderstood CMMC program purpose <br />
and thought the requirements applied to <br />
systems and capabilities acquired or <br />
developed for DoD’s use, using formal <br />
policies of the Defense Acquisition <br />
System. Based on this misinterpretation, <br />
this commenter made dozens of <br />
recommendations related to integration <br />
of CMMC assessment and program <br />
requirements with other existing DoD <br />
acquisition frameworks and suggested <br />
relying on the assessors that complete <br />
TRAs, in place of implementing the <br />
CMMC program. One of their comments <br />
also proposed establishing a single <br />
responsible office for CUI and SCRM, <br />
hosting CUI material within a single, <br />
separate secure and existing cloud- <br />
based data warehouse and including <br />
hardware and software approving <br />
authorities as part of the proposed rule <br />
for GFE. The commentor also stated the <br />
role of the Office of Small Business <br />
Programs (OSBP) needs to flow down to <br />
the Small Business Administration <br />
military service offices. The commentor <br />
also asked how to reconcile CMMC <br />
against the DoDI 8582.01 requirement <br />
stating a DoD Component should not
 
specify the content and format of plans <br />
of action that address deficiencies or <br />
specifying the parameters of security <br />
controls.
 
This commenter also recommended
 
creation of a MIL-Standard in lieu of <br />
aligning cybersecurity requirements to <br />
existing NIST standards, and linkage of <br />
CMMC requirements to procedures <br />
related to Approval to Operate (which <br />
applies to DoD systems. This <br />
commenter suggested that the CMMC <br />
PMO be made responsible to provide <br />
system scans to check for Software Bills <br />
of Material as part of DoD’s response to <br />
Executive Order 14028 regarding <br />
Supply Chain Risk Management. The <br />
commenter further requested a DoD- <br />
level working group outline how DoD <br />
program offices might identify which <br />
components are mission or safety <br />
critical or which associated production <br />
processes should be identified as CTI. <br />
That commenter recommended this rule <br />
be held in abeyance until AT&amp;L [sic] has <br />
reviewed and provided their insight into <br />
the impacts of CMMC on existing DoD <br />
acquisition documentation and <br />
deliverables. Yet another comment <br />
recommended that ‘‘this proposed <br />
DFARS ruling’’ be vetted through <br />
‘‘AT&amp;L, ASD and OUSD’’ [sic] as a <br />
minimum to determine if changes <br />
would be required in the Program <br />
Protection Improvement Plan and <br />
System Security Plan. Lastly, this <br />
commenter recommended the DoD <br />
engage with NDIA and ISO/IEC to <br />
develop alternate standards for securing <br />
data and supply chains.
 
''Response: ''CMMC Program
 
requirements apply to contractor-owned <br />
information systems that process, store, <br />
or transmit FCI and CUI and do not <br />
apply to systems developed or acquired <br />
for DoD through the formal Defense <br />
Acquisition System (DAS). Therefore, <br />
integrating the CMMC assessment <br />
process and internal DAS processes <br />
(including technical reviews prior to <br />
RFP development) is not appropriate <br />
and is beyond the scope of this rule. <br />
Note that CMMC applicability is broader <br />
than just the Major Defense Acquisition <br />
Programs.
 
DoD’s organizational alignment of
 
responsibilities (between OSBP and <br />
SBA military offices) for assisting small <br />
businesses or establishing new offices <br />
within OSD is beyond the scope of this <br />
rule. Due to national security concerns, <br />
DoD declines the recommendation to <br />
further delay implementation of the <br />
CMMC Program. Each passing day in <br />
delay of implementing the security <br />
requirements for safeguarding DoD FCI <br />
and CUI increases the risk for <br />
exfiltration of non-public information <br />
on unsecured nonfederal systems that
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00015
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83106 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
may result in the loss of DoD’s <br />
technological advantages in its <br />
warfighting capabilities and programs.
 
Discussions regarding acquisition
 
strategies and frameworks are beyond <br />
the scope of this CMMC rule. The <br />
CMMC Program does not alleviate or <br />
supersede any existing requirements of <br />
the Adaptive Acquisition Framework, <br />
nor does it alter any statutory or <br />
regulatory requirement for acquisition <br />
program documentation or deliverables. <br />
Note that CMMC Program requirements <br />
do not apply to systems delivered to <br />
DoD. DoD Instructions for required <br />
acquisition program documentation are <br />
beyond the scope of this rule. CMMC <br />
assessment certifications are not <br />
integrated into System Security Plans <br />
(SSPs).
 
The role of System Engineering and
 
associated processes within the DoD <br />
acquisition process is beyond the scope <br />
of this rule. ITRA assessments provide <br />
a view of program technical risk and are <br />
not well-suited to the assessment of <br />
contractor owned information systems <br />
against standards for safeguarding CUI. <br />
CMMC Program requirements do not <br />
clash with Program Office <br />
responsibilities, but instead provide <br />
Program Manager’s with a mechanism <br />
for validating that contractors are <br />
compliant with the rules for protecting <br />
DoD CUI.
 
b. FedRAMP Program and FedRAMP <br />
Equivalency
 
''Comment: ''Many commenters took
 
issue with the requirements for <br />
FedRAMP Moderate Equivalency, as <br />
referenced in DFARS clause 252.204– <br />
7012 and defined in a separate DoD <br />
policy memo. Some merely highlighted <br />
discrepancies or highlighted concerns <br />
about their ability to meet the FedRAMP <br />
Moderate Equivalency requirements. <br />
Others recommended revisions to that <br />
policy, or to the DFARS clause 252.204– <br />
7012 clause, or both. Some <br />
recommended the FedRAMP Moderate <br />
Equivalency policy memo be <br />
incorporated into the DFARS clause <br />
252.204–7012 clause. Other suggestions <br />
ranged from eliminating equivalency to <br />
meet requirements, allowing 3PAO <br />
attestation to equivalency, requiring all <br />
FedRAMP Moderate Equivalency <br />
candidates to be assessed by the same <br />
C3PAO or allowing equivalency to be <br />
established through other industry <br />
certifications or third-party security <br />
assessments, ''i.e., ''SOC, ISO/IEC 27001. <br />
One commenter requested that <br />
applications hosted on a FedRAMP <br />
Moderate environment only need to <br />
meet the CMMC level of the data the <br />
application will process. Another <br />
suggested that all Cloud Service
 
Providers be required to meet the same <br />
CMMC requirement as the OSCs they <br />
support. One commenter recommended <br />
expanding the scope of CMMC Program <br />
to include assessing other security <br />
requirements in DFARS clause 252.204– <br />
7012, to include the use of FedRAMP <br />
Moderate cloud environment. <br />
Comments also expressed that it is <br />
unreasonable to expect any cloud <br />
provider to share security <br />
documentation with a customer or <br />
C3PAO since they limit dissemination <br />
of this information due to operational <br />
security needs. Another commenter <br />
noted that the proposed rule does not <br />
cover all types of information that <br />
contractors may handle, such as <br />
classified information, export-controlled <br />
information, or proprietary information <br />
and they recommended the DoD clarify <br />
applicability of the CMMC program for <br />
these types of information.
 
''Response: ''Although some
 
commercially based Cloud Service <br />
Offerings (CSOs) may experience <br />
limitations in trying to support the <br />
Defense Industrial Base with the <br />
FedRAMP Moderate equivalent <br />
requirement, the DoD is not willing to <br />
assume all the risk of non-FedRAMP <br />
Moderate Equivalent CSOs when the <br />
CSO is used to process, store, or <br />
transmit CUI. If the offering does not <br />
process, store, or transmit CUI, then <br />
FedRAMP certification is not required. <br />
Although the DoD considered <br />
acceptance of the ISO/IEC 27001 <br />
certification, it chose the NIST <br />
cybersecurity requirement to meet <br />
FedRAMP Moderate baseline <br />
equivalency standard to stay aligned <br />
with the FedRAMP Moderate baseline <br />
which is based on NIST standards <br />
versus ISO/IEC standards.
 
The rule was updated to require
 
FedRAMP moderate or FedRAMP <br />
moderate equivalency in accordance <br />
with DoD Policy. CMMC Program <br />
Requirements make no change to <br />
existing policies for information <br />
security requirements implemented by <br />
DoD. Comments related to applications <br />
hosted on a FedRAMP Moderate <br />
environment are outside the scope of <br />
this rule.
 
The requirements for CSPs that
 
process, store, or transmit CUI are set by <br />
DFARS clause 252.204–7012 and the <br />
DoD CIO policy memo on FedRAMP <br />
Moderate equivalency. These <br />
requirements are beyond the scope of <br />
this rule. ESPs that are not CSPs will be <br />
required to meet the CMMC <br />
requirements and be assessed as part of <br />
the scope of an acquiring OSA. ESPs <br />
that are not a CSP may voluntarily <br />
request a C3PAO assessment if they <br />
decide it would be to their advantage.
 
c. Other DoD Programs and Policies
 
''Comment: ''One commenter expressed
 
dissatisfaction with results obtained <br />
from previously submitted FOIA <br />
requests related to development of the <br />
CMMC program.
 
Two commenters asked if there was a
 
mechanism to update FAR clause <br />
52.204–21 to address evolving threats <br />
and recommended the Department <br />
specifically identify the frequency and <br />
identify accountable parties to review <br />
and update FAR security requirements. <br />
Another commenter cited responses <br />
visible on the DoD CIO’s Frequently <br />
Asked Questions (FAQ) website and <br />
criticized both the utility of the <br />
information (given that does not <br />
constitute formal policy) and the <br />
frequency with which the information is <br />
updated. Similarly, one commenter <br />
asked for more frequent updates to <br />
FAQs on the DoD Procurement Toolbox <br />
URL.
 
One commenter asserted that the
 
Federal Government sometimes <br />
contracts for support to perform <br />
sensitive tasks and permits access to <br />
‘‘highly classified’’ information that <br />
should only be accessed by Federal <br />
employees.
 
One commenter requested NIST
 
develop a simplified inspection <br />
standard for organizations with less <br />
than 20 employees.
 
One commenter asked about the
 
transfer of CMMC Program oversight <br />
from OUSD(A&amp;S) to DoD CIO.
 
A comment cited the utility of free
 
cybersecurity related services that DoD <br />
agencies offer, such as security alerts <br />
and vulnerability scanning, and <br />
encouraged expansion of those <br />
programs.
 
One person suggested that DoD’s
 
Zero-Trust approach would provide a <br />
higher level of security for CUI data <br />
than the CMMC program.
 
One commenter stated the
 
Department should develop clear, <br />
flexible guidelines and alternative <br />
pathways for global companies to <br />
achieve CMMC compliance without <br />
relying on enclave architectures and <br />
recommended that this approach rely on <br />
Zero Trust principals.
 
One comment noted that under FAR
 
clause 52.204–21, FCI does not include <br />
simple transactional information (STI) <br />
and asked if certain data would be <br />
considered STI and therefore not subject <br />
to CMMC.
 
One comment stated that conflicting
 
regulatory guidance exists between the <br />
content of E.O. 15028, NIST SP 800– <br />
218, NIST SP 800–171 R2, and NIST SP <br />
800–171 Revision 3.
 
''Response: ''One comment lacked
 
clarity and failed to clearly articulate
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00016
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83107 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
23
 
[http://www.esd.whs.mil/DD/DoD-Issuances DoD Issuances (''www.esd.whs.mil/DD/DoD- '']
 
[http://www.esd.whs.mil/DD/DoD-Issuances ''Issuances''). ]
 
any relevance to the content of this rule, <br />
so no response can be provided.
 
SPRS will be used for reporting
 
CMMC Status of all contractors, <br />
regardless of which service issued the <br />
contract. Publication of this rule follows <br />
completion of OMB’s formal rulemaking <br />
process, which includes both DoD <br />
internal coordination (including the <br />
USD(A&amp;S) and USD(R&amp;E)) and <br />
Interagency coordination.
 
CMMC is consistent with Section 3.4
 
of DoDI 8582.01, Validation and <br />
Compliance. CMMC does not specify <br />
the content and format of plans of action <br />
beyond what is specified in NIST SP <br />
800–171 R2, which is required under <br />
DoDI 8582.01.
 
Clinger Cohen Act requirements,
 
which apply to DoD’s IT investments, <br />
are not relevant to CMMC Program <br />
requirements, which apply to <br />
contractor-owned information systems. <br />
The classification marking of existing <br />
DoD documentation is beyond the scope <br />
of this rule, as is engagement with <br />
INCOSE and ISO/IEC certification <br />
organizations.
 
Executive Orders state mandatory
 
requirements for the Executive Branch <br />
and have the effect of law. E.O. 14028— <br />
‘‘Improving the Nation’s Cybersecurity’’ <br />
(issued May 12, 2021) requires agencies <br />
to enhance cybersecurity and software <br />
supply chain integrity. NIST SP 800– <br />
171 R2 and NIST SP 800–218 are <br />
guidelines, not regulations. NIST SP <br />
800–171 Revision 3 is not currently <br />
applicable to this rule.
 
Recommendations to add or modify
 
requirements specified in NIST <br />
documentation should be submitted in <br />
response to NIST requests for public <br />
comment on the applicable guidelines. <br />
Federal and DoD requirements for <br />
delivery of software bills of material of <br />
secure software development are <br />
beyond the scope of this rule, which is <br />
limited to the assessment of compliance <br />
with requirements for adequate <br />
protection of FCI and CUI. Federal <br />
Contract Information is defined in FAR <br />
clause 52.204–21, which also provides <br />
the security requirements applicable for <br />
basic safeguarding of such information. <br />
The Department has no authority to <br />
modify definitions established in the <br />
FAR for application to all executive <br />
branch agencies. Any data that meets <br />
the definition of FCI, is subject to <br />
CMMC Level 1. It is beyond the scope <br />
of the CMMC rule to render decisions <br />
on specific elements of data.
 
The OUSD(A&amp;S) was not replaced by
 
the DoD CIO, rather, CMMC Program <br />
management oversight has been <br />
realigned from the OUSD(A&amp;S) to the <br />
Office of the DoD CIO for better <br />
integration with the Department’s other
 
DIB cybersecurity related initiatives. <br />
Comments pertaining to DoD’s <br />
organizational structure are not relevant <br />
to the content of this rule. DoD’s <br />
processing of FOIA requests is also not <br />
within the scope of this rule. The DoD <br />
declines to respond to speculative or <br />
editorial comments about private <br />
citizens or outside entities, all of which <br />
are beyond the scope of this rule. <br />
Likewise, the DoD will not comment <br />
here on other DoD cybersecurity related <br />
programs, such as Zero Trust.
 
Some comments expressed
 
appreciation for cybersecurity related <br />
services that DoD provides free of <br />
charge, including protected DNS, <br />
vulnerability scanning, and security <br />
alerts, but these programs are outside <br />
the CMMC program. The government <br />
cannot comment on specific <br />
implementation or documentation <br />
choices of an OSA. Comments on <br />
alternate risk mitigation strategies such <br />
as product monitoring or software <br />
testing are not within the scope of this <br />
rule text.
 
d. DoD Policies Supporting CMMC <br />
Implementation
 
''Comment: ''Some comments addressed
 
the DoD’s internal policies and training <br />
efforts to prepare the Government <br />
workforce for CMMC program <br />
implementation. For example, some <br />
commenters opined that the rule’s focus <br />
on contactor responsibilities misses the <br />
true risk that lies further up obscure <br />
supply chains. Another commenter <br />
recommended DoD work with <br />
contractors in each sector to provide <br />
clear guidance on the types of data that <br />
the Department would consider CTI. <br />
One commenter requested DoD <br />
acknowledge that human factors <br />
influence DIB cybersecurity while <br />
another stated DoD should provide <br />
uniform web-based training at no cost to <br />
ensure applicable training requirements <br />
are satisfactorily met. Another asked <br />
whether DoD PMs would receive CMMC <br />
related training prior to implementation. <br />
Another comment asked whether <br />
specific risk mitigating approaches, <br />
such as product monitoring or software <br />
testing might suffice to manage supply <br />
chain risk considering lack of visibility <br />
into the origins of 3rd and 4th tier <br />
components.
 
One commenter perceived the CMMC
 
requirement for Program Managers to <br />
identify the level of assessment <br />
requirement appropriate for a <br />
solicitation as removing the contract <br />
award decision from the USD(A&amp;S). <br />
One commenter stated more information <br />
about procedures for implementing <br />
CMMC into government-wide contracts <br />
is needed. Another commenter
 
expressed a need to use a basic contract <br />
that is unclassified, and any CUI would <br />
be contained in a separate appendix to <br />
allow sub-contractors to plan with their <br />
Prime to access the information on the <br />
Prime’s network and avoid requirements <br />
for their own CMMC certification.
 
Another comment recommended
 
revisions to describe that medium <br />
assurance certificates for incident <br />
reporting are a DFARS clause 252.204– <br />
7012 requirement, independent of <br />
CMMC program requirements.
 
Two commenters criticized the
 
DFARS clause 252.204–7020 <br />
requirement to allow ‘‘full access’’ to <br />
contractor facilities, systems, and <br />
personnel for the purposes of DIBCAC <br />
assessment, or for damage assessment <br />
following incident, and recommended <br />
that the CMMC program not include or <br />
rely on this authority.
 
Another commenter recommended
 
that, prior to issuing a final rule on <br />
CMMC, DoD work with other relevant <br />
agencies to integrate and harmonize the <br />
numerous regulatory changes that <br />
impact contractors’ capacity to <br />
safeguard data and systems. One <br />
commenter suggested rule publication <br />
be delayed until DoD articulates the <br />
benefit expected from contractor <br />
compliance with the rule.
 
''Response: ''All recommendations to
 
revise other Government-wide or DoD <br />
policies and programs are beyond the <br />
scope of the CMMC rule.
 
CMMC Program Requirements make
 
no change to existing policies for <br />
information security requirements <br />
implemented by DoD. Policies for CUI <br />
and creation of program documentation, <br />
to include Security Classification <br />
Guides and FedRAMP equivalency are <br />
separate from this rule. Relevant <br />
policies include DoDI 5200.48 <br />
‘‘Controlled Unclassified Information’’ <br />
and DoD Manual 5200.45 ‘‘Instructions <br />
for Developing Security Classification <br />
Guides’’ for example.23 Some comments <br />
received lacked relevance to the rule’s <br />
content, which is limited to specific <br />
CMMC program requirements. Changes <br />
to FAR and DFARS requirements are <br />
beyond the scope of this rule, as are the <br />
contents and updating of DoD’s FAQ <br />
and Procurement Toolbox web pages.
 
CMMC program requirements do not
 
result in any change to which DoD <br />
organization makes the contract award. <br />
Recommendations to adopt standard <br />
DoD contracting procedures (''i.e., ''to <br />
exclude CUI information in the basic <br />
award) are not within the scope of this <br />
rule, which outlines program <br />
requirements. The DoD limits the
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00017
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83108 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
burden of CMMC compliance by <br />
requiring annual affirmations rather <br />
than annual assessments. Affirmations <br />
required for the CMMC program <br />
indicate that a DoD contractor has <br />
achieved and intends to maintain <br />
compliance with the applicable DoD <br />
information security requirements.
 
The CMMC program is designed only
 
to validate implementation of the <br />
information security standards in FAR <br />
clause 52.204–21, NIST SP 800–171 R2, <br />
and a selected subset of NIST SP 800– <br />
172 Feb2021. This rule does not address <br />
the other DFARS clause 252.204–7012 <br />
requirements for cyber incident <br />
reporting. The CMMC assessment <br />
framework will not alter, alleviate, or <br />
replace the cyber incident reporting <br />
aspects of DFARS clause 252.204–7012, <br />
which will remain effective where <br />
applicable. Classified information is <br />
managed differently from CUI, and <br />
different safeguarding regulations apply <br />
to these different categories of <br />
information (each of which are defined <br />
in 32 CFR part 2002). CMMC Program <br />
requirements are aligned to the <br />
requirements for safeguarding of CUI <br />
and are unrelated to the requirements <br />
for safeguarding classified information. <br />
‘‘Export Controlled’’ is a category of <br />
CUI. To the extent that a company <br />
generates information it considers <br />
proprietary, but which is explicitly <br />
excluded from the definition of CUI (see <br />
32 CFR part 2002), no CMMC <br />
requirements would apply.
 
As the CMMC program requirements
 
make no change to existing policies for <br />
information security requirements <br />
implemented by DoD, dialogues with <br />
industry to identify CUI is outside the <br />
scope of this 32 CFR part 170 CMMC <br />
Program rule. Several existing <br />
requirements directly address the <br />
human factors of cybersecurity, <br />
particularly those in the Awareness and <br />
Training, Personnel Security, and <br />
Physical Protection domains. Additional <br />
training and education on the topics of <br />
CUI safeguarding requirements, <br />
cybersecurity hygiene, and other useful <br />
topics may be found at: <br />
[https://www.archives.gov/cui/training.html ''www.archives.gov/cui/training.html <br />
''][https://securityawareness.usalearning.gov/ ''https://securityawareness.'']
 
[https://securityawareness.usalearning.gov/ ''usalearning.gov/ '']
 
[https://business.defense.gov/Resources/Be-Cyber-Smart/ ''https://business.defense.gov/Resources/ '']
 
[https://business.defense.gov/Resources/Be-Cyber-Smart/ ''Be-Cyber-Smart/ <br />
'']OSAs may develop their own policies
 
to validate completion of training. <br />
Developing and providing cyber <br />
security awareness training is not <br />
within the scope of the CMMC Program. <br />
DoD program managers will receive <br />
training.
 
In support of 32 CFR part 170 CMMC
 
Program final rule, DoD issued guidance
 
to reiterate the most appropriate <br />
information safeguarding requirements <br />
for DoD information and the associated <br />
CMMC assessment requirement for any <br />
given solicitation. Irrespective of CMMC <br />
Program assessment requirements, when <br />
CUI is processed, stored, or transmitted <br />
on contractor owned information <br />
systems, those systems are subject to the <br />
security requirements of NIST SP 800– <br />
171, due to the applicability of DFARS <br />
clause 252.204–7012. Program Managers <br />
have a vested interested in knowing <br />
whether a contractor can comply with <br />
these existing requirements to <br />
adequately safeguard DoD CUI.
 
Applicability of and compliance with
 
DFARS clause 252.204–7020 is beyond <br />
the scope of the CMMC Program. <br />
Implementation of the CMMC Program <br />
does not require or rely upon DFARS <br />
clause 252.204–7020. The existing <br />
assessments described in DFARS clause <br />
252.204–7020 are entirely different than <br />
those described in this rule. This rule <br />
contains no cyber incident reporting <br />
requirements. Concerns related to a <br />
CISA rule pertaining to cyber incident <br />
reporting are beyond the scope of this <br />
rule and should have been submitted <br />
instead to the relevant docket for that <br />
rule. The DoD has declined the <br />
recommendation to address certificate <br />
requirements for the cyber incident <br />
reporting requirements of DFARS clause <br />
252.204–7012 in this rule. The DoD is <br />
unable to comment on, balance with, or <br />
modify contractual or regulatory <br />
requirements to comply with any other <br />
agency’s future requirements.
 
The preamble of this rule articulates
 
how contractor compliance with CMMC <br />
will contribute to counteracting the <br />
cyber security threat. Implementation of <br />
the CMMC Program will help protect <br />
DoD’s FCI and CUI that is processed, <br />
stored, and transmitted on non-Federal <br />
information systems of defense <br />
contractors and subcontractors. <br />
Adequately securing that information as <br />
required, down to the smallest, most <br />
vulnerable innovative companies, helps <br />
mitigate the security risks that result <br />
from the significant loss of FCI and CUI, <br />
including intellectual property and <br />
proprietary data. Hence the <br />
implementation of the DoD CMMC <br />
Program is vital, practical, and in the <br />
public interest. Working with NIST and <br />
other regulatory authorities to align <br />
standards is beyond the scope of this <br />
rule.
 
''4. DFARS Requirements ''
 
''Comment: ''Two commenters
 
recommended the DoD fully implement <br />
CMMC requirements to standardize <br />
contract requirements to avoid <br />
proliferation of unique contract clauses
 
across the Department. One comment <br />
suggested the rule should state <br />
explicitly that CMMC requirements do <br />
not apply to other agencies and advise <br />
DoD contractors to seek legal guidance <br />
before complying with CMMC <br />
requirements if other agency <br />
requirements also apply.
 
In addition, several commenters
 
thought the 32 CFR part 170 CMMC <br />
Program rule requirements lacked <br />
sufficient information about the <br />
associated 48 CFR part 204 CMMC <br />
Acquisition rule requirements to <br />
implement them. One person <br />
erroneously identified the DFARS <br />
clause 252.204–7021 as part of the 32 <br />
CFR part 170 CMMC Program rule, and <br />
one person asked what additional <br />
rulemaking is needed to implement <br />
CMMC requirements. Another person <br />
recommended close coordination and <br />
synchronization between the two rules. <br />
One comment recommended the <br />
contract clauses be simplified to be <br />
‘‘stand alone’’, rather than requiring <br />
cognizance of the 32 CFR part 170 <br />
CMMC Program rule content.
 
One commenter asked whether
 
contractors must meet CMMC <br />
requirements during the solicitation <br />
phase, or to view RFPs that contain CUI. <br />
Another asked how DoD plans to <br />
integrate CMMC requirements into <br />
DoD’s Adaptive Acquisition Framework. <br />
One contractor disagreed with CMMC’s <br />
pre-award approach, and worried it <br />
could create a need to become <br />
compliant in anticipation of future <br />
solicitations. This commenter posited <br />
that any information designated as CUI <br />
after contract award will create a <br />
‘‘chicken and egg’’ dilemma for CMMC <br />
compliance. Other comments asked <br />
whether conditional certifications <br />
would be weighted differently than final <br />
certifications in the proposal evaluation <br />
and award process and suggested that <br />
DoD provide 6 months advance notice <br />
for all solicitations containing a CMMC <br />
requirement.
 
Some comments urged the DoD to
 
describe how DoD will identify CUI in <br />
solicitations and when CUI markings <br />
should apply in CSP or ESP scenarios. <br />
They also requested modification of <br />
DoD contracting procedures to provide <br />
criteria for identifying CUI information <br />
in each contract award along with the <br />
corresponding CMMC assessment level. <br />
One commenter inquired about the <br />
difference between implementing <br />
security requirements and assessing <br />
compliance. Some comments pertained <br />
to other DFARS contractual <br />
requirements, rather than CMMC <br />
requirements. For example, some <br />
recommended changing DFARS clause <br />
252.204–7012 to remove the definition
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00018
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83109 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
of Covered Defense Information and to <br />
deviate from a requirement to comply <br />
with the NIST SP 800–171 version <br />
current at the time of solicitation. In <br />
addition, they asked about cost <br />
allowability for time and materials or <br />
cost type contracts. Some comments <br />
posited that costs for reassessment or <br />
recertification should be explicitly <br />
identified as reimbursable in the 48 CFR <br />
part 204 CMMC Acquisition rule, while <br />
one similar comment suggested that <br />
CMMC level 3 certification costs should <br />
be allowable when CMMC level 3 <br />
requirements are initially implemented.
 
One comment addressed cyber
 
incident reporting timelines for cloud <br />
service providers and recommended <br />
that the DoD’s FedRAMP moderate <br />
equivalency policy be revised to align <br />
with DFARS clause 252.204–7012 <br />
timelines. Another asked whether the <br />
rule inadvertently omitted requirements <br />
to assess compliance with DFARS <br />
clause 252.204–7012 cyber incident <br />
requirements.
 
Other commenters asked for the
 
CMMC contract clause verbiage, as was <br />
subsequently published in the related <br />
48 CFR part 204 CMMC Acquisition <br />
rule. For example, some people asked <br />
whether CMMC requirements would be <br />
levied in ID/IQ contract awards versus <br />
task order awards, and GSA schedules. <br />
They asserted that adding CMMC <br />
clauses in GSA schedules might <br />
inadvertently allow contracting officers <br />
to include them in non-DoD issued task <br />
orders. Another opined that ID/IQ <br />
contracting procedures might <br />
necessitate changing the CMMC level <br />
needed for the base contract after its <br />
initial award, based on the needs of a <br />
task order. One commenter incorrectly <br />
inferred that a single Program Manager <br />
would make the CMMC level and type <br />
determination for every task order <br />
issued against an ID/IQ. In addition, two <br />
comments suggested that the DoD <br />
communicate with every current DoD <br />
contractor to identify which CMMC <br />
level would apply to their existing <br />
contracts.
 
One company identified their specific
 
DoD contract and asked whether it <br />
would be cancelled absent CMMC <br />
compliance. Another asked whether a <br />
current DFARS clause 252.204–7020 <br />
self-assessment score could be <br />
submitted to meet a CMMC level 2 self- <br />
assessment requirement. They also <br />
recommended elimination of the <br />
DFARS clause 252.204–7020 <br />
requirements when CMMC is <br />
implemented.
 
One commenter speculated about
 
whether DoD’s CMMC contract clauses <br />
can be applied to DoD contractors that <br />
also make and sell the same product to
 
other US Government agencies. They <br />
noted that export licenses do not restrict <br />
companies from providing product data <br />
to other parties and posited that this <br />
might conflict with CMMC <br />
requirements. One person asked about <br />
the potential for conflicts between <br />
CMMC clauses and the Berry <br />
amendment and suggested that Berry <br />
amendment compliance take <br />
precedence over CMMC clauses.
 
''Response: ''Some comments received
 
lacked relevance to the rule’s content, <br />
which is limited to specific CMMC <br />
program requirements. Changes to FAR <br />
and DFARS requirements are out of <br />
scope of the 32 CFR part 170 CMMC <br />
Program rule, as contractual changes <br />
would occur under the 48 CFR part 204 <br />
CMMC Acquisition rule. This rule does <br />
not discuss the Berry Amendment. The <br />
rule does not address recovery of <br />
assessment costs because it does not <br />
make any change to 48 CFR 31.201–2.
 
This 32 CFR part 170 CMMC Program
 
rule is not an acquisition regulation, <br />
however, a CMMC Conditional <br />
Certification meets the CMMC program <br />
certification requirements. Any <br />
comments related to contract <br />
requirements should be directed to the <br />
related 48 CFR part 204 CMMC <br />
Acquisition rule.
 
CMMC requirements apply to
 
contracts that include FAR clause <br />
52.204–21 or DFARS clause 252.204– <br />
7012 and result in processing, storing, <br />
or transmitting of FCI or CUI on a <br />
contractor owned information system. <br />
The CMMC program is not a verification <br />
program for compliance with all <br />
requirements of DFARS clause 252.204– <br />
7012, rather, its purpose is to ensure <br />
compliance with FAR clause 52.204–21, <br />
NIST SP 800–171 R2, and NIST 800–172 <br />
Feb2021 when applicable. The DoD <br />
does not provide detailed instruction on <br />
how to implement specific solutions to <br />
meet security requirements identified in <br />
the FAR clause or applicable NIST <br />
requirements, which is determined by <br />
the OSA. Any deviation from or change <br />
to the DFARS clause 252.204–7012 <br />
clause is beyond the scope of this rule.
 
Each of the teams responsible for
 
developing these two CMMC rules has <br />
reviewed both documents.
 
There are no CMMC requirements for
 
reviewing FCI or CUI solicitation <br />
material. Recommendations to adopt <br />
standard contracting procedures for <br />
award of DoD contracts (''i.e., ''to exclude <br />
CUI information in the basic award) are <br />
out the scope of this 32 CFR part 170 <br />
CMMC Program rule. In support of the <br />
32 CFR part 170 CMMC Program final <br />
rule, DoD issued policy guidance to its <br />
program managers and acquisition <br />
workforce to identify the appropriate
 
CMMC requirement in solicitations and <br />
contracts. The CMMC assessment level <br />
required does not change based on <br />
acquisition lifecycle phase and is based <br />
on whether FCI and CUI are processed, <br />
stored, or transmitted on contractor <br />
owned information systems used in the <br />
performance of a contract.
 
Discussion of DoD’s willingness to
 
provide advance notice of CMMC <br />
requirements or to remove the PM’s <br />
discretion to include the CMMC level <br />
that best suits program requirements is <br />
a 48 CFR part 204 CMMC Acquisition <br />
rule matter and outside the scope of this <br />
rule. The CMMC Level will be identified <br />
in the solicitation. Once attained, a <br />
CMMC self-assessment or certification <br />
can be used in support of any number <br />
of proposals and solicitations.
 
''5. Litigation and False Claims ''
 
''Comment: ''Some commenters
 
expressed concern that CMMC <br />
implementation would result in <br />
increased litigation by DIB companies or <br />
pursuit of False Claims Act penalties by <br />
DoD against DIB companies. One <br />
commenter erroneously believed that <br />
Mexico would participate in oversight <br />
of the CMMC ecosystem, and that ‘‘a <br />
flood of litigation’’ may result from DIB <br />
companies losing contracts due to non- <br />
compliance with CMMC requirements. <br />
One commenter suggested that DoD <br />
should absolve contractors from False <br />
Claims Act prosecution when <br />
differences are found between C3PAO <br />
assessment results and a previously <br />
submitted contractor self-assessment, <br />
due to potentially valid reasons for the <br />
differing outcomes. Another suggested <br />
that DoD establish protections from <br />
regulatory and legal liability related to <br />
cyber incidents when the affected <br />
contractor has complied with relevant <br />
CMMC Program requirements.
 
''Response: ''The DoD lacks the
 
authority to change the False Claims <br />
Act, which is a Federal law that imposes <br />
liability persons and companies who <br />
defraud or knowingly submit false <br />
claims to the government. Comments <br />
related to Safe Harbor provisions are <br />
outside the scope of this rule.
 
Comments about potential industry
 
litigation are also beyond the scope of <br />
the final rule and the recommendations <br />
provided were not appropriate for <br />
inclusion in this rule. Nothing in the <br />
rule prevents frivolous private lawsuits, <br />
but the rule does provide that the <br />
CMMC AB maintain an appeals process. <br />
The DoD has faithfully followed the <br />
formal rulemaking process, to include <br />
completion of the public comment <br />
period. Implementation of the CMMC <br />
program will be carried out objectively <br />
and in accordance with the tenets of the
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00019
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83110 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
final rule. No foreign actors have any <br />
role in DoD’s administration of the <br />
program.
 
''6. DoD Metrics ''
 
''Comment: ''Several commenters
 
inquired about the types of metrics the <br />
DoD plans to use to monitor progress <br />
toward the DIB cybersecurity objectives <br />
that the CMMC program was designed <br />
to meet. One asked whether DoD’s <br />
metrics would include testing, and <br />
another recommended they capture <br />
changes in the population of DoD <br />
contractors caused by cost impacts of <br />
CMMC implementation. Others <br />
referenced a December 2021 GAO <br />
Report that critiqued DoD’s earlier <br />
attempts to implement the CMMC <br />
program. Specifically, they cited the <br />
GAO’s finding that, at that time, DoD <br />
had not defined how it would analyze <br />
data to measure performance.
 
A comment recommended the DoD
 
identify responses to other GAO <br />
findings, which dealt with <br />
improvements to communications with <br />
industry and metrics for program <br />
management. Another comment asked <br />
whether management alignment within <br />
OSD, budget, and staffing of the CMMC <br />
program office are adequate.
 
Two comments asked how many
 
current contract awardees had received <br />
notification or identification of CUI to <br />
be provided in performance of their <br />
contracts, and asked which CMMC level <br />
would theoretically apply to those <br />
contracts. Another asked the DoD to <br />
provide DIBCAC assessment results data <br />
as a more relevant justification for the <br />
CMMC program than the 2019 DoDIG <br />
report on DIB Cybersecurity.
 
''Response: ''DoD’s response to the
 
referenced GAO and DoD IG reports are <br />
beyond the scope of this rule. Likewise, <br />
the DoD does not comment on analysis <br />
methods supporting the DoD IG’s <br />
conclusions. Publishing DIBCAC <br />
assessments results is also beyond the <br />
scope of this rule, as are CMMC Program <br />
effectiveness metrics and return on <br />
investment calculations. The DoD is <br />
establishing CMMC assessment <br />
requirements as part of a comprehensive <br />
effort to verify that underlying <br />
information security requirements are <br />
met, as required, for all contractor <br />
owned information systems that <br />
process, store, or transmit CUI or FCI in <br />
the performance of a DoD Contract. <br />
DoD’s calculation of ROI for the security <br />
controls that CMMC will assess, and <br />
cost elasticity of the DIB are also beyond <br />
the scope of this rule.
 
''7. Phased Implementation of the <br />
Program ''
 
''Comment: ''Many comments asked for
 
additional explanation of DoD’s <br />
expected start and progression through <br />
phases of the CMMC implementation <br />
plan. Several asked that the phase-in <br />
plan be extended. One commenter asked <br />
whether contracts that would otherwise <br />
be associated with CMMC Level 3 <br />
would include a CMMC Level 2 <br />
requirement if issued prior to Phase 4 of <br />
the plan. Another misread the phase-in <br />
plan to mean that self-assessments <br />
would no longer be permitted at Full <br />
Implementation. One comment asked if <br />
the USG would be revisiting acquisition <br />
timelines to add more time for due <br />
diligence to ensure all entities meet <br />
CMMC requirements or have a POA&amp;M <br />
in place.
 
Some commenters observed that
 
DoD’s intended dates for CMMC <br />
implementation, as published in an <br />
earlier 48 CFR CMMC interim final rule, <br />
are unachievable and must be changed <br />
via another CMMC DFARS rule. Some <br />
commenters were confused by the <br />
differences between the dates of <br />
implementation phases in the rule, and <br />
the seven years described in cost <br />
estimates as necessary to complete <br />
implementation. Another commenter <br />
asked why the rule only applies to DoD.
 
Some commenters suggested changes
 
to prioritize different kinds of contracts, <br />
programs, or companies earlier or later <br />
in the implementation plan, rather than <br />
basing the phase-in on assessment type. <br />
For example, one suggested capping the <br />
number of contracts with CMMC <br />
requirements each year. Another <br />
suggested phasing in by increasing the <br />
numerical assessment score required for <br />
compliance, with additional time <br />
permitted for POA&amp;M close-out beyond <br />
the current limit of 180 days. Another <br />
suggested reversing the phase-in to <br />
begin with CMMC Level 3. Several <br />
commenters requested extension of the <br />
phase-in plan to allow more time. One <br />
speculated that ‘‘tens of thousands’’ of <br />
contractors would require certification <br />
in less than 18 months. One commenter <br />
suggested the DoD modify the timing of <br />
implementation for CMMC levels 2 and <br />
3, and that DoD consider allowing <br />
sufficient time to develop a robust <br />
CMMC ecosystem and demonstrate the <br />
CMMC model before full <br />
implementation.
 
Flexibility in the implementation plan
 
that allows Program Managers and <br />
requiring activities to include CMMC <br />
requirements earlier in the plan than <br />
will be mandated by policy also <br />
generated questions and comments. <br />
Some commenters asked whether this
 
could result in the DoD applying CMMC <br />
requirements to previously awarded <br />
contracts or asked that the rule specify <br />
they will apply only to new contracts. <br />
Another asked about opportunities to <br />
renegotiate the contract ceiling price if <br />
CMMC assessments are required for <br />
option period exercise. One commenter <br />
asked that the rule be revised to exclude <br />
these flexibilities to result in an ‘‘on/ <br />
off’’ approach to implementation.
 
Another commenter asked what
 
mechanisms the DoD would have to <br />
change the pace of implementation or <br />
monitor the contracts that include <br />
CMMC requirements.
 
''Response: ''The DoD lacks the
 
authority to implement CMMC as a <br />
Federal-wide program. The 48 CFR part <br />
204 CMMC Acquisition rule for CMMC <br />
will be updated to align with this 32 <br />
CFR part 170 CMMC Program rule and <br />
will modify DFARS clause 252.204– <br />
7021. CMMC Phase 1 implementation <br />
will commence when both the 32 CFR <br />
part 170 CMMC Program rule and the 48 <br />
CFR part 204 CMMC Acquisition rule <br />
are in effect. Some commenters may <br />
have overlooked that § 170.3(e) states <br />
Phase 1 begins on the effective date of <br />
this 32 CFR part 170 CMMC Program <br />
rule or the complementary 48 CFR part <br />
204 CMMC Acquisition rule, whichever <br />
occurs later. The implementation plan <br />
describes when CMMC level <br />
requirements will appear in <br />
solicitations, it does not define a <br />
timeframe by which all contractors must <br />
be certified. During the first phases of <br />
the plan, a majority of CMMC <br />
requirements will be for self-assessment.
 
In response to public comments, the
 
DoD has updated the rule to extend <br />
Phase 1 by 6 months, with appropriate <br />
adjustments to later phases. DoD is not <br />
conducting Pilots in the updated CMMC <br />
implementation plan. The phased <br />
implementation plan described in <br />
§ 170.3(e) is intended to address ramp- <br />
up issues, provide time to train the <br />
necessary number of assessors, and <br />
allow companies the time needed to <br />
understand and implement CMMC <br />
requirements. DoD has updated the rule <br />
to add an additional six months to the <br />
Phase 1 timeline. Phase 2 will start one <br />
calendar year after the start of Phase 1.
 
The DoD’s objective timeline to begin
 
implementing the CMMC requirements <br />
has been, and remains, FY2025. The <br />
implementation period will consist of <br />
four (4) phases, 1 through 4, and is <br />
intended to address any CMMC <br />
assessment ramp-up issues, provide the <br />
time needed to train the necessary <br />
number of assessors, and to allow <br />
companies time to understand and <br />
implement CMMC requirements. It is <br />
estimated that full implementation of
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00020
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83111 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
CMMC by all defense contractors will <br />
occur over seven years, given the <br />
number of DoD solicitations contractors <br />
respond to and are awarded each year.
 
The four phases add CMMC level
 
requirements incrementally, starting in <br />
Phase 1 with Level 1 and Level 2 Self- <br />
assessments, and ending with Phase 4 <br />
for Full Implementation, as addressed in <br />
§ 170.3(e)(4). By Phase 3, all CMMC <br />
Levels 1, 2, and 3 will be included in <br />
some DoD solicitations and contracts, <br />
but Level 3 requirements may be <br />
identified for implementation as option <br />
period requirements rather than for <br />
initial contract award. In Phase 4, DoD <br />
will include CMMC requirements in all <br />
applicable DoD contracts and option <br />
periods on contracts awarded after the <br />
beginning of Phase 4. As addressed in <br />
§ 170.18(a), receipt of a CMMC Level 2 <br />
Final CMMC Status for information <br />
systems within the Level 3 CMMC <br />
Assessment Scope is a prerequisite for <br />
a CMMC Level 3 certification <br />
assessment.
 
CMMC self-assessment requirements
 
build on the existing DFARS clause <br />
252.204–7020 requirement for basic <br />
safeguarding of CUI. CMMC Level 3 <br />
requires advanced implementation, and <br />
the phase-in period provides additional <br />
time for OSC to achieve the higher <br />
standard. In phase 4, which is full <br />
implementation, CMMC requirements <br />
must apply to new contracts and option <br />
year awards. The DoD may choose to <br />
negotiate modifications adding CMMC <br />
requirements to contracts awarded prior <br />
to CMMC implementation, as needed. <br />
No changes to this rule are needed to <br />
reflect existing contract administration <br />
processes. Questions on specific <br />
contracting matters, including contract <br />
costs and funding, are outside of the <br />
scope of this rule.
 
With the implementation of the final
 
32 CFR part 170 CMMC Program rule <br />
and 48 CFR part 204 CMMC Acquisition <br />
rule, prospective DoD contractors and <br />
subcontractors should be actively <br />
preparing for DoD contract <br />
opportunities that will include CMMC <br />
Program requirements when <br />
performance will require the contractor <br />
or subcontractor to process, store, or <br />
transmit FCI or CUI. The respective <br />
phases of the implementation plan <br />
provide adequate time to complete <br />
CMMC requirements and DoD program <br />
requirements and timelines will dictate <br />
the programs that may warrant CMMC <br />
Level 3 requirements during the phased <br />
implementation of CMMC.
 
DoD considered many alternatives
 
before deciding upon the current CMMC <br />
implementation plan. The phased <br />
implementation plan is based on CMMC <br />
assessment level and type, which DoD
 
believes to be a fair approach for all <br />
prospective offerors. Defining the phase- <br />
in based on contract type, company size <br />
standard, or other potential bases could <br />
lead to unfair advantage. Program <br />
Managers will have discretion to <br />
include CMMC Status requirements or <br />
rely upon existing DFARS clause <br />
252.204–7012 requirements, in <br />
accordance with DoD policy. The DoD <br />
will monitor the Program Managers’ <br />
exercise of this discretion to ensure a <br />
smooth phase-in period. The decision to <br />
rely upon CMMC self-assessment in lieu <br />
of certification assessment is a <br />
Government risk-based decision based <br />
upon the nature of the effort to be <br />
performed and CUI to be shared. Note <br />
that section § 170.20 Standards <br />
acceptance states OSCs that completed <br />
a DCMA DIBCAC High Assessment with <br />
a score of 110 and aligned with CMMC <br />
Level 2 Scoping, will receive Final <br />
CMMC Status for a Level 2 certification <br />
assessment.
 
As noted by one commenter, self-
 
assessments against NIST SP 800–171 <br />
are already required, and verifying <br />
compliance with applicable security <br />
requirements is necessary for the <br />
protection of DoD CUI. For all CMMC <br />
independent assessments (''i.e., ''Level 2 <br />
or 3), DoD policy guides Program <br />
Managers in appropriately including <br />
these requirements in DoD solicitations. <br />
DoD systems that support the <br />
procurement process can identify the <br />
number of contracts issued that include <br />
any specific clause. Such metrics for the <br />
CMMC Program are not within the <br />
scope of this rule.
 
The seven-year timespan reflects the
 
DoD’s estimate for all defense <br />
contractors to achieve CMMC <br />
compliance. The implementation plan <br />
ramps up CMMC assessment <br />
requirements over 4 phases, such that <br />
the ecosystem will reach maximum <br />
capacity by year four. One commenter <br />
referenced the response to a specific <br />
comment to the 2020 CMMC rule. Those <br />
earlier questions about the 2020 rule <br />
publication are no longer relevant due <br />
to changes made in the more recent <br />
2023 rule publication. DoD estimates <br />
acknowledge that contractors with <br />
existing contracts may not receive <br />
another contract award or even submit <br />
another proposal immediately.
 
The DoD has developed CMMC to
 
increase consistency of implementation <br />
of NIST SP 800–171 R2 and NIST SP <br />
800–172 Feb2021. Specifically, this rule <br />
provides extensive information on <br />
scoring methodology, in an effort to <br />
improve self-assessments. The use of <br />
independent C3PAOs further enforces <br />
consistency for those companies that <br />
need to meet a CMMC Level 2
 
certification requirement. The DoD has <br />
considered the suggestions and declines <br />
to modify the phase-in periods based on <br />
total score required, or other criteria, <br />
which would not provide the desired <br />
improvements in DIB cybersecurity.
 
The DoD notes the commenter’s
 
concern that self-assessments go away <br />
after Phase 4. Requirements from earlier <br />
phases continue as each additional <br />
phase is implemented. When <br />
applicable, self-assessments will still be <br />
allowed, as appropriate, in Phase 4. This <br />
rule describes flow down requirements <br />
to subcontractors. This rule makes no <br />
change to 48 CFR 252.204–7008.
 
''8. Commercially Available Off-the-Shelf <br />
(COTS) Procurements ''
 
''Comment: ''One comment suggested
 
the definition of COTS should be more <br />
explicitly defined or the model outlined <br />
in § 170.2 should encompass COTS <br />
products. Two comments questioned <br />
the exemption of CMMC requirements <br />
for contracts or subcontracts exclusively <br />
for commercial off-the-shelf (COTS) <br />
items. Others questioned applicability <br />
of CMMC requirements to COTS <br />
procurements and/or purchases at or <br />
below the micro-purchase threshold. <br />
Finally, one commenter questioned the <br />
validity of a COTS exclusion, stating <br />
that no COTS components are exempt <br />
from DoD’s certification requirements <br />
from DISA or NSA.
 
''Response: ''The term Commercially
 
available off-the-shelf (COTS) is defined <br />
in FAR part 2.101. Some comments <br />
pertained to content of the 48 CFR part <br />
204 CMMC Acquisition rule, including <br />
applicability of CMMC clauses to COTS <br />
procurements and/or those below the <br />
micro-purchase threshold. Such <br />
comments are not within the scope of <br />
this CMMC 32 CFR part 170 CMMC <br />
Program rule, which outlines program <br />
requirements and not acquisition <br />
procedures. CMMC requirements do not <br />
apply to contracts and subcontracts that <br />
are exclusively for the delivery of COTS <br />
products to a DoD buyer. The exemption <br />
does not apply to a contractor’s use of <br />
COTS products within its information <br />
systems that process, store, or transmit <br />
CUI. CMMC assessments are conducted <br />
on contractor owned information <br />
systems to ascertain compliance with <br />
the designated FAR, DFARS, and NIST <br />
requirements.
 
''9. Specific Product Recommendations ''
 
''Comment: ''One managed service
 
provider expressed concern that the <br />
specific tools they use to provide <br />
services might be considered Security <br />
Protection Assets or generate Security <br />
Protection Data in the context of CMMC <br />
assessment requirements, which might
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00021
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83112 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
result in clients electing to use their <br />
own tools and products in lieu of the <br />
managed service provider. This <br />
commenter attached a list of more than <br />
a dozen commercial product and tools <br />
they use as examples associated with <br />
this concern. One commenter used their <br />
public comment submission to submit <br />
materials marketing services their <br />
company can provide, while another <br />
commenter suggested the rule direct <br />
readers to a website listing all software, <br />
tools, and applications deemed ‘‘safe <br />
and cost effective’’ by virtue of CMMC <br />
assessment.
 
Another commenter asserted that all
 
companies need access to cybersecurity <br />
solutions from DHS/CISA and grants to <br />
assist them in buying Zero Trust <br />
technologies to protect CUI. Similarly, <br />
some commenters recommended <br />
various other cybersecurity tools, <br />
programs, or technologies that could be <br />
used to meet CMMC security <br />
requirement and provide threat <br />
intelligence to DIB companies. Such <br />
recommendations included portals used <br />
in conjunction with perimeter and <br />
privileged access management systems. <br />
One commenter proposed delaying <br />
implementation of the CMMC rule until <br />
all DoD contractors’ system <br />
architectures could be analyzed for <br />
possible implementation of Virtual <br />
Machines, or Blockchain for secure data <br />
transmission, or hosting of all CUI on <br />
DoD hosted platforms.
 
''Response: ''The government cannot
 
comment on specific products or <br />
vendors, including marketing materials <br />
submitted via public comment. <br />
However, companies that act as ESPs <br />
should note this rule does not require <br />
CMMC assessment or certification of <br />
ESPs that do not process, store, or <br />
transmit CUI. Services provided by an <br />
ESP are in the OSA’s assessment scope.
 
Comments pertaining to solutions
 
available from other Federal agencies or <br />
expressing a desire for grants to obtain <br />
Zero Trust solutions or other <br />
cybersecurity solutions are also beyond <br />
the scope of the CMMC rule. A wide <br />
range of technologies may be used to <br />
implement CMMC requirements. DoD <br />
will not comment on specific OSA <br />
technology choices. The Department <br />
declines the recommendation to review <br />
the system architectures of all DoD <br />
contractors. The DoD did not modify the <br />
rule to identify a repository of ‘‘safe and <br />
cost effective’’ software, applications, <br />
and tools because a CMMC assessment <br />
does not evaluate commercial products <br />
or services for those characteristics and <br />
the government does not provide <br />
product endorsements.
 
''10. Applicability ''
 
a. Systems Operated on Behalf of DoD <br />
and National Security Systems
 
''Comment: ''The DoD received
 
questions about whether CMMC <br />
requirements apply to information <br />
systems that are designated as National <br />
Security Systems, Defense Business <br />
Systems, or systems operated on the <br />
DoD’s behalf. In concert with those <br />
questions, one person recommended <br />
adding NIST SP 800–53 R5 <br />
requirements to the rule for such <br />
systems. The commenter further <br />
recommended expanding applicability <br />
of the rule to include contractor-owned <br />
systems that directly affect DoD NSS. <br />
Two commenters recommend edits to <br />
clarify that CMMC requirements do not <br />
apply to NSS or to government systems <br />
operated by contractors on the DoD’s <br />
behalf.
 
One commenter asked if a Cloud
 
Service Provider that stores CUI would <br />
have to be at Impact Level 4 in <br />
accordance with the DISA Cloud <br />
Computing Security Requirements <br />
Guide.
 
''Response: ''The CMMC assessment
 
requirements apply in conjunction with <br />
FAR clause 52.204–21 and DFARS <br />
clause 252.204–7012 requirements and <br />
provide a mechanism for verifying <br />
compliance with the security <br />
requirements for safeguarding FCI or <br />
CUI (''e.g., ''NIST SP 800–171) levied by <br />
those clauses.
 
The CMMC Program does not alter
 
any additional security requirements <br />
that may be applicable to contractor- <br />
owned information systems that may <br />
also meet the criteria for designation as <br />
NSS.
 
There is no conflict between the
 
CMMC rule and the DISA Cloud SRG, <br />
which applies to contractor information <br />
systems that are part of Information <br />
Technology (IT) services or systems <br />
operated on behalf of the Government. <br />
The CMMC rule does not apply to those <br />
systems (§ 170.3(b)). The DoD declines <br />
to modify the rule because the <br />
applicability section already states this <br />
rule applies to contractor-owned <br />
information systems.
 
b. Infrastructure Entities
 
''Comment: ''Many commenters had
 
concerns about CMMC’s potential <br />
impact to the energy and electric <br />
industries, internet Service Providers <br />
(ISPs) and small, disadvantaged <br />
businesses looking to contract with the <br />
DoD, especially given dependencies on <br />
appropriate marking of Controlled <br />
Unclassified Information (CUI).
 
Another commenter referenced
 
Executive Order 13175, ‘‘Consultation
 
and Coordination with Indian Tribal <br />
Governments’’ and requested <br />
information on CMMC impact to and <br />
potential exemptions for Native <br />
American and small disadvantaged <br />
contractors. Another commenter stated <br />
that some small businesses may stop <br />
providing cost estimating services to <br />
Federal agencies due to ‘‘threatened <br />
penalties’’ under CMMC requirements.
 
One commenter recommended adding
 
the definition of the defense industrial <br />
base (DIB), and referenced the <br />
Cybersecurity and Infrastructure <br />
Security Agency definition, which <br />
explicitly excludes commercial <br />
infrastructure providers from their <br />
definition of the Defense Industrial Base <br />
Sector. One commenter stated the lack <br />
of clarity around requirements for <br />
electric cooperatives under the CMMC <br />
framework is causing concern about <br />
unanticipated cost impacts for these <br />
smaller entities. The commenter <br />
requested that DoD provide contractors <br />
the ability to recover unanticipated <br />
costs incurred to achieve CMMC <br />
certification.
 
Another commenter asked about
 
potential CMMC exemptions for <br />
telecommunications providers, <br />
specifically for end user encryption. The <br />
commenter stated the DoD needs to <br />
impose CUI encryption requirements on <br />
the relevant contractors and not <br />
telecommunications network providers, <br />
who have no control over whether a <br />
user encrypts information it sends over <br />
those networks. The commenter also <br />
noted that definitions of ‘‘common <br />
carrier’’ vary across Federal Government <br />
and suggested the DoD should create a <br />
blanket exemption for contracts <br />
involving commercial communications <br />
networks that are not ‘‘purpose-built’’ to <br />
transmit sensitive government data. <br />
Another commenter suggested the <br />
CMMC Rule should further clarify that <br />
encryption must be configured such that <br />
the common carrier does not have <br />
access to the decryption key(s).
 
Several commenters requested clarity
 
around CUI, citing general confusion <br />
among industry about which CUI is <br />
subject to the CMMC Program. Some <br />
commenters interpreted the rule as <br />
proposing to apply to all CUI <br />
information, rather than just <br />
information handled by the contractor <br />
‘‘in support of a defense contract’’ and <br />
asserted that this would be an <br />
expansion beyond the current DFARS <br />
clause 252.204–7012 requirements. <br />
They further suggested this broad <br />
definition could result in companies <br />
applying costly controls to all apparent <br />
CUI, regardless of its association with <br />
DoD, to avoid penalties under the False <br />
Claims Act. They recommended clearly
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00022
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83113 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
stating that CUI provided to contractors <br />
by non-DoD agencies should be subject <br />
to the requirements of those agencies <br />
and not the CMMC Program.
 
A commenter said the electric
 
industry will experience increased costs <br />
as electric utilities comb through vast <br />
amounts of data across the electric grid <br />
to determine all potential CUI, even if <br />
that CUI is not specifically subject to a <br />
DoD contract. One commenter stated <br />
that guidance DoD has provided for <br />
electric utilities to identify CUI in the <br />
past is insufficient and suggested that <br />
use of Security Classifications Guides <br />
could help by minimizing the need for <br />
CMMC compliance. In addition, they <br />
speculated that inclusion of CMMC <br />
requirements could create requirements <br />
after award which might require <br />
adjustments to contract price. Another <br />
commenter stated energy companies <br />
servicing military customers must <br />
develop governance programs around <br />
data protection years in advance, with <br />
significant investments. The commenter <br />
is concerned that CMMC requires these <br />
companies to make these large <br />
investments prior to knowing if a <br />
proposed contract may contain CUI and <br />
without adequate guidance about what <br />
data is considered CUI.
 
''Response: ''This rule has no
 
disproportionate impact on Native <br />
American-owned businesses. Once <br />
identified as a requirement, the CMMC <br />
Level will apply uniformly to all <br />
prospective competitors. DoD must <br />
enforce safeguarding requirements <br />
uniformly across the Defense Industrial <br />
Base for all contractors and <br />
subcontractors who process, store, or <br />
transmit CUI. The value of information <br />
(and impact of its loss) does not <br />
diminish when the information moves <br />
to DoD contractors and DoD <br />
subcontractors, regardless of their status <br />
as Native American or small <br />
disadvantaged businesses.
 
The CMMC Program rule does not
 
include ‘‘threatened penalties.’’ If a <br />
requirement of a DoD contract is not <br />
met, then standard contractual and <br />
other remedies applicable to that <br />
contract may apply.
 
CMMC Program requirements make
 
no change to existing policies for <br />
information security requirements <br />
implemented by DoD. Policies for CUI <br />
and creation of program documentation, <br />
to include Security Classification <br />
Guides, are separate from this rule.
 
Section 170.4(b) of the rule states
 
Defense Industrial Base (DIB) is defined <br />
in 32 CFR part 236, which addresses <br />
DoD and DIB Cyber Security Activities. <br />
Section 236.2 includes the DoD <br />
approved definition for DIB.
 
The CMMC Program applies only to
 
DoD contracts that include the DFARS <br />
clause 252.204–7021 and under which <br />
FCI or CUI is processed, stored, or <br />
transmitted on contractor information <br />
systems.
 
This includes CUI outside the
 
category of the Defense Organizational <br />
Index Group. Contracts for the provision <br />
of electricity or other utilities which do <br />
not contain FAR clause 52.204–21 or <br />
DFARS clause 252.204–7012 and which <br />
do not require the processing, storing, or <br />
transmitting of FCI or CUI on contractor <br />
owned information systems will not <br />
require CMMC assessment. The CMMC <br />
rule makes no change to FAR cost <br />
allowability or cost accounting <br />
standards. The 32 CFR part 170 CMMC <br />
Program rule has been updated to add <br />
‘‘in performance of the DoD contract’’ to <br />
§ 170.3, and the 48 CFR part 204 CMMC <br />
Acquisition rule will provide the <br />
contractual direction.
 
A common carrier’s information
 
system is not within the contractor’s <br />
CMMC Assessment Scope if CUI is <br />
properly encrypted during transport <br />
across the common carrier’s information <br />
system. A common carrier who is a DoD <br />
contractor or subcontractor is <br />
responsible for complying with the <br />
CMMC requirements in their contracts. <br />
CUI encryption requirements already <br />
apply to the OSA, not the <br />
telecommunications network provider. <br />
The lack of adequate encryption on the <br />
part of the OSA would not trigger <br />
application of CMMC requirements to <br />
the common carrier’s network. The term <br />
‘‘common carrier’’ appears in the <br />
comment section to a previous rule <br />
making process. Its definition and use <br />
are taken from CNSSI 4009. Efforts to <br />
define it or related terms by other <br />
agencies are outside the scope of the <br />
CMMC Program. Commenter scenarios <br />
where a common carrier would be privy <br />
to an OSA’s encryption keys are <br />
unrealistic. DoD declines to provide <br />
additional guidance.
 
CMMC Program requirements make
 
no change to existing policies for <br />
information security requirements <br />
implemented by DoD. Policies for CUI <br />
and creation of program documentation, <br />
to include Security Classification <br />
Guides, are separate from this rule. <br />
Relevant policies include DoDI 5200.48 <br />
‘‘Controlled Unclassified Information’’ <br />
and DoD Manual 5200.45 ‘‘Instructions <br />
for Developing Security Classification <br />
Guides’’. CMMC Program requirements <br />
will be identified as solicitation <br />
requirements. Contractors will be <br />
required to meet the stated CMMC <br />
requirements, when applicable, at or <br />
above the level identified. For this <br />
reason, it is up to each DIB organization
 
to determine which CMMC level they <br />
should attain.
 
Questions regarding specific
 
contractual matters are outside of the <br />
scope of this rule and may be addressed <br />
by the 48 CFR part 204 CMMC <br />
Acquisition rule. The CMMC program <br />
will be implemented as a pre-award <br />
requirement.
 
c. Joint Ventures
 
''Comment: ''Two commenters requested
 
clarification as to whether CMMC <br />
requirements will apply to companies <br />
engaged in Joint Ventures.
 
''Response: ''CMMC program
 
requirements are applicable when DoD <br />
requires processing, storing, or <br />
transmitting of either FCI or CUI in the <br />
performance of a contract between DoD <br />
and the respective contractor. CMMC <br />
Program requirements will apply to <br />
information systems associated with <br />
contract efforts that process, store, or <br />
transmit FCI or CUI, and to any <br />
information system that provides <br />
security protections for such systems, or <br />
information systems not logically or <br />
physically isolated from all such <br />
systems. The identity of an offeror or <br />
contractor as a joint venture does not in <br />
and of itself define the scope of the <br />
network to be assessed.
 
d. Fundamental Research Efforts
 
''Comment: ''One commenter
 
recommended that both the sharing of <br />
CUI and the decision to apply a CMMC <br />
compliance assessment should only be <br />
considered for contracts of sufficient <br />
contract value and performance period <br />
to make the expense of safeguarding CUI <br />
worthwhile. This commenter asserted <br />
that small businesses are selected for <br />
SBIR contract award not based on <br />
ability to protect information, but <br />
instead on the unique product or service <br />
they offer.
 
Some commenters expressed concern
 
that CMMC could result in state-funded <br />
universities incurring costs to comply <br />
with CMMC level 2, while even the <br />
costs for implementing required FCI <br />
safeguarding requirements is a <br />
significant financial burden. These <br />
commenters speculated that applying <br />
FCI or CUI markings to fundamental <br />
research information negatively impact <br />
academic institutions by requiring them <br />
to remove such data from the public <br />
domain. This commenter cited DFARS <br />
clause 252.204–7000 as rationale to <br />
modify the CMMC rule to exclude <br />
fundamental research.
 
One commenter requested that when
 
contracting for fundamental research, <br />
the Government include a CMMC <br />
requirement based only on whether <br />
information shared is currently FCI or
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00023
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83114 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
CUI, and not whether the effort might <br />
lead to development of FCI or CUI. <br />
Another commenter requested that DoD <br />
issue policies clearly describing how to <br />
recognize or identify circumstances that <br />
could result in fundamental research <br />
becoming FCI or CUI such that it would <br />
require being processed, stored, or <br />
transmitted on CMMC compliant <br />
information systems. The commenter <br />
expressed concern that absent such <br />
policies, research institutions may <br />
house all DoD-related project activities <br />
in CUI enclaves ‘‘out of an abundance <br />
of caution’’, thereby unnecessarily <br />
expanding CUI applicability at <br />
significant cost. They asked that DoD <br />
Instruction 5200.48, ‘‘Controlled <br />
Unclassified Information,’’ and a related <br />
DoD policy memorandum ‘‘Clarifying <br />
Guidance for Marking and Handling <br />
Controlled Technical Information in <br />
accordance with Department of Defense <br />
Instruction 5200.48, ‘Controlled <br />
Unclassified Information’’ be <br />
incorporated into the rule by reference.
 
One commenter questioned whether
 
and how CMMC requirements may <br />
apply to non-contract efforts, including <br />
grants, or efforts conducted under Other <br />
Transactional Authorities.
 
''Response: ''One of the main purposes
 
of the CMMC Program is to ensure that <br />
DoD contracts that require contractors to <br />
safeguard CUI will be awarded to <br />
contractors with the ability to protect <br />
that information. All contractor-owned <br />
information systems that process, store, <br />
or transmit CUI are subject to the <br />
requirements of NIST SP 800–171 when <br />
DFARS clause 252.204–7012 is included <br />
in the contract. This is the case whether <br />
or not the contractor is engaged in <br />
fundamental research.
 
To the extent that universities are
 
solely engaged in fundamental research <br />
that only includes information intended <br />
for public release and does not include <br />
FCI or CUI, no CMMC requirement is <br />
likely to apply. When a research <br />
institution does process, store, or <br />
transmit FCI, the information should be <br />
adequately safeguarded in accordance <br />
with the FAR clause 52.204–21, if <br />
applied. When a research institution <br />
does process, store, or transmit CUI, the <br />
information should be adequately <br />
safeguarded in accordance with the <br />
DFARS clause 252.204–7012, if applied. <br />
That clause makes the contractor owned <br />
information system subject to NIST SP <br />
800–171, which includes requirements <br />
for Awareness and Training (AT) and <br />
Physical Protection (PE). The CMMC <br />
Program provides a means to verify <br />
compliance.
 
DoD’s CUI program policies already
 
address responsibilities for identifying <br />
and marking information, including
 
procedures for changing markings. The <br />
DoD declined to incorporate all the <br />
references associated with marking and <br />
handling CUI. The DoD instructions and <br />
policy guidance are authoritative and <br />
incorporating them into the CMMC <br />
regulation is beyond the scope of this <br />
rule. DoD declines to update the <br />
preamble to exclude the possibility that <br />
information may be designated CUI over <br />
the course of time. According to A&amp;S <br />
memo dated 31 March 2021, titled <br />
Clarifying Guidance for Marking and <br />
Handling Controlled Technical <br />
Information in accordance with <br />
Department of Defense Instruction <br />
5200.48, ‘‘Controlled Unclassified <br />
Information,’’ ‘‘Information related to <br />
RDT&amp;E-funded research efforts, other <br />
than fundamental research, do not <br />
always qualify as CUI.’’ This implies <br />
that some DoD fundamental research <br />
may qualify as CUI. When the DoD does <br />
determine that research meets the <br />
definition of CUI, safeguarding <br />
requirements of DFARS clause 252.204– <br />
7012 will apply regardless of whether <br />
the contractor’s work is fundamental <br />
research. In such instances, CMMC <br />
assessment requirements may also be <br />
applied. Contractors should work <br />
closely with Government Program <br />
Managers to ensure a proper <br />
understanding of the data being <br />
developed and the appropriate markings <br />
and safeguarding.
 
Questions regarding the application of
 
CMMC requirements to specific <br />
transactions, including grants and <br />
OTAs, are outside of the scope of this <br />
32 CFR part 170 CMMC Program rule.
 
e. DoD Waiver of CMMC Applicability
 
''Comment: ''Several questions were
 
submitted about waiver procedures for <br />
CMMC requirements. For example, <br />
someone asked which DoD person or <br />
office has authority to approve waiver <br />
requests. Others also requested insight <br />
to the specific criteria for waiver <br />
approval. One commenter submitted <br />
preferred rewording of the rule section <br />
that describes waivers while another <br />
suggested self-assessment should be <br />
required even when certification is <br />
waived.
 
''Response: ''DoD internal policies,
 
procedures, and approval requirements <br />
will govern the process for DoD to waive <br />
inclusion of the CMMC requirement in <br />
the solicitation. Once applicable to a <br />
solicitation, there is no process for <br />
OSAs to seek waivers of CMMC <br />
requirements from the DoD CIO. In <br />
accordance with § 170.5(d), a limited <br />
waiver authority is provided to the <br />
Acquisition Executive with acquisition <br />
oversight for the program in question. <br />
These officials may issue supplemental
 
guidance dictating specific coordination <br />
requirements for waiver requests. <br />
Recommended administrative changes <br />
have been incorporated into § 170.5(d) <br />
to add clarity.
 
''11. Determination of Applicable <br />
Assessment Type ''
 
a. Process for Level Determination
 
''Comment: ''Multiple comments asked
 
how DoD will determine the CMMC <br />
level to include in solicitations. <br />
Multiple comments inquired about the <br />
criteria DoD will use to determine when <br />
to require a CMMC Level 2 self- <br />
assessment, CMMC Level 2 certification, <br />
or CMMC Level 3 certification <br />
assessment. Multiple comments asked <br />
specifically about when CMMC Level 2 <br />
self-assessment will be required versus <br />
CMMC Level 2 Certification. One <br />
comment requested more information <br />
on which companies may ‘‘self-attest’’.
 
One comment requested § 170.5(a) be
 
modified to prevent CMMC level 2 or 3 <br />
being assigned for contracts where only <br />
FCI is exchanged. One comment <br />
emphasized that requirement(s) for <br />
Contractor certification levels must be <br />
the same as stated throughout this <br />
proposed ruling. Two comments <br />
recommended providing contracting <br />
officers with interim guidance to ensure <br />
consistency in applying CMMC <br />
requirements. One comment requested <br />
the detailed guidance ensure CMMC <br />
requirements are selected based on risk, <br />
and that certification is not required by <br />
default.
 
Some commenters objected to the
 
wording of one criterion for level <br />
selection as ‘‘potential for and impacts <br />
from exploitation of information <br />
security deficiencies’’. One asserted this <br />
equates to a sub-CONFIDENTIAL <br />
security classification. One comment <br />
expressed that all information systems <br />
that process CUI should have the same <br />
level of ‘‘program criticality, <br />
information sensitivity, and the severity <br />
of cyber threat’’ since CUI is <br />
Unclassified Information which is a <br />
‘‘handling caveat’’.
 
Multiple comments requested a
 
clearer description of what contracts <br />
require CMMC Level 3 Certification, one <br />
of which requested a definition of what <br />
constitutes a ‘‘priority program’’ that <br />
might require CMMC Level 3. One <br />
comment requested that acquisition <br />
processes first analyze the CUI for a <br />
proposed effort using published factors <br />
for aligning CUI to high value assets <br />
before setting CMMC levels. They <br />
asserted use of such published factors <br />
would improve accuracy of CUI <br />
marking.
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00024
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83115 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
''Response: ''Pre-award contracting
 
procedures and processes for CMMC <br />
assessment requirements will be <br />
addressed in the 48 CFR part 204 <br />
CMMC Acquisition rule. CMMC is a <br />
pre-award requirement. As stated in the <br />
Applicability section summary of the <br />
CMMC rule (§ 170.3), once CMMC is <br />
implemented in the 48 CFR part 204 <br />
CMMC Acquisition rule, DoD will <br />
specify the required CMMC Level in the <br />
solicitation and the resulting contract.
 
DoD’s policies and procedures for the
 
length of time allowed for proposal <br />
submission in response to any <br />
solicitation are beyond the scope of this <br />
rule. PMs typically consider the totality <br />
of the requirement when deciding how <br />
much time to allow for proposal <br />
submission or whether to seek industry <br />
input through Request for Information <br />
to inform solicitation details. Note that <br />
once attained, companies may reference <br />
a CMMC Status as part of any number <br />
of proposals to various solicitations <br />
with that level of CMMC requirement if <br />
the same assessment scope is used.
 
The type and sensitivity of
 
information to be utilized during the <br />
contract, FCI or CUI, determines the <br />
requirements in the solicitation, which <br />
then informs the CMMC level required. <br />
CMMC level 1 requirements are <br />
designed to be applied when FAR <br />
clause 52.204–21 security requirements <br />
apply to the contract, whereas CMMC <br />
level 2 and 3 requirements are designed <br />
for the protection of CUI information, <br />
and to be applied when DFARS clause <br />
252.204–7012 also applies.
 
When CMMC Program requirements
 
are effective, the DoD will begin <br />
including CMMC assessment <br />
requirements in solicitations as <br />
described in § 170.3 Applicability. DoD <br />
solicitations will specify which <br />
requirements will apply to the contract <br />
award. Prior to issuance of a <br />
solicitation, DoD will determine the <br />
appropriate CMMC level and type of <br />
assessment needed to ensure adequate <br />
safeguarding of the DoD program <br />
information to be shared in performance <br />
of the contract. Identification of the <br />
CMMC level and assessment type will <br />
be part of the DoD’s requirement <br />
definition process. As addressed in <br />
§ 170.18(a) of this rule, a CMMC Level <br />
2 Final CMMC Status is a prerequisite <br />
for CMMC Level 3 assessment and must <br />
be achieved for information systems <br />
within the Level 3 Assessment Scope.
 
Identification of priority programs is a
 
function of the requirements definition <br />
process for any DoD effort. The DoD will <br />
issue policy guidance to Program <br />
Managers to clarify which programmatic <br />
indicators should be considered for <br />
selecting the most appropriate
 
information safeguarding requirement <br />
and associated CMMC assessment <br />
requirement for any given solicitation. <br />
Once identified as a requirement, the <br />
CMMC Status required will apply <br />
uniformly to all prospective <br />
competitors.
 
b. Who Determines the CMMC Level
 
''Comment: ''Two comments asked who,
 
within the Department, determines the <br />
CMMC level required for a contract. One <br />
comment suggested that DoD should <br />
require senior-level approval to include <br />
CMMC Level 3 Certification <br />
requirements in solicitations to limit <br />
unnecessary application. One comment <br />
inquired about when and how CMMC <br />
levels change during the program <br />
office’s Agile Acquisition Framework <br />
lifecycle.
 
''Response: ''Based on DoD decision
 
criteria that include the type and <br />
sensitivity of program information to be <br />
shared, Program Managers will identify <br />
and coordinate as appropriate the <br />
CMMC requirement in the solicitation. <br />
Internal policies for implementation of <br />
CMMC requirements by DoD’s <br />
acquisition community have been <br />
developed, and work will continue as <br />
needed to integrate CMMC policies into <br />
relevant acquisition policies, <br />
guidebooks, and training materials. The <br />
DoD intends that requiring activities <br />
will determine when compliance should <br />
be assessed through CMMC Level 3 as <br />
part of the ordinary acquisition <br />
planning and requirements generation <br />
process.
 
The CMMC assessment level required
 
does not change based on acquisition <br />
lifecycle phase, but based on whether <br />
FCI and CUI are processed, stored, or <br />
transmitted on contractor owned <br />
information systems. All contractor- <br />
owned information systems that <br />
process, store, or transmit CUI are <br />
subject to the requirements of NIST SP <br />
800–171 when DFARS clause 252.204– <br />
7012 is included in the contract.
 
c. CMMC Level 3 Determination
 
''Comment: ''Multiple comments
 
requested further clarification about <br />
which types or categories of CUI require <br />
enhanced protection against Advanced <br />
Persistent Threats (APTs) at CMMC <br />
Level 3 and whether the CMMC level <br />
would be based on the Program or the <br />
data. Two comments expressed concern <br />
or asked how DoD Components will <br />
avoid assigning CMMC Level 3 <br />
requirements to too many contracts. One <br />
comment recommended that DoD <br />
modify its criteria for CMMC Level 3 to <br />
consider factors such as Acquisition <br />
Program Category.
 
''Response: ''CMMC levels do not
 
correspond to CUI levels as the CMMC <br />
Program requirements make changes to <br />
neither the CUI Program, categories of <br />
CUI, nor existing DoD policies for <br />
information security requirements. The <br />
CMMC Flow down requirement is <br />
defined in § 170.23.
 
The Requiring Activity knows the
 
type and sensitivity of information that <br />
will be shared with or developed by the <br />
awarded contractor and selects the <br />
CMMC Level required to protect the <br />
information according to DoD guidance.
 
The DoD declines to modify CMMC
 
Level 3 selection criteria as described in <br />
the commenters recommended <br />
alternatives, which have no bearing on <br />
DoD’s need for increased confidence in <br />
a contractor’s ability to safeguard certain <br />
CUI against Advanced Persistent <br />
Threats. The value of information, and <br />
impact of its loss, does not diminish <br />
based on the total number or dollar <br />
value of contracts held by the awardee, <br />
or acquisition program category. The <br />
DoD reserves the right to decide when <br />
compliance should be assessed by the <br />
Government through CMMC Level 3 <br />
certification. The DoD defines the work <br />
requirements to be solicited for any <br />
given program contract.
 
d. Environments Processing Both FCI <br />
and CUI
 
''Comment: ''Two commentors
 
recommended the elimination of <br />
separate assessments when the FCI and <br />
CUI environments are the same. One of <br />
these comments requested clarification <br />
regarding the scenario of an OSC having <br />
one assessment scope environment for <br />
both FCI and CUI that meets Level 2 <br />
requirements.
 
''Response: ''CMMC Level 2 is required
 
when CUI will be processed, stored, or <br />
transmitted on contractor information <br />
systems. Successful completion of a <br />
CMMC Level 2 self-assessment or <br />
CMMC Level 2 certification assessment <br />
will suffice to meet the CMMC Level 1 <br />
requirement for FCI if/when the scope is <br />
identical. The CMMC Level 2 Scoping <br />
Guide reflects this language.
 
e. Recommendations and Scenarios
 
''Comment: ''One comment
 
recommended removing CMMC Level 2 <br />
self-assessment, changing the CUI <br />
Program, or creating a new type of CUI <br />
to distinguish between CMMC Level 2 <br />
self-assessment and CMMC Level 2 <br />
Certification. Another comment noted <br />
that the requirements for CMMC Level <br />
2 certification assessment are almost <br />
identical to requirements for CMMC <br />
Level 2 self-assessment. One comment <br />
expressed concern that DoD’s <br />
designation of CMMC Level 2 self-
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00025
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83116 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
assessment and certification assessment <br />
runs contrary to FCI (FAR requirements) <br />
and the CUI Program. One comment <br />
asked if the designation of information <br />
as FCI or CUI changes the scope of <br />
CMMC.
 
One comment asked for clarification
 
on which contracts will have sensitive <br />
unclassified DoD information but will <br />
not require CMMC assessment. One <br />
comment recommended removing the <br />
option for CMMC Level 2 self- <br />
assessments to reduce complexity. One <br />
comment posed multiple questions <br />
about what DoD will do if contracting <br />
officers assign CMMC Level 2 or CMMC <br />
Level 3 Certification requirements at a <br />
rate substantially higher than projected.
 
''Response: ''The DoD CIO looked at CUI
 
from a risk-based perspective and <br />
determined that different approaches to <br />
assessments could be implemented to <br />
address risk and help lower the burden <br />
for the DIB. The security requirements <br />
for a CMMC Level 2 self-assessment and <br />
a CMMC Level 2 certification <br />
assessment are the same, the only <br />
difference in these assessments is <br />
whether it is performed by the OSA or <br />
by an independent C3PAO.
 
The decision to rely upon self-
 
assessment in lieu of certification <br />
assessment is a Government risk-based <br />
decision based upon the nature of the <br />
effort to be performed and CUI to be <br />
shared. The size of the company with <br />
access to the CUI is not a basis for this <br />
determination. The value of information <br />
(and impact of its loss) does not <br />
diminish when the information moves <br />
to contractors of smaller size. The DoD <br />
declines to modify the rule to include <br />
its internal decision process.
 
To select a CMMC Level for a
 
procurement, Program Managers and <br />
requiring activities will identify the <br />
applicable CMMC Level using the <br />
factors included in § 170.5(b)(1) through <br />
(5). The DoD did agree with one <br />
comment to rephrase § 170.5(b)(4) to <br />
delete a reference to the ‘‘potential for’’ <br />
impact from exploitation of information <br />
security deficiencies, which likely <br />
cannot be effectively determined. The <br />
DoD does not agree that the wording <br />
equates to a sub-CONFIDENTIAL <br />
classification and declines to delete that <br />
criterion. § 170.5(b)(3) is appropriately <br />
worded in that it states Program <br />
Managers will consider the listed <br />
criteria in selecting a CMMC <br />
requirement level. It does not have the <br />
effect of ‘‘transforming FCI into CUI’’. <br />
The DoD reserves the right to define the <br />
criteria for selection of the CMMC <br />
assessment requirement, just as it <br />
defines all other requirements for <br />
inclusion in a solicitation.
 
The Department remains committed
 
to implementing the CMMC program to <br />
require compliance assessment against <br />
applicable security requirements in all <br />
DoD contracts involving FCI or CUI. <br />
Some such contracts will require only a <br />
CMMC self-assessment, while others <br />
will require a certification assessment. <br />
The commenter misinterprets that some <br />
contracts that do require processing of <br />
FCI or CUI will not require CMMC <br />
assessment of either kind, without <br />
approval of a waiver.
 
The DoD declines to remove self-
 
assessments from the rule. Self- <br />
assessments allow the acquiring <br />
organization to balance the cost and <br />
complexity of assessment with the risk <br />
to the information being shared with the <br />
OSA.
 
Supporting guidance for CMMC
 
implementation will be updated, as <br />
necessary. DoD has options to mitigate <br />
implementation issues such as waivers <br />
and other contractual remedies. DoD’s <br />
estimate for the number of contractor’s <br />
requiring CMMC Level 1 and cost <br />
estimates represent derived estimates <br />
based on internal expertise and public <br />
feedback in accordance with OMB <br />
Circular A–4.
 
''12. Flow-Down/Applicability to Sub <br />
Contractors ''
 
a. Applicability and Compliance
 
''Comment: ''Several comments
 
requested clarification about the <br />
applicability of CMMC requirements to <br />
subcontractors and how to correctly <br />
flow down requirements. Some asked <br />
whether prime contractors would have <br />
flexibility to flow down a lower CMMC <br />
level than required for the prime <br />
contract. Three comments expressed <br />
confusion about the type of Level 2 <br />
assessment required for subcontractors <br />
when supporting a prime that is <br />
required to meet CMMC Level 3 <br />
requirements. Two asked about the <br />
impact to flow-down when contractors <br />
hold multiple contracts. A couple <br />
comments requested clarity on how to <br />
determine the correct CMMC level to <br />
flow down.
 
Some comments asked what factors
 
would result in flow-down of a <br />
particular CMMC requirement level, or <br />
whether affirmations submitted by <br />
primes would require knowledge of <br />
subcontractor compliance status.
 
Other comments asked what tools
 
would be available to assist contractors <br />
in checking subcontractor compliance <br />
with CMMC requirements or suggested <br />
that SPRS should be made available for <br />
this purpose. One suggested that <br />
without this transparency, CMMC <br />
compliance would become a
 
meaningless effort to ‘‘check the box’’ <br />
without actual steps to secure their <br />
systems. Another simply asked if they <br />
would have their own SPRS and eMASS <br />
access, or access through their prime. <br />
Some asked what action meets the rule’s <br />
requirement to ‘‘require subcontractor <br />
compliance’’, ''i.e., ''does simply including <br />
the CMMC clause in subcontracts meet <br />
that requirement.
 
One comment objected to the
 
definition of subcontractor used in the <br />
rule, which they stated was overly broad <br />
and would result in application of <br />
CMMC requirements to too many <br />
businesses. Some comments suggested <br />
the flow-down requirement apply only <br />
to one sub-tier, while another requested <br />
advance notice of solicitations that plan <br />
to include CMMC requirements. One <br />
comment suggested that CUI be treated <br />
more like classified information, <br />
meaning to limit sharing of CUI with <br />
subcontractors. Some comments asked <br />
whether prime contractors are <br />
responsible for verifying subcontractor <br />
compliance with DFARS clause <br />
252.204–7012, as C3PAOs do during an <br />
assessment. Two comments <br />
recommended rephrasing the flow- <br />
down section, with one specifically <br />
asking to clarify it is required only when <br />
FCI or CUI will be processed, stored, or <br />
transmitted in the performance of any <br />
particular prime contract. Another <br />
suggested edits for clarity or for <br />
consistency with DFARS clause <br />
252.204–7012.
 
''Response: ''It is up to each OSA to
 
protect FCI and CUI and to determine <br />
the assessment boundary, policies, and <br />
procedures necessary to do that. Section <br />
170.23 specifically addresses the CMMC <br />
requirements that apply to <br />
subcontractors that will process, store, <br />
or transmit FCI or CUI. Section 170.23 <br />
addresses flow down of CMMC <br />
requirements from the prime contractor <br />
to the subcontractors in the supply <br />
chain. Prime contractors are responsible <br />
for complying with contract terms and <br />
conditions, including the requirement to <br />
flow down applicable CMMC <br />
requirements to subcontractors. The <br />
DoD modified § 170.23(a)(3) to clarify <br />
that when a subcontractor will process, <br />
store, or transmit CUI in performance of <br />
the subcontract and the Prime <br />
contractor has, for the associated prime <br />
contract, a requirement of Level 2 <br />
certification assessment, then CMMC <br />
Level 2 certification assessment is the <br />
minimum requirement for the <br />
subcontractor. Requirements for <br />
External Service Providers are defined <br />
in § 170.4; not all companies that <br />
provide services to an OSA are <br />
considered ESPs.
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00026
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83117 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
As in other contexts, the Government
 
may specify additional guidance in the <br />
solicitation. CMMC assessments will be <br />
identified as pre-award requirements. <br />
Subcontractors at each tier are <br />
responsible for submitting their own <br />
assessment and affirmation information <br />
in SPRS. CMMC self-assessments and <br />
certifications will be reflected in SPRS, <br />
including an indicator of the currency of <br />
the credentials. Contracting Officers and <br />
Program Managers need not review any <br />
assessment artifacts, only the resulting <br />
scores and certificate validity period.
 
Work arrangements between the
 
prime and subcontractor are beyond the <br />
scope of this rule, however, if CUI is <br />
flowed down and will be processed, <br />
stored, or transmitted on subcontractor <br />
information systems in the performance <br />
of a DoD contract then CMMC <br />
requirements also flow down as <br />
described in § 170.23. The DoD will not <br />
track progress toward certification but <br />
will implement CMMC as a pre-award <br />
requirement. An OSA’s pursuit of a <br />
C3PAO assessment is a business <br />
decision to be made by each contractor <br />
considering the contract opportunities it <br />
wishes to pursue.
 
The DoD disagrees with one
 
commenter’s assertion that CMMC <br />
requirement will flow down ‘‘regardless <br />
of what work they do’’, because it does <br />
not acknowledge the point that flow- <br />
down requirements are for <br />
subcontractors who process, store, or <br />
transmit CUI. The text of § 170.23, <br />
clearly conditions the flow-down to <br />
those cases when a subcontractor will <br />
process, store, or transmit FCI or CUI. <br />
The prime contractor’s responsibility is <br />
to flow down CMMC assessment <br />
requirements as described in § 170.23 <br />
and to ensure that FCI and CUI are not <br />
further disseminated to subcontractors <br />
that do not meet the CMMC requirement <br />
indicated in § 170.23. Likewise, <br />
subcontractors must also flow down <br />
CMMC requirements and ensure that <br />
FCI and CUI are not further <br />
disseminated to subcontractors that do <br />
not meet the CMMC requirement <br />
indicated in § 170.23. Section 170.23 <br />
has been revised to make this clearer. <br />
DoD declines to accept the <br />
recommendation to treat CUI like <br />
classified data. Classified information is <br />
managed differently from CUI, and <br />
different safeguarding regulations apply <br />
to these different categories of <br />
information (each of which are defined <br />
in 32 CFR part 2002).
 
This rule makes no change to CUI
 
policies for marking of data, and CMMC <br />
levels are not CUI categories in the DoD <br />
CUI registry. Primes and their <br />
subcontractors must understand flow- <br />
down requirements based on § 170.23,
 
which clearly identifies requirements <br />
that apply when subcontractors will <br />
process, store, or transmit CUI in <br />
performance of the subcontract and the <br />
Prime contractor has a requirement of <br />
Level 3 certification assessment (''i.e., <br />
''CMMC Level 2 certification assessment <br />
is the minimum requirement for the <br />
subcontractor). In addition, the rule has <br />
been revised to make clear that the <br />
requirement applies in the performance <br />
of a subcontract when the relevant <br />
prime contract has a CMMC <br />
requirement. The rationale for the <br />
minimum level 2 certification flow- <br />
down requirement is that the DoD made <br />
a risk-based decision not to mandate <br />
flow down of the level 3 requirement <br />
unless explicit guidance is provided to <br />
do so. As stated in § 170.23(a)(3), when <br />
a Prime contractor has a requirement of <br />
Level 2 certification, any CUI that is <br />
flowed down for a subcontractor to <br />
process, store, or transmit in <br />
performance of the subcontract will also <br />
carry a minimum requirement of Level <br />
2 certification assessment.
 
CMMC Program requirements will be
 
identified as solicitation and contract <br />
requirements, and contractors will be <br />
required to meet the stated CMMC <br />
requirements, when applicable, at or <br />
above the level identified. One <br />
commenter misinterpreted a response to <br />
a prior public comment. The quoted <br />
content says that contractors and <br />
subcontractors each must verify <br />
(through CMMC assessment) that all <br />
applicable security requirements of <br />
NIST SP 800–171 required via DFARS <br />
clause 252.204–7012 have been <br />
implemented. Contractors are not <br />
required to assess subcontractor <br />
implementation of the requirements of <br />
NIST SP 800–171. The prime <br />
contractor’s responsibility is to flow <br />
down CMMC assessment requirements <br />
as described in § 170.23 and also to <br />
refrain from disseminating FCI or CUI to <br />
subcontractors that have not indicated <br />
meeting the CMMC level described in <br />
that section for the type of information <br />
to be shared. Likewise, subcontractors <br />
must also flow down CMMC <br />
requirements or refrain from <br />
disseminating FCI or CUI. The DoD does <br />
not provide SPRS access or other tools <br />
for contractors to identify the CMMC <br />
status or other companies. The DoD <br />
expects that defense contractors will <br />
share information about CMMC status <br />
with other DIB members to facilitate <br />
effective teaming arrangements when <br />
bidding for DoD contracts.
 
Prime contractors will not be granted
 
access to subcontractor’s information in <br />
SPRS. However, prime contractors <br />
should communicate early and often <br />
with prospective subcontractors to
 
confirm current CMMC status, including <br />
whether the level matches that required. <br />
This interaction does not involve the <br />
government and is beyond the scope of <br />
this rule.
 
This rule follows the format and
 
includes all sections required in OMB <br />
guidelines for formal rulemaking. The <br />
DoD lacks authority to modify the <br />
template or omit required sections, <br />
which results in some repetition.
 
DIB contractors are responsible for
 
submitting their Level 1 and Level 2 <br />
self-assessments and will access SPRS <br />
to enter the results. DIB contractors do <br />
not have access to CMMC eMASS, as <br />
that system is used to support <br />
certification assessments only.
 
CMMC Program requirements are
 
designed to require completion of an <br />
assessment and an annual affirmation. <br />
The purpose of the annual affirmation <br />
addressed in § 170.22 is to validate to <br />
the DoD that the contractor is actively <br />
maintaining its CMMC level status, <br />
which is more than a checkbox exercise.
 
One commenter misinterpreted the
 
quoted definition of subcontractor, <br />
which makes clear that term includes <br />
only those entities providing supplies, <br />
materials, equipment, or services under <br />
a subcontract in connection with the <br />
prime contract. DFARS clause 252.204– <br />
7012 and FAR clause 52.204–21 also <br />
flow-down the requirement to safeguard <br />
information. CMMC program <br />
requirements will be flowed down <br />
similarly, therefore there is no <br />
anticipated expansion of scope. The cost <br />
estimates included in the published rule <br />
include costs for both existing DIB <br />
members and new entrants (or newly <br />
covered entities).
 
The DoD modified the Overview
 
summary of CMMC 2.0 to read ‘‘The <br />
DFARS clause 252.204–7012 also <br />
requires defense contractors to include <br />
this clause in all subcontracts that will <br />
require the subcontractor to process, <br />
store, or transmit CUI.’’ The DoD <br />
declined additional edits in this <br />
location that requested reframing the <br />
criteria Program Managers will use <br />
select CMMC requirements to address <br />
Levels 2 and 3 only. The DoD may apply <br />
CMMC Level 2 or 3 requirements when <br />
there is anticipation of the need for the <br />
contactor or subcontractors to process, <br />
store, or transmit CUI during the <br />
performance of a contract.
 
b. Prime and Subcontractor <br />
Relationships
 
''Comment: ''Many requested specific
 
examples of when a prime contractor <br />
should flow down its CMMC <br />
requirements to a subcontractor or ESP, <br />
and how to determine the appropriate <br />
CMMC level to flow down. For example,
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00027
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83118 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
one comment asked whether the <br />
subcontract document would require <br />
safeguarding, necessitating flow-down <br />
of the CMMC requirement. Some <br />
comments expressed concern that flow- <br />
down requirements are not sufficiently <br />
clear to prevent prime contractors from <br />
unnecessarily sharing CUI and applying <br />
CMMC requirements to lower tier <br />
suppliers. Another thought that the <br />
flow-down requirements will drastically <br />
expand the scope of the program and <br />
drive cost increases for the DIB.
 
Several comments suggested strategies
 
for minimizing the burden of security <br />
implementation on lower tier <br />
subcontractors, such as requiring prime <br />
contractors to provide access to CUI on <br />
prime contractor systems, or prohibiting <br />
prime contractors from unnecessarily <br />
sharing CUI information that would <br />
necessitate a CMMC requirement. One <br />
asked whether the prime contractor has <br />
a responsibility to check which CMMC <br />
level the subcontractor has flowed down <br />
to the next tier. One comment <br />
referenced industry activities aimed at <br />
gauging subcontractor preparedness for <br />
CMMC and expressed concern with <br />
anecdotal evidence that primes will not <br />
issue orders until the subcontractor has <br />
submitted CMMC scores into SPRS.
 
''Response: ''One commentor correctly
 
interpreted § 170.23(a)(3) as meaning <br />
that CMMC level 2 Certification <br />
requirements (not self-assessments) flow <br />
down for subcontractors that will <br />
handle CUI when the Prime contract <br />
specifies a CMMC Level 2 Certification <br />
requirement.
 
At the time of award, the DoD may
 
have no visibility into whether the <br />
awardee will choose to further <br />
disseminate DoD’s CUI, but DFARS <br />
clause 252.204–7012 and DFARS clause <br />
252.204–7021 require that the prime <br />
contractor flow down the information <br />
security requirement to any <br />
subcontractor with which the CUI will <br />
be shared. Decisions regarding the DoD <br />
information that must be shared to <br />
support completion of subcontractor <br />
tasks, will take place between the prime <br />
contractor and the subcontractors <br />
chosen to complete the specific tasks. <br />
The DoD encourages prime contractors <br />
to work with its subcontractors to flow <br />
down CUI with the required security <br />
and the least burden. The DoD declines <br />
to revise the rule to address <br />
responsibilities for derivative marking <br />
of CUI because this rule makes no <br />
change to DFARS clause 252.204–7012 <br />
or DoD’s CUI policies regarding marking <br />
of CUI, including creation of <br />
information.
 
The specific contractual language is
 
part of the 48 CFR part 204 CMMC <br />
Acquisition rule and beyond the scope
 
of this 32 CFR part 170 CMMC Program <br />
rule. This rule describes DoD’s intent for <br />
CMMC Program requirements, which <br />
include that all prime and <br />
subcontractors at all tiers that process, <br />
store, or transmit CUI in the <br />
performance of a DoD contract (or sub- <br />
contract) are required to demonstrate <br />
compliance with the contract <br />
requirements (''i.e., ''FAR clause 52.204– <br />
21 or DFARS clause 252.204–7012) for <br />
adequately safeguarding FCI or CUI.
 
CMMC flow-down requirements are
 
designed to apply consistent assessment <br />
requirements to all subcontractors, <br />
regardless of company size, who are <br />
required to adequately safeguard CUI. <br />
The DoD cannot dictate DIB business <br />
practices and encourages prime <br />
contractors to carefully consider the <br />
necessity of sharing CUI information <br />
and work with subcontractors to flow <br />
down CUI only when deemed <br />
appropriate.
 
Likewise, the criteria by which
 
contractors select CSPs for support or <br />
the availability of GFE for any particular <br />
contract are beyond the scope of this <br />
rule. The DoD declines to limit CMMC <br />
program requirements to the first-tier <br />
subcontractor, as suggested by the <br />
commenter. When a contractor or <br />
subcontractor responds to multiple <br />
solicitations, that contractor should <br />
complete the highest assessment level <br />
among them for the assessment scope <br />
defined for use in performance of the <br />
contracts. The contractor may also elect <br />
to structure its environment to meet <br />
differing CMMC requirements based on <br />
the contract(s) in question.
 
Contractual remedies for non-
 
compliance are a 48 CFR part 204 <br />
CMMC Acquisition rule matter and <br />
beyond the scope of this rule.
 
c. Requirements
 
''Comment: ''Some comments objected
 
to CMMC Level 2 certification <br />
assessment being identified as the <br />
minimum flow-down from prime <br />
contractors with a CMMC Level 3 <br />
requirement. They asked how the more <br />
sensitive data associated with a Level 3 <br />
requirement would be tracked. Three <br />
asked whether CMMC Level 2 <br />
certification assessment must be flowed <br />
down as the CMMC requirement when <br />
the prime contract requires a higher <br />
level, and the subcontract is for limited <br />
scope. One comment complained that <br />
the rule does not actively encourage <br />
primes to flow down Level 2 self- <br />
assessment requirements instead of <br />
certification requirements.
 
One comment suggested the
 
Department is impermissibly attempting <br />
to make sensitivity determinations of
 
other agencies’ CUI and FCI through the <br />
implementation of this rule.
 
Another comment requested
 
affirmation that contractors remain <br />
responsible for determining whether <br />
information that they create (derived <br />
from CUI) retains its CUI identity when <br />
sharing that information with lower tier <br />
suppliers, and for determining any <br />
associated CMMC flow-down <br />
requirement.
 
''Response: ''DoD will issue guidance to
 
Program Managers to reiterate the most <br />
appropriate information safeguarding <br />
requirements for DoD information and <br />
the associated CMMC assessment <br />
requirement for any given solicitation. <br />
CMMC program requirements will be <br />
identified in the solicitation, and <br />
contractors will be required to meet the <br />
stated CMMC requirements, when <br />
applicable, at or above the level <br />
identified by the time of contract award. <br />
CMMC requirements flow down from <br />
primes to subcontractors, as described <br />
in section § 170.23.
 
The DoD declined to provide forecasts
 
of upcoming DoD solicitations with <br />
CMMC assessment requirements. Given <br />
that FAR clause 52.204–21 was effective <br />
in 2016 and DFARS clause 252.204– <br />
7012 was effective in 2017, OSAs have <br />
had over seven years to implement NIST <br />
SP 800–171 R2 requirements and close <br />
out POA&amp;Ms. DoD contracts that require <br />
OSAs to process, store, or transmit CUI <br />
and include DFARS clause 252.204– <br />
7020, also require a minimum of a self- <br />
assessment against NIST SP 800–171 <br />
requirements. That self-assessment <br />
includes the same requirements as the <br />
CMMC Level 1 and CMMC Level 2 self- <br />
assessments.
 
DoD must enforce CMMC
 
requirements uniformly for all defense <br />
contractors and subcontractors, <br />
regardless of size, who process, store, or <br />
transmit FCI, and CUI, regardless of <br />
size. The value of DoD information (and <br />
impact of its loss) does not diminish <br />
when the information moves to <br />
contractors and subcontractors. The <br />
DoD cannot dictate business practices <br />
but encourages prime contractors to <br />
work with its subcontractors to limit the <br />
flow down of FCI and CUI. The DoD <br />
declines to base CUI safeguarding <br />
requirements on contract ceiling value.
 
This DoD 32 CFR part 170 CMMC
 
Program rule does not impact or <br />
supersede 32 CFR part 2002 (the CUI <br />
Program) or make exceptions for the <br />
categories of CUI or the Designating <br />
Agency for the CUI. CMMC <br />
requirements apply to DoD contracts <br />
that will involve processing, storing, or <br />
transmitting of FCI or CUI on any non- <br />
Federal information system.
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00028
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83119 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
''13. The CMMC Ecosystem Roles, <br />
Responsibilities and Requirements ''
 
a. Government
 
''Comment: ''Some comments asked
 
how the Department plans to address <br />
complaints and concerns from <br />
ecosystem stakeholders and the process <br />
by which disputes between OSCs and <br />
C3PAOs or the CMMC AB are resolved. <br />
Two comments wanted the CMMC PMO <br />
to document a process for ecosystem <br />
stakeholders to register complaints or <br />
use of Service Level Agreements to hold <br />
the Department accountable to respond.
 
Some asked whether the DoD could
 
be subject to litigation challenging <br />
DoD’s reliance on the CMMC AB’s <br />
appeals process to resolve disputes <br />
between OSCs and C3PAOs. The <br />
commenters asserted resolving such <br />
disputes may be an inherently <br />
governmental function. One commenter <br />
noted that transactions between OSCs <br />
and C3PAOs for initiating an assessment <br />
are beyond the DoD’s authority to <br />
regulate, since the DoD is not a party to <br />
the transaction. They perceived DoD’s <br />
indirect oversight of C3PAOs through <br />
the CMMC AB as creating conflicts of <br />
interest and potential legal liabilities. <br />
One commenter requested the DoD <br />
modify the rule to state the CMMC PMO <br />
is responsible for the assessment and <br />
monitoring of the CMMC AB, as well as <br />
the CMMC AB’s performance of its <br />
roles.
 
One commenter noted the ISO/IEC
 
17011:2017(E) requirements that the <br />
CMMC AB must meet and asked why <br />
the rule identifies a timeline for <br />
compliance instead of requiring <br />
immediate accreditation.
 
One commenter referenced a CMMC-
 
related Request for Information issued <br />
prior to CMMC program development to <br />
gauge industry’s capability to provide <br />
the necessary ecosystem accreditation <br />
and management functions. They <br />
asserted no response was provided to <br />
their RFI response.
 
One comment suggested the CMMC
 
PMO should develop a process to act as <br />
the authoritative source for assessment <br />
interpretations to ensure consistency. <br />
One person asked which DoD office <br />
authored the rule. Another noted the <br />
realignment of the CMMC PMO from <br />
OUSD(A&amp;S) to DoD CIO and asked <br />
whether this indicated a lack of <br />
OUSD(A&amp;S) involvement in the <br />
program. One commenter noted that <br />
DoD Program Managers and requiring <br />
activities have a role in the CMMC <br />
Program and suggested that their <br />
responsibilities for marking and <br />
managing CUI be added to the rule.
 
One commenter wanted to require
 
DIBCAC assessors to complete CCP and
 
CCA training and certification exams <br />
through a CAICO approved licensed <br />
training provider.
 
''Response: ''DoD agreed with the
 
commenter that the government does <br />
not have authority over transactions <br />
between the OSC and C3PAO. The roles <br />
and responsibilities of the government <br />
are set forth in § 170.6. The interaction <br />
between the CMMC Accreditation Body <br />
and C3PAOs is governed by the <br />
requirements of this rule in §§ 170.8 and <br />
170.9, including Conflict of Interest, <br />
Code of Professional Conduct, and <br />
Ethics policies, as well as ISO/IEC <br />
standards.
 
All DCMA DIBCAC assessors comply
 
with DoD regulations regarding the <br />
cybersecurity workforce, to include DoD <br />
Directives 8140 and 8570 and other <br />
internal training standards. DCMA <br />
DIBCAC assessors’ credentials for <br />
CMMC Levels 2 and 3 exceed the <br />
training that CCPs and CCAs complete <br />
through Approved Training Providers <br />
and include industry certification and a <br />
security clearance. Additionally, DCMA <br />
DIBCAC assessors must take the CMMC <br />
certification examinations.
 
DoD’s contract with the CMMC AB
 
assigned places responsibility for Level <br />
2 assessment interpretation to the <br />
CMMC Accreditation Body. The CMMC <br />
Accreditation Body publishes <br />
assessment procedures and guidance for <br />
C3PAO’s conducting CMMC Level 2 <br />
Certification Assessments. The CMMC <br />
AB is required to provide the CMMC <br />
PMO with all plans or changes related <br />
to its own activities and activities <br />
within the CMMC Ecosystem for review <br />
prior to implementation and <br />
publication. The DCMA DIBCAC is <br />
responsible for CMMC Level 3 <br />
assessment interpretation and will use <br />
the same process that is used for <br />
DIBCAC High Assessments.
 
Management oversight of the CMMC
 
Program was realigned from the <br />
OUSD(A&amp;S) to the Office of the DoD <br />
CIO for better integration with the <br />
Department’s other DIB cybersecurity <br />
related initiatives. Comments pertaining <br />
to DoD’s organizational structure are not <br />
relevant to the content of this rule. The <br />
DoD CIO is responsible for all matters <br />
relating to the DoD information <br />
enterprise, including network policy <br />
and standards and cybersecurity. In this <br />
capacity, the DoD CIO prescribes IT <br />
standards, including network and <br />
cybersecurity standards. The DoD CIO <br />
oversees programs to enhance and <br />
supplement DIB company capabilities to <br />
safeguard DoD information that resides <br />
on or transits DIB unclassified <br />
information systems.
 
The DoD reviewed and assessed
 
whitepapers that were submitted by RFI
 
respondents and determined that no <br />
single respondent could meet all the <br />
broad facets required to serve as the <br />
CMMC Accreditation Body.
 
§§ 170.8, 170.9, and 170.10 document
 
the roles of the CMMC AB and the <br />
CAICO in managing a complaints/ <br />
appeals process for CCAs, CCPs, and <br />
C3PAOs. OSCs concerned about the <br />
results of a Level 2 or Level 3 <br />
Certification assessment have a route of <br />
appeal documented in § 170.9. DoD, as <br />
the contracting entity, is not subject to <br />
service level agreements. Vendors and <br />
prospective vendors can voice concerns <br />
with the relevant contracting officer. <br />
External organizations may utilize <br />
existing DoD procedures to file <br />
complaints or concerns against any DoD <br />
organization.
 
This rule establishes requirements for
 
the conduct of assessments, as well as <br />
the requirements for handling of <br />
disputes, to include an appeals process. <br />
In the roles established by this rule, <br />
C3PAOs and the CMMC AB execute <br />
program requirements as codified in the <br />
32 CFR part 170 CMMC Program rule, <br />
with appropriate DoD oversight. For <br />
ISO/IEC 17020:2012(E) and ISO/IEC <br />
17011:2017(E) compliance, an appeals <br />
process is required. Appeals are <br />
addressed in §§ 170.8(b)(16) and <br />
170.9(b)(9), (14), (20), and (21).
 
The DoD declines to update the rule
 
content of § 170.6 to include a new <br />
subsection on DoD PMs and requesting <br />
activities and their responsibilities <br />
regarding marking CUI as that subject <br />
matter is already addressed for the DoD. <br />
DoD Instruction 5200.48 on CUI <br />
establishes policy, assigns <br />
responsibilities, and prescribes <br />
procedures for CUI throughout the DoD <br />
in accordance with 32 CFR part 2002, <br />
CFR for CUI to include 32 CFR 2002.20 <br />
Marking CUI; and 48 CFR 252.204–7008 <br />
and DFARS clause 252.204–7012. The <br />
CMMC Program requirements make no <br />
change to existing policies for <br />
information security implemented by <br />
the DoD.
 
The DoD declined to modify the rule
 
to further define the existing CMMC <br />
PMO oversight responsibilities, <br />
identified in § 170.6, which includes the <br />
CMMC AB and all other aspects of the <br />
program.
 
b. CMMC-AB
 
''Comment: ''There were multiple
 
comments regarding the CMMC <br />
Accreditation Body (AB). Ten comments <br />
were not relevant to the rule text. <br />
Multiple commenters asked about <br />
mechanisms to monitor the CMMC AB <br />
and how the DoD provides oversight. <br />
Seven comments provided valuable <br />
editorial recommendations that
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00029
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83120 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
enhanced the existing rule text. Seven <br />
comments also raised concerns and <br />
asked for clarification about certification <br />
of the CMMC AB, its standing with <br />
international accreditation bodies and <br />
the effects of that standing on the <br />
C3PAOs. Two comments sought clarity <br />
on the CMMC AB’s responsibilities and <br />
what resources they will provide to the <br />
CMMC ecosystem. One comment <br />
suggested incorporation by reference of <br />
specific CMMC AB generated artifacts. <br />
One comment requested clarity on terms <br />
and definitions regarding the CMMC <br />
AB.
 
''Response: ''Some comments received
 
lacked relevance to the rule’s content, <br />
including the establishment of outside <br />
entities. The DoD declines to respond to <br />
speculative or editorial comments about <br />
private citizens or entities, which are <br />
outside the scope of this rule. The DoD <br />
declines to respond to requests for <br />
documents related to the CMMC AB and <br />
the CAICO that lack relevance to the <br />
CMMC rule.
 
The term CMMC Accreditation Body
 
is a generic term for whichever <br />
accreditation body is supporting the <br />
DoD at a given time. The rule has been <br />
updated to remove reference to any <br />
specific accreditation body. There is <br />
only one Accreditation Body for the <br />
DoD CMMC Program at any given time, <br />
and its primary mission is to authorize <br />
and accredit the C3PAOs. The <br />
Accreditation Body does not issue <br />
certifications. The current CMMC AB is <br />
under a no-cost contract that has <br />
followed normal DoD contracting <br />
procedures. The DoD declines to delete <br />
the section outlining requirements for <br />
the CMMC AB, which are enduring and <br />
apply irrespective of which entity the <br />
DoD has currently approved to serve in <br />
that capacity.
 
This rule identifies the requirements
 
for the Accreditation Body’s role in the <br />
CMMC Ecosystem. The DoD has a <br />
variety of options available to address <br />
the commenter’s concern should the <br />
current CMMC AB not be able to fulfill <br />
this role. These include but are not <br />
limited to, contracting with a new/ <br />
replacement Accreditation Body. And <br />
authorized and accredited C3PAOs <br />
would be able to continue conducting <br />
CMMC assessments.
 
§ 170.8(b)(6) requires the CMMC AB
 
to complete a CMMC Level 2 assessment <br />
conducted by DCMA DIBCAC that must <br />
meet all CMMC Final Level 2 <br />
certification assessment requirements <br />
and will not result in a CMMC Level 2 <br />
certification. This requirement for an <br />
assessment is based on the potential <br />
compilation of sensitive information on <br />
the CMMC AB’s information systems. <br />
After the CMMC AB’s successful
 
completion of this Level 2 assessment, <br />
the DoD reserves the right to send CUI <br />
to the CMMC AB, as appropriate.
 
Requirements for the CMMC AB,
 
detailed in § 170.8(b) of this rule, <br />
include DoD requirements to comply <br />
with Conflict of Interest, Code of <br />
Professional Conduct and Ethics <br />
policies as set forth in the DoD contract <br />
with the AB. § 170.8(b)(3) details the <br />
ISO/IEC requirements the CMMC AB <br />
must meet and the timeline for meeting <br />
them. § 170.8(b)(3)(i) and (ii) further <br />
detail the requirements for the CMMC <br />
AB to authorize and accredit C3PAOs. <br />
The CMMC AB is under contract with <br />
the DoD and must fully comply with the <br />
contract requirements.
 
The CMMC rule was updated to
 
clarify that the CMMC AB must be a <br />
U.S.-based signatory to the International <br />
Laboratory Accreditation Cooperation <br />
Mutual Recognition Arrangement <br />
within 24 months of DoD approval and <br />
must operate in accordance with ISO/ <br />
IEC 17011:2017(E). The rule was also <br />
updated to clarify that a disqualifying <br />
eligibility determination may result in <br />
the CMMC AB losing its authorization <br />
or accreditation under the CMMC <br />
Program.
 
All CMMC ecosystem members are
 
required to abide by the appropriate <br />
ethics and conflicts of interest policies <br />
established by the CMMC AB and <br />
CAICO. Rule content pertaining to <br />
ethics, quality assurance functions, <br />
record keeping, data encryption, <br />
security, etc. functions across the <br />
ecosystem are tailored to reflect the role <br />
each entity fills in the ecosystem. The <br />
CMMC AB is not an agency of the <br />
Federal government; it is a private <br />
sector organization operating under <br />
contract with the DoD. As described in <br />
§ 170.6(a), the Office of the Department <br />
of Defense Chief Information Officer <br />
(DoD CIO) provides oversight of the <br />
CMMC Program and is responsible for <br />
establishing CMMC assessment, <br />
accreditation, and training requirements <br />
as well as developing and updating <br />
CMMC Program implementing <br />
guidance. The Accreditation Body must <br />
be under contract with the DoD. The <br />
rule has been modified to include <br />
additional CMMC AB oversight <br />
responsibilities for the CMMC PMO. <br />
The Department declines to incorporate <br />
CMMC AB generated artifacts into the <br />
rule by reference. The responsibilities of <br />
the DoD CIO and CMMC PMO are <br />
outlined in § 170.6 and the <br />
responsibilities of the Accreditation <br />
Body are outlined in § 170.8.
 
The DoD acknowledges that the
 
CMMC AB may not offer both <br />
accreditation services and certification <br />
services. DoD declines to make edits to
 
these sections as they are in alignment <br />
with the roles and responsibilities of the <br />
CMMC AB. The DoD has revised <br />
§ 170.8(b)(17)(i)(C) in the rule to clarify <br />
that the ‘‘CMMC activities’’ which <br />
former Accreditation Body members are <br />
prohibited from include any or all <br />
responsibilities described in Subpart C <br />
of this rule.
 
The rule was updated to indicate that
 
C3PAOs must also meet administrative <br />
requirements as determined by the <br />
CMMC AB. It was also updated to <br />
clarify that the term ‘‘independent <br />
assessor staff’’ in § 170.8(b)(4) refers to <br />
independent CMMC Certified Assessor <br />
staff, and to clarify the meaning of the <br />
term ‘‘members’’ at § 170.8(b)(17)(i)(B). <br />
DoD declines to modify § 170.8(b)(15) to <br />
include the phrase ‘‘technical accuracy <br />
and alignment with all applicable legal, <br />
regulatory, and policy requirements’’, as <br />
this does not result in a substantive <br />
change to the requirements as currently <br />
specified.
 
c. C3PAOs
 
''Comment: ''Clarification was requested
 
regarding C3PAOs’ timelines for <br />
accreditation and their dependencies on <br />
the CMMC AB accreditation process. <br />
Some commenters requested additional <br />
time. Clarification was also requested on <br />
the current disposition of authorized <br />
C3PAOs. A few comments asked for <br />
simplification and clarification of the <br />
difference between the terms <br />
‘‘authorized’’ and ‘‘accredited’’ with the <br />
establishment of C3PAOs. One comment <br />
requested that the rule be edited to <br />
require full compliance before C3PAOs <br />
can conduct certifications, and that <br />
duplicative language relating to ethics, <br />
record keeping, etc., be moved to a <br />
central location in the rule. One <br />
commentor questioned whether <br />
§ 170.9(b)(16), which states ‘‘Ensure that <br />
all CMMC assessment activities are <br />
performed on the information system <br />
within the CMMC Assessment Scope’’, <br />
applies to all C3PAO personnel or just <br />
those involved in the Quality Assurance <br />
process.
 
Other comments objected to the
 
requirement that C3PAOs obtain a <br />
CMMC Level 2 certification assessment <br />
because the assessment does not result <br />
in a Level 2 certification. They asked <br />
whether this would require two separate <br />
assessments every three years for <br />
C3PAOs that also conduct contractor <br />
work for DoD. Two comments requested <br />
clarification on determining the scope <br />
for a CMMC Level 2 assessment of a <br />
C3PAO to be used by DIBCAC, and if or <br />
when they would be required to obtain <br />
a FedRAMP Moderate certification. <br />
Also, clarification was requested on <br />
whether a C3PAO is permitted to
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00030
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83121 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
possess OSC CUI and other artifacts <br />
during the assessment so long as they <br />
are destroyed upon completion of the <br />
assessment. One comment suggested <br />
that all information collected by the <br />
C3PAO be encrypted.
 
Three comments asked for
 
clarification on what constitutes a <br />
C3PAO assessment team and whether it <br />
can consist of solely a Lead CCA. One <br />
commentor asked whether entities <br />
accredited under ISO 17020:2012(E) by <br />
another accreditation body, rather than <br />
the CMMC AB, meets CMMC C3PAO <br />
requirements. A couple of comments <br />
asked for clarification on whether a <br />
C3PAO could be foreign owned and <br />
participate in the current CMMC AB <br />
Marketplace.
 
''Response: ''One commenter
 
misinterpreted several sections of the <br />
CMMC rule. By defining the <br />
requirements in this rule to become a <br />
C3PAO, and defining a scoring <br />
methodology, the DoD is providing the <br />
authority and guidance necessary for <br />
C3PAOs to conduct assessments.
 
DoD considered many alternatives
 
before deciding upon the current CMMC <br />
structure. The DoD has established <br />
requirements for a CMMC Accreditation <br />
Body, and this accreditation body will <br />
administer the CMMC Ecosystem. The <br />
appeals process is defined in <br />
§§ 170.8(b)(16) and 170.9(b)(9), (14), <br />
(20), and (21). The DoD will not assume <br />
the workload of directly managing the <br />
CMMC ecosystem or the other <br />
alternatives suggested. DoD must treat <br />
all potential defense contractors and <br />
subcontractors fairly. DoD cannot <br />
inadvertently create a pathway to a free <br />
assessment for an organization by virtue <br />
of its dual-purpose as a C3PAO and <br />
separately as a defense contractor. <br />
Therefore, DoD assesses C3PAOs free of <br />
charge, but the assessment does not <br />
result in a Certificate of CMMC Status. <br />
The C3PAOs determine the people, <br />
processes, and technologies that are in- <br />
scope for their DIBCAC assessment to <br />
become a C3PAO. The need to protect <br />
the assessment information is <br />
independent of its status as FCI or CUI. <br />
Assessment information, such as which <br />
requirements are MET or not, as well as <br />
the evidence and analysis leading to <br />
that result, would provide valuable <br />
insights to an adversary if not protected. <br />
A C3PAO is not a CSP and therefore <br />
would not require a FedRAMP moderate <br />
assessment to be a C3PAO. However, if <br />
they use a CSP to process, store, or <br />
transmit assessment information, then <br />
the CSP would require a FedRAMP <br />
Moderate, or equivalent, assessment. <br />
The CSP assessment results and CRM <br />
would be in scope for the C3PAO <br />
assessment.
 
The requirements in § 170.9 apply to
 
both authorized and accredited <br />
C3PAOs. The only difference between <br />
authorization and accreditation is the <br />
status of the CMMC Accreditation Body. <br />
Prior to the CMMC AB achieving its full <br />
ISO/IEC 17011:2017(E) compliance, the <br />
interim term ‘‘authorized’’ is used for <br />
C3PAOs. As stated in §§ 170.8(b)(3)(i) <br />
and 170.9(b)(1) and (2), currently <br />
authorized C3PAOs must achieve and <br />
maintain compliance with ISO/IEC <br />
17020:2012(E) within 27 months of <br />
authorization. As stated in § 170.9(b)(6), <br />
C3PAOs must obtain a Level 2 <br />
certification assessment, but this does <br />
not result in a CMMC Level 2 certificate. <br />
The DoD declines to modify the rule <br />
text related to C3PAO requirements as it <br />
does not make a substantive change. <br />
Requirements are specified in the rule <br />
for each entity within the CMMC <br />
ecosystem.
 
A C3PAO may start preparing for
 
compliance with ISO/IEC 17020:2012(E) <br />
before the Accreditation Body achieves <br />
compliance with ISO/IEC <br />
17011:2017(E). The 27-month timeline <br />
for a C3PAO to achieve and maintain <br />
compliance with ISO/IEC 17020:2012(E) <br />
begins on the date that the C3PAO is <br />
authorized by the Accreditation Body, <br />
as addressed in § 170.9(b)(2) C3PAOs <br />
authorized by the CMMC AB prior to <br />
becoming compliant with ISO/IEC <br />
17020:2012(E) must be accredited by the <br />
CMMC AB within 27 months of the <br />
C3PAO’s initial authorization to meet <br />
CMMC program requirements. The <br />
accreditation process is not tied to, nor <br />
is it impacted by, the DoD’s <br />
appropriations period.
 
The rule has been updated to add
 
‘‘authorized’’ to the definition of a <br />
C3PAO. Authorized is defined in <br />
§ 170.4.
 
DoD disagrees with the suggestion
 
that certain C3PAO requirements are not <br />
needed or redundant. C3PAO’s must <br />
follow specific requirements for CMMC <br />
assessment record retention and <br />
disposition, audits, personal <br />
information, and CMMC Assessment <br />
Scope. Each paragraph number is <br />
independent, dependent sub-paragraphs <br />
are numbered with lower case Roman <br />
numerals. The requirement in <br />
§ 170.9(b)(16) applies to all C3PAO <br />
company personnel participating in the <br />
CMMC assessment process.
 
The size of a C3PAO assessment team
 
is variable based on factors including <br />
the scope of the assessment and the <br />
arrangements between the OSC and <br />
C3PAO. The rule has been updated in <br />
§ 170.9(b)(12) to clarify that, at a <br />
minimum, the assessment team must <br />
have a Lead CCA, as defined in <br />
§ 170.11(b)(10), and one other CCA. A
 
C3PAO is permitted to possess OSC CUI <br />
and artifacts during an assessment. <br />
CMMC Certified Assessors must use the <br />
C3PAO’s information technology which <br />
has received a CMMC Level 2 <br />
certification assessment as stated in <br />
§ 170.11(b)(7) and any copies of the <br />
OSC’s original artifacts must be <br />
destroyed when the assessment is <br />
complete as defined in § 170.9(1).
 
The DoD has considered the
 
recommendation to require encryption <br />
of all information and declines to revise <br />
the rule text, since the C3PAO is <br />
required in § 170.9(b)(6) to obtain a <br />
Level 2 certification assessment <br />
conducted by DCMA DIBCAC.
 
Several foreign or international
 
companies submitted comments <br />
expressing interest in the rule section <br />
pertaining to C3PAO requirements <br />
(§ 170.9(b)) and correctly noted that this <br />
section does not preclude otherwise <br />
qualified foreign companies from <br />
achieving C3PAO accreditation. Also, <br />
the DoD does permit C3PAO personnel <br />
who are not eligible to obtain a Tier 3 <br />
background investigation to meet the <br />
equivalent of a favorably adjudicated <br />
Tier 3 background investigation. DoD <br />
will determine the Tier 3 background <br />
investigation equivalence for use with <br />
the CMMC Program only.
 
d. CAICO
 
''Comment: ''Numerous comments
 
requested correction of perceived <br />
misstatements, oversights, or erroneous <br />
paragraph references in the CAICO <br />
responsibilities section. One commenter <br />
suggested the level of detail in <br />
§ 170.10(b) is more appropriate for a <br />
statement of work and some paragraphs <br />
could be deleted from the rule. They <br />
offered preferred rewording to clarify <br />
that the CAICO must also comply with <br />
AB and ISO/IEC requirements, and <br />
further recommended deleting the <br />
requirement to provide all <br />
documentation in English. In addition, <br />
they recommended deleting separation <br />
of duties as a requirement, because it is <br />
already required under ISO/IEC <br />
certification. One commenter conflated <br />
CAICO subcontractors with DIB <br />
subcontractors and suggested deletion of <br />
the rule’s restrictions on releasing <br />
CMMC-related information. One <br />
comment asked whether the Cyber AB <br />
and CAICO have documented processes <br />
for regular review and updates to their <br />
compliance documentation. Lastly, one <br />
comment requested duplicative <br />
language relating to ethics, record <br />
keeping, etc. be moved to a central <br />
location in the rule.
 
A few commenters suggested
 
preferred edits to improve the role of the <br />
CAICO. One comment noted that the
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00031
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83122 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
accreditor for certifying the CAICO <br />
should be a U.S.-based signatory to <br />
ILAC or relevant International <br />
Accreditation Forum (IAF) in addition <br />
to complying with ISO/IEC <br />
17011:2017(E). Two comments noted <br />
concerns that having only one CAICO <br />
would create an untenable bottleneck <br />
should something happen to the single <br />
CAICO. One commenter asserted that <br />
the CMMC Certified Instructor (CCI) <br />
certification requirement is redundant <br />
and not cost-effective since instructors <br />
will need to be certified as CCPs or <br />
CCAs to teach those courses. One <br />
comment suggested a grace period of <br />
18–24 months from final rule <br />
publication, to allow update of training <br />
and examinations, before implementing <br />
the CCP and CCA certification <br />
requirements. Three comments <br />
recommended that Approved <br />
Publishing Partner (APP) and Approved <br />
Training Providers (ATP) sections be <br />
added to Subpart C of the rule. One <br />
commenter asked for clarification on <br />
what constitutes a CAICO subcontractor <br />
and if this includes LTPs and LPPs, and <br />
asked why an authorization process for <br />
LTPs and LPPs is not included in the <br />
rule.
 
One commenter appreciated that
 
CAICO responsibilities include <br />
compliance with relevant ISO/IEC <br />
standards, as those are internationally <br />
recognized standards.
 
One commenter provided an
 
attachment containing an image of an <br />
article published in the February 2024 <br />
issue of National Defense Magazine. The <br />
commentor did not provide specific <br />
questions or comments regarding the <br />
article, they simply submitted an article. <br />
DoD declines to comment on the <br />
reposting of information being reported <br />
in the media.
 
''Response: ''The DoD declines to
 
comment on the reposting of <br />
information being reported in the <br />
media. This rule identifies requirements <br />
for the CAICO role in the ecosystem. <br />
The DoD has a variety of options <br />
available to address issues with reliance <br />
on a single CAICO. These include but <br />
are not limited to working with the <br />
CMMC AB to identify a new/ <br />
replacement CAICO.
 
The final rule includes a requirement
 
for the Accreditation Body, CAICO, and <br />
C3PAOs to adhere to appropriate ISO/ <br />
IEC standards, which include the <br />
current version of the standard for <br />
conformity assessment (ISO/IEC <br />
17024:2012(E) located at ISO website: <br />
[http://www.iso.org/standard/52993.html ''www.iso.org/standard/52993.html''). ]
 
All CMMC ecosystem members are
 
required inter alia to abide by the <br />
appropriate ethics and conflicts of <br />
interest policies established by the
 
CMMC AB and CAICO. Rule content <br />
pertaining to ethics, quality assurance <br />
functions, record keeping, data <br />
encryption, security, etc. functions <br />
across the ecosystem are tailored to <br />
reflect the role each entity fills in the <br />
ecosystem. Repeating this content in the <br />
section of each ecosystem role serves to <br />
emphasize the importance of adherence <br />
to these requirements.
 
DoD disagrees with the commenter’s
 
suggestion that certain CAICO <br />
requirements are not needed or are <br />
redundant. The DoD requirement for <br />
documentation in English refers to <br />
official information provided to the <br />
Accreditation Body or the DoD. The <br />
commenter’s preferred rewording of <br />
§ 170.10(b)(3) is unnecessary because <br />
there is a separate requirement for the <br />
CAICO to meet ISO/IEC standards, and <br />
this rule does not codify non-DoD <br />
requirements. The DoD declines to <br />
remove the requirement in <br />
§ 170.10(b)(10) to provide status <br />
information to the CMMC AB because it <br />
is necessary for program management. <br />
The rule retains the separation of duties <br />
requirement at § 170.10(b)(11), which is <br />
more specific than the management of <br />
impartiality required under ISO/IEC <br />
17024:2012(E).
 
The DoD declines to delete
 
certification requirements for CCI. <br />
Having the technical background as a <br />
CCP or CCA does not ensure all the <br />
instructor-unique qualifications <br />
necessary to be a CCI are met. The DoD <br />
also declines to remove the reference to <br />
§ 170.10 from § 170.12(b)(1) since it is <br />
accurate that the CAICO certifies CCIs.
 
Section § 170.10(b)(13) ensures that
 
personal information is encrypted and <br />
protected in all CAICO information <br />
systems and databases and those of any <br />
CAICO training support service <br />
providers. DoD disagrees with the <br />
commentor’s statement that training <br />
support service providers of the CAICO <br />
be allowed to disclose information <br />
about CCAs and/or CCPs. § 170.10 <br />
references the CAICO requirements. <br />
Entities providing training support <br />
services to the CAICO are not a part of <br />
the assessment process in the <br />
ecosystem. It is not up to them to release <br />
data on certified persons in the <br />
ecosystem. Any metrics regarding <br />
certifications will come from the <br />
CAICO.
 
DoD declines to add Approved
 
Publishing Partner (APP) and Approved <br />
Training Providers (ATP), or sections to <br />
the rule. The CMMC Program defines <br />
the requirements for the ecosystem. <br />
Specific requirements for publishing <br />
and training guidelines are determined <br />
by the CAICO and do not require the <br />
oversight of the DoD. The CMMC Rule
 
does not use the term Licensed Training <br />
Provider (LTP), as the LTPs are not <br />
required to be licensed. The acronym <br />
ATP means Approved Training Provider <br />
which encompasses the same role in the <br />
CMMC Ecosystem. The DoD does not <br />
intend to further delay implementation <br />
of CMMC to provide an 18 to 24-month <br />
grace period from the official release of <br />
the rule to build curriculum.
 
The DoD has reviewed commenter
 
recommendations and revised the rule <br />
as follows:
 
The CMMC rule has been updated to
 
state that the CAICO must be accredited <br />
by a U.S. based signatory to ILAC or <br />
other relevant IAF mutual recognition <br />
arrangements and operate in accordance <br />
with ISO/IEC 17011:2017(E). The DoD <br />
has removed the term ‘‘practitioner’’ <br />
from § 170.10(b)(8) for clarity and <br />
changed the term subcontractor to <br />
training service support provider.
 
e. CCPs and CCAs
 
''Comment: ''Some comments requested
 
DoD’s response to speculations about <br />
market forces, competitiveness of the <br />
CMMC Certified Professional (CCP) and <br />
CMMC Certified Assessment (CCA) <br />
roles and career opportunities, assessor <br />
burnout, complexity of CMMC <br />
ecosystem, and a limited assessor pool.
 
Several comments identified
 
administrative changes or preferred <br />
rewording or reordering of the CCP and <br />
CCA sections of the ecosystem <br />
requirements. For example, two <br />
commenters objected to repeating the <br />
requirement to meet CoPC and COI <br />
requirements for each Ecosystem <br />
member in § 170.8. Another comment <br />
requested deletion of the requirement <br />
for all documentation and records to be <br />
provided in English.
 
One commenter recommended
 
revising proficiency and experience <br />
requirements for CCPs, CCAs, and Lead <br />
CCAs. Another requested clarification <br />
on what requirements govern the <br />
certification of a CCA and requested the <br />
rule allow the CAICO to establish the <br />
certification validity period. One <br />
comment recommended all additional <br />
assessor certification requirements in <br />
§ 170.11(b)(6)(ii) be removed from the <br />
rule, so that only those prerequisite <br />
training requirements identified by the <br />
CAICO would apply.
 
Another comment suggested that a
 
requirement prohibiting assessors from <br />
use of personally owned IT that is <br />
contained in the CCA section at § 170.11 <br />
also be added to the C3PAO <br />
requirements section at § 170.9. Two <br />
commenters objected to the restrictions <br />
on CCAs sharing information with <br />
people outside the assessment team.
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00032
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83123 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
One comment questioned the
 
requirement for a Tier 3 background <br />
investigation for CCPs and another <br />
suggested the validity period of CCP <br />
certification should be determined by <br />
the CAICO. Yet another comment <br />
suggested changing certification periods <br />
from 3 to 4 years for those certified prior <br />
to the rule becoming effective. One <br />
comment suggested there is insufficient <br />
clarity regarding the role CCPs may play <br />
in an assessment and another asked <br />
whether a CCPs was allowed to review <br />
more than just Level 1 requirements. <br />
Two other comments recommended <br />
updating CCP training to include Level <br />
2 practices. Another comment noted <br />
that assessor cannot be robotic and that <br />
they must be allowed to evaluate the <br />
situation as it pertains to the company <br />
being evaluated.
 
One comment asked for clarification
 
on Lead CCA requirements and <br />
requested a reduction in the <br />
management experience to 2 years. Two <br />
other comments recommended adding <br />
IT and cybersecurity experience as <br />
relevant skills. One comment also <br />
recommended that Lead CCAs have <br />
industry-specific knowledge of the <br />
industry in which the OSC being <br />
assessed participates. Another comment <br />
requested clarification whether years of <br />
experience are cumulative for the Lead <br />
CCA. One comment recommended <br />
changing the name of Lead CCA and <br />
adding roles and responsibilities <br />
requirements. One stated that the rule’s <br />
CCA prerequisites is too low a skill set <br />
and recommended increasing the <br />
requirements for both CCAs and Lead <br />
CCAs. While another comment noted <br />
the rule referenced both DoD Manual <br />
8570 and DoD Manual 8140.03 and one <br />
or the either should be used.
 
One commenter suggested that should
 
sufficient assessors not be available to <br />
meet demand, the DoD should provide <br />
a delay or ‘‘grace period’’ to meet <br />
certification requirements.
 
''Response: ''The CMMC rule provides
 
detail on anticipated impacts on the DIB <br />
in the Impact and Cost Analysis <br />
summary of the preamble. Speculation <br />
on market forces on roles in the CMMC <br />
ecosystem such as CCPs and CCAs are <br />
outside of the scope of the CMMC <br />
program rulemaking. Likewise, <br />
limitations on career opportunities and <br />
associated issues such as burn-out or job <br />
satisfaction are beyond the scope of the <br />
program.
 
The DoD updated the rule to clarify
 
that CCAs must meet all the <br />
requirements set forth in § 170.11(b) and <br />
modified the rule in § 170.10(b)(10) to <br />
include CMMC Certified Professionals <br />
(CCPs). § 170.13(b)(6) was changed to <br />
conform to rule text in § 170.11(b)(9)
 
and to clarify with whom information <br />
may be shared.
 
The DoD determined the certification
 
requirements specified in § 170.11(b)(6) <br />
meet the needs of ensuring certified <br />
assessors have the required depth of <br />
cybersecurity knowledge and <br />
experience that is beyond what the <br />
CMMC-specific training provides.
 
The DoD disagreed with the comment
 
that the CAICO should determine the <br />
length of time a CCP certification is <br />
valid. DoD has a significant interest in <br />
ensuring the quality of assessors in the <br />
CMMC ecosystem and the currency of <br />
their training. The DoD does not agree <br />
with the assertion that managerial, and <br />
personnel related skills are most <br />
relevant for success as a Lead Assessor. <br />
As written, § 170.11 of the rule requires <br />
Lead Assessors to have a balance of <br />
technical and managerial expertise. A <br />
Lead Assessor also requires assessment <br />
or audit experience. The DoD views <br />
these skills as the minimum required to <br />
adequately provide the technical <br />
guidance and managerial oversight of <br />
the assessment team. The DoD declined <br />
to revise the rule to specify IT and/or <br />
Cybersecurity for the required audit <br />
experience.
 
The DoD also disagreed with a
 
recommendation to require Lead CCAs <br />
to have industry-specific knowledge of <br />
the industry in which the OSC being <br />
assessed participates. The DoD found <br />
that this requirement would <br />
unreasonably restrict C3PAOs from <br />
participating in a broad range of <br />
assessments and could have a negative <br />
effect on the ability of the DIB to <br />
schedule CMMC Level 2 certification <br />
assessments. The OSC can select a <br />
C3PAO with the experience it considers <br />
valuable.
 
The DoD declined a commentor’s
 
request to modify the rule to allow the <br />
CAICO to determine the requirement for <br />
the frequency of CCA/CCP certification. <br />
The DoD considers the 3 years <br />
certification period a key CMMC <br />
program requirement that will be <br />
enacted and managed by the CAICO. <br />
The DoD also declined to change the <br />
rule to extend the certification timeline <br />
to 4 years for those earning a <br />
certification prior to completion of <br />
rulemaking. Additionally, the DoD did <br />
not accept the recommendation to <br />
remove the requirement for providing <br />
documentation in the English language, <br />
which applies to all official information <br />
that would be provided to the CAICO, <br />
CMMC AB, or the DoD.
 
The DoD disagreed with a
 
commenter’s recommendation to <br />
remove the second sentence in <br />
§ 170.11(b)(7) that prohibits individual <br />
assessors from using any IT other than
 
that provided to them by the C3PAO <br />
that has been contracted to perform that <br />
OSA’s assessment. This sentence is <br />
required to eliminate ambiguity, <br />
particularly for C3PAOs that may have <br />
implemented a BYOD program or that <br />
allow some work roles to use personal <br />
devices. The DoD updated the rule to <br />
provide additional clarity.
 
The DoD does not concur with the
 
comment calling for a DoD Manual <br />
8140.03 requirement on CCAs. <br />
Assessment teams are required to have <br />
a Lead Assessor who must meet the <br />
higher level of the DoDM 8140.03 <br />
requirements. The rule has been <br />
updated to remove reference to DoD <br />
Manual 8570.
 
The experience requirements
 
referenced for the Lead CCA are <br />
cumulative. The rule has been updated <br />
to move Lead CCA requirements to the <br />
end of § 170.11, but not to create a new <br />
section.
 
The DoD disagreed with the
 
commenter’s assertion that Assessors <br />
are robotic. Assessors will go through <br />
CMMC training and will assess each <br />
unique CMMC Assessment Scope, as <br />
defined by the OSA, against the security <br />
requirements. As specified in <br />
§ 170.13(a) CCPs can participate on <br />
CMMC Level 2 certification assessments <br />
with CCA oversight where the CCA <br />
makes all final decisions. Updates to <br />
training are beyond the scope of this <br />
rule. Statements made in training <br />
materials produced prior to final <br />
adoption of the CMMC rule are beyond <br />
the scope of CMMC rulemaking. DoD <br />
disagrees with the comment that <br />
§ 170.13 does not provide sufficient <br />
detail regarding the role CCPs may play <br />
in an assessment. The requirement in <br />
the rule that ‘‘with CCA oversight where <br />
the CCA makes all final determinations’’ <br />
provides sufficient flexibility to adapt to <br />
a wide variety of assessments while <br />
ensuring the responsibility for <br />
assessment findings rests with the CCA <br />
and Lead CCA.
 
The rule restates COI and CoPC
 
requirements in each ecosystem section <br />
because all CMMC ecosystem members <br />
are required to abide by the appropriate <br />
ethics and conflicts of interest policies <br />
established by the CMMC AB and the <br />
CAICO. Rule content pertaining to <br />
ethics, quality assurance functions, <br />
record keeping, data encryption, <br />
security, and other functions across the <br />
ecosystem are tailored to reflect the role <br />
each entity fills in the ecosystem.
 
DoD CIO, in coordination with OUSD/
 
I&amp;S, evaluated the requirements for the <br />
CMMC Ecosystem. Based on the access <br />
to sensitive unclassified information, a <br />
Tier 3 background investigation that <br />
results in determination of national
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00033
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83124 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
security eligibility is required. <br />
§ 170.13(a) states that a CCP is eligible <br />
to participate in Level 2 certification <br />
assessment with CCA oversight and is <br />
eligible to become a CCA and will <br />
receive additional training and testing <br />
per the requirements in § 170.11.
 
The phased implementation plan
 
described in § 170.3(e) is intended to <br />
address ramp-up issues and provide <br />
time to train the necessary number of <br />
assessors. DoD has updated the rule to <br />
add an additional six months to the <br />
Phase 1 timeline.
 
e. CCI
 
1. Training and Training Materials
 
''Comment: ''One comment mistook the
 
requirement to ‘‘provide all <br />
documentation and records in English’’ <br />
as applying to training materials. Four <br />
comments expressed concerns about the <br />
requirements for confidentiality <br />
surrounding training records. These <br />
concerns arose primarily from a <br />
misinterpretation of the requirement to <br />
‘‘keep confidential all information <br />
obtained during the performance of <br />
CMMC training activities’’ to mean a <br />
requirement to keep the training <br />
materials themselves confidential, <br />
rather than keeping student records <br />
confidential.
 
''Response: ''The requirement to
 
‘‘provide all documentation and records <br />
in English’’ refers to official information <br />
that would be provided to the CMMC <br />
Assessor and Instructor Certification <br />
Organization (CAICO) or the DoD. The <br />
terms do not pertain to all materials <br />
used in the delivery of a course. The <br />
DoD disagreed with the <br />
recommendation to delete the <br />
§ 170.12(b)(7) requirement for keeping <br />
CMMC training records and information <br />
confidential. ‘‘Training activities’’ do <br />
not include course material. The <br />
example in § 170.12(b)(7) (student <br />
records) makes clear the type of data <br />
covered by the rule.
 
2. Time Limits and Other Constraints
 
''Comment: ''One comment
 
recommended that the CAICO, instead <br />
of the DoD, determine the frequency of <br />
CMMC Certified Instructor (CCI) <br />
certification. Another requested <br />
clarification on the length of time that <br />
a CCI may not provide consulting <br />
services. One comment recommended <br />
changing the rule to require CCIs to <br />
provide updates to the CAICO and the <br />
CMMC AB no less than annually, in lieu <br />
of ‘‘most up to date’’.
 
Two comments expressed concern
 
that CCIs are not allowed to provide <br />
consulting services to OSCs; one of the <br />
comments asserted this would result in
 
reduced quality of training for CMMC <br />
Certified Professionals (CCP) and <br />
CMMC Certified Assessors (CCA). One <br />
comment expressed disagreement with <br />
the requirement prohibiting CCIs from <br />
exam development and exam <br />
proctoring. Another comment <br />
recommended a rule update indicating <br />
CCIs can teach both CCA and CMMC <br />
Certified Professional (CCP) candidates.
 
''Response: ''The DoD declined a
 
commenter’s request to modify the rule <br />
to allow the CAICO to determine the <br />
requirement for validity period of a CCI <br />
certification. The DoD considers the 3- <br />
year certification period for CCIs as a <br />
key CMMC program requirement that is <br />
to be enforced by the CAICO.
 
The DoD modified § 170.12(b)(4) to
 
read ‘‘annually’’ instead of ‘‘most up to <br />
date’’ to clarify the reporting <br />
requirement.
 
All CMMC ecosystem members are
 
required to abide by the appropriate <br />
ethics and conflicts of interest (COI) <br />
policies established by the CMMC AB <br />
and CAICO. Rule content pertaining to <br />
ethics, quality assurance functions, <br />
record keeping, data encryption, <br />
security, and other functions across the <br />
ecosystem are tailored to reflect the role <br />
each entity fills in the ecosystem. The <br />
DoD defined COI requirements to <br />
reduce the possibility that a CMMC <br />
Ecosystem member acting in one <br />
capacity may bias, or be biased by, <br />
clients that are paying them to perform <br />
another CMMC related service. CCIs are <br />
not permitted to develop or proctor <br />
exams to avoid participating in any <br />
activity, practice, or transaction that <br />
could result in an actual or perceived <br />
conflict of interest.
 
3. Relationship to CAICO and Other <br />
Ecosystem Members
 
''Comment: ''One comment asked why
 
the rule does not include requirements <br />
for LTPs, and another requested <br />
additional rule text to clarify the <br />
relationship between an ATP and the <br />
CAICO in administrative matters of <br />
students. One comment recommended <br />
not requiring CCIs to provide <br />
qualification and training information to <br />
the CAICO.
 
One comment recommended a
 
method for reducing a perceived <br />
redundancy in the rule text between <br />
ecosystem-related sections. Two <br />
comments asserted that a CCI <br />
certification is redundant because <br />
individuals attempting to become CCIs <br />
are already certified as CCPs or CCAs.
 
One comment asked that a new
 
requirement be added to the rule under <br />
§ 170.12 to address the transition of <br />
Provisional Instructors to CCIs.
 
''Response: ''The CMMC rule does not
 
use the term Licensed Training Provider <br />
(LTP), as training providers are not <br />
required to be licensed. The correct term <br />
for CMMC training providers is <br />
Approved Training Provider (ATP). The <br />
CMMC rule contains the requirements <br />
to create the training for the CMMC <br />
Program. § 170.10 contains the <br />
requirements for the CAICO to ensure <br />
compliance with ISO/IEC 17024:2012(E) <br />
and to ensure all training products, <br />
instruction, and testing materials are of <br />
high quality.
 
DoD disagreed with a comment to
 
delete a requirement in the rule for CCIs <br />
to update the CAICO regarding <br />
qualification, training experience, and <br />
other information relating to their <br />
competency to teach within the CMMC <br />
ecosystem. Viewing and verifying CCI <br />
qualifications is an important element of <br />
quality assurance in the CAICO’s role of <br />
training, testing, authorizing, certifying, <br />
and recertifying CMMC assessors, <br />
instructors, and related individuals.
 
§ 170.12(b) in the rule was updated to
 
add the requirement for a CCI to be <br />
certified at or above the level of training <br />
they are delivering. The DoD also <br />
modified § 170.12(a)(11) to add CMMC <br />
Certified Professional (CCP) candidates.
 
The DoD declined to remove the
 
certification requirement for CCIs. <br />
Although CMMC Certified Assessors <br />
have the technical background, that <br />
does not imply that they meet all the <br />
instructor-unique qualifications <br />
necessary to be a CCI.
 
The DoD modified § 170.12 to include
 
requirements for Provisional Instructors <br />
prior to their transition to a CMMC <br />
Certified Instructor. Any Provisional <br />
Instructor (PI) will be required to <br />
achieve certification under the CMMC <br />
Certified Instructor (CCI) program <br />
within 18 months of the final rule <br />
publication. The PI designation ends 18 <br />
months after the effective date of the <br />
rule.
 
f. Conflicts of Interest and Code of <br />
Professional Conduct
 
''Comment: ''Many commenters had
 
questions about existing CMMC conflict <br />
of interest (CoI) requirements and had <br />
suggestions for further protecting the <br />
impartiality of the CMMC Program. One <br />
commenter requested the Department <br />
develop a mechanism to prevent third- <br />
party assessment organizations from <br />
delaying re-evaluation of NOT MET <br />
requirements to create a pipeline of <br />
future assessment work. The commenter <br />
recommended removing the 10-day re- <br />
evaluation deadline requirement <br />
currently in the CMMC Rule to prevent <br />
any conflicts of interest. Another <br />
commenter stated that allowing a
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00034
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83125 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
commercial entity to manage the CMMC <br />
‘ecosystem’ creates a scenario ‘fox <br />
watching the henhouse’’ condition and <br />
that fraud and abuse will be rampant.
 
Some commenters questioned the
 
legality of the current CMMC AB’s <br />
establishment and alleged unethical <br />
behavior by its Board of Directors. They <br />
cited the number of resignations among <br />
its Board of Directors as evidence of <br />
internal politics, conflicts of interests, or <br />
ethics concerns. One commenter <br />
suggested the 6-month ‘‘cooling off <br />
period’’ between an employee leaving <br />
the CMMC AB and supporting other <br />
CMMC roles be extended to one year to <br />
ensure impartiality within the CMMC <br />
Program. Another commenter claimed <br />
an informational newsletter offered by <br />
the CMMC AB to ecosystem members <br />
violates the conflicts of interest <br />
requirements. In addition, commenters <br />
alleged that the CMMC AB’s progress <br />
(prior to final rule publication) toward <br />
ISO/IEC compliance violates the terms <br />
of its contract with DoD, which the DoD <br />
should terminate.
 
Commenters also stated that DoD’s
 
no-cost contract with the current CMMC <br />
AB has forced them to focus on <br />
generating revenue instead of building a <br />
CMMC Assessor cadre. One commenter <br />
cited publicly available tax filings of the <br />
current CMMC AB to substantiate that <br />
view. Another commenter noted <br />
concerns that the rule permits a timeline <br />
for meeting the ISO/IEC requirements, <br />
rather than requiring immediate <br />
compliance, and suggested that it would <br />
be more advantageous to cite different <br />
ISO/IEC requirements (for conformity <br />
assessment) than those identified in the <br />
rule.
 
One commenter wrote that significant
 
delays in CMMC implementation this <br />
far beyond the Department’s earlier <br />
objectives of 2020 constitute fraud and <br />
claimed that DoD representatives <br />
directed companies to comply with <br />
requirements that have become <br />
irrelevant due to changes in program <br />
requirements that occurred during <br />
rulemaking.
 
Many commenters stated the
 
Department needs to further clarify <br />
existing CoI requirements for CCIs, <br />
CCAs, and CCPs in the CMMC Rule text. <br />
Specifically, commenters suggested the <br />
DoD: <br />
—Revise § 170.12(b)(5) to state that CCIs
 
may serve on an assessment team for <br />
a student’s company, provided the <br />
CCI does not provide consulting to an <br />
OSC during delivery of the CMMC <br />
Instruction or breach other conflict of <br />
interest rules, and add that the CCI <br />
must ‘‘[b]e a currently certified CCA <br />
and conduct at least one certified or
 
mock assessment under the direction <br />
of a C3PAO annually.’’
 
—Revise § 170.12(b)(6) to allow CCIs to
 
craft exam objectives and content, as <br />
CCIs are the ‘‘most in tune with issues <br />
faced by candidate CCPs and CCAs.’’
 
—Strike § 170.12 altogether, because
 
potential CoIs will be rare and can be <br />
‘‘managed by existing conflicts of <br />
interest mechanisms’’; clarify that <br />
‘‘while serving as a CMMC instructor’’ <br />
means ‘‘limited only to while actively <br />
teaching or any time while the person <br />
holds the CCI certification’’; and that <br />
CoI concerns could be addressed by <br />
the addition of an Instructor Code of <br />
Conduct. One commenter also <br />
suggested this section would <br />
significantly decrease the available <br />
pool of CMMC instructors, as they <br />
would be forced to choose between <br />
instructing and consulting, which <br />
may be a more lucrative option. They <br />
also claimed it prevented CCIs who <br />
teach CCP/CCA courses at night from <br />
providing consulting services during <br />
the day.
 
—Impose a three- or four-year
 
prohibition on ecosystem members <br />
from participating in the CMMC <br />
assessment process for an assessment <br />
in which they previously served as a <br />
consultant or ‘‘since the OSC last <br />
obtained CMMC certification, <br />
whichever is most recent.’’
 
—Add language to §§ 170.11 and 170.13
 
to clarify if an individual consults <br />
with a defense industrial base <br />
company, they are prohibited from <br />
participating as a CMMC assessor for <br />
that same company.
 
—Update § 170.8(b)(ii)(17)(ii)(G) and
 
add a time limit to this requirement <br />
to ensure a consultant can perform <br />
assessments, given an appropriate <br />
amount of time has passed.
 
—Revise § 170.8(b)(17)(ii)(G) to say,
 
‘‘Prohibit CMMC Ecosystem members <br />
from participating in the CMMC <br />
assessment process for a CMMC <br />
assessment in which they previously <br />
served as an employee or consultant <br />
to prepare the organization for any <br />
CMMC assessment,’’ as both an OSC <br />
employee and a CCPA/CCP serving as <br />
a consultant would face identical CoI.
 
—Provide more detail on the scope of
 
CCA and CCP conflict of interest <br />
disclosure required, particularly <br />
around the definition of ‘‘process, <br />
store, or transmit’’ in § 170.4(b).
 
—More narrowly tailor the CoI
 
requirement in § 170.8(b)(17)(i)(D) <br />
and more expressly identify the <br />
‘‘perceived conflicts of interest’’ <br />
scenarios to help ecosystem members <br />
avoid legal risk.
 
—Rewrite § 170.8(b)(17)(iii)(C) to clarify
 
what constitutes a ‘‘satisfactory record <br />
of integrity and business ethics.’’
 
—Provide more detail in § 170.10(b)(11)
 
on the term ‘‘separation of duties,’’ so <br />
CCAs know whether they can <br />
volunteer to develop test questions or <br />
provide training. <br />
''Response Summary: ''Some comments
 
received lacked relevance to the rule’s <br />
content, which is limited to specific <br />
CMMC Program requirements. The DoD <br />
declines to respond to speculative or <br />
editorial comments about private <br />
citizens or entities, all of which are not <br />
within the scope of this rule. Personnel <br />
actions taken by the CMMC AB and <br />
comments regarding filing of IRS forms <br />
are not within the scope of this rule.
 
§ 170.8(b) of this final rule provides
 
requirements of the CMMC AB. CMMC <br />
Program requirements as described in <br />
this rule requires the CMMC <br />
Accreditation Body and the CAICO to <br />
have and abide by ethics and conflicts <br />
of interest rules and to have and <br />
maintain a Code of Professional <br />
Conduct (CoPC). § 170.8(b)(3) describes <br />
the ISO/IEC requirements and the <br />
timeline in which the CMMC AB needs <br />
to meet those requirements. The DoD <br />
declines to comment on business <br />
decisions made by the current CMMC <br />
AB in the performance of its CMMC <br />
related roles, responsibilities, and <br />
requirements. Based on information <br />
currently known to DoD, the CMMC AB <br />
is currently performing as defined in <br />
this final rule and the terms of the <br />
contract. The ANSI National <br />
Accreditation Body is performing the <br />
function of accrediting the CAICO, <br />
which is appropriate given its status as <br />
a subsidiary of the CMMC AB.
 
The DoD defined CMMC Conflict of
 
Interest requirements to reduce the <br />
possibility that a member of the CMMC <br />
Ecosystem acting in one capacity may <br />
bias, or be biased by, clients that are <br />
paying them to perform another CMMC <br />
related service. The rule text includes <br />
ethics requirements for members of the <br />
CMMC ecosystem, to include the CMMC <br />
AB (§ 170.8). The DoD concurred with <br />
some comments and has increased the <br />
cooling off period from six months to <br />
one year in § 170.8(b)(17)(i)(C).
 
DoD considered many alternatives
 
before deciding upon the current CMMC <br />
structure. The DoD has established <br />
requirements for a CMMC Accreditation <br />
Body, and this accreditation body will <br />
administer the CMMC Ecosystem. The <br />
phased CMMC implementation plan <br />
provides time to train the necessary <br />
number of assessors and, the rule has <br />
been updated to add an additional six <br />
months to the Phase 1 timeline.
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00035
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83126 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
The DoD requires that the
 
Accreditation Body must achieve and <br />
maintain compliance with the ISO/IEC <br />
17011:2017(E) standard (the <br />
international benchmark used in <br />
demonstrating an accreditation body’s <br />
impartiality, technical competency, and <br />
resources) and the requirements set <br />
forth in § 170.8. The CMMC Proposed <br />
rule also requires compliance with ISO/ <br />
IEC 17020:2012(E) for conformity <br />
assessments. § 170.12(b)(5) was revised <br />
to indicate that a CMMC instructor, <br />
subject to the Code of Professional <br />
Ethics and Conflict of Interest policies, <br />
may serve on an assessment team but <br />
cannot consult. CCIs are not permitted <br />
to develop or proctor exams to avoid <br />
participating in any activity, practice, or <br />
transaction that could result in an actual <br />
or perceived conflict of interest.
 
The CAICO is responsible to ensure
 
the separation of duties for individuals <br />
volunteering to assist with testing, <br />
training, and certification activities. An <br />
example of separation of duties is <br />
shown in § 170.12(b)(6), which specifies <br />
that a CCI cannot be involved in <br />
examination activities.
 
DoD modified § 170.8(b)(17)(ii)(G) to
 
add that a consultant is only limited <br />
from participation in the assessment <br />
process for 36 months. CMMC <br />
Ecosystem members do not participate <br />
in an assessor capacity on DIBCAC <br />
assessments. The DoD declined to add <br />
explicit requirements prohibiting <br />
ecosystem members from participating <br />
in an assessment of an OSC by whom <br />
they were previously employed (directly <br />
or as a consultant), because the scenario <br />
is already covered under <br />
§ 170.8(b)(17)(ii)(G).
 
DoD disagreed with the comments
 
that a CMMC Ecosystem member is <br />
unable to avoid perceived conflicts of <br />
interest. The Accreditation Body is <br />
required to provide a CoI policy in <br />
§ 170.8(b)(17) for CMMC Ecosystem <br />
members. The Department expects that <br />
a reasonable person subject to the CoI <br />
policy should understand how to avoid <br />
the appearance of conflicts of interest <br />
and, if unsure, seek clarity from the <br />
Accreditation Body. Details of the <br />
disclosure requirements are in the <br />
Accreditation Body conflict of interest <br />
policy.
 
A satisfactory record of integrity and
 
business ethics is a record that does not <br />
indicate derogatory behavior in relation <br />
to professional conduct or conflict of <br />
interest.
 
The DoD declined to remove the 10-
 
day re-evaluation deadline in <br />
§§ 170.17(c)(2) and 170.18(c)(2) to <br />
ensure consistency in the assessment <br />
process. The OSC may utilize the <br />
appeals process, as necessary. The DoD
 
is required to codify CMMC program <br />
requirements through a prescribed and <br />
formal rulemaking process. The timeline <br />
for CMMC implementation changed due <br />
in part to DoD’s decision to pause and <br />
assess the program, seek opportunities <br />
to streamline and ease the burden of its <br />
implementation, and respond to public <br />
comments. The DoD declines to respond <br />
to speculative or editorial comments <br />
regarding the actions of private citizens, <br />
which are not within the scope of this <br />
rule.
 
g. Ecosystem Eligibility
 
1. Foreign Ownership
 
''Comment: ''Two comments noted the
 
rule does not include Foreign <br />
Ownership, Control, or Influence (FOCI) <br />
requirements for the CAICO. One <br />
comment recommended the rule <br />
incorporate the definition of the <br />
‘‘national technology and industrial <br />
base’’ and exclude those companies <br />
from FOCI requirements. The NTIB <br />
includes organizations from the United <br />
States, the United Kingdom of Great <br />
Britain and Northern Ireland, Australia, <br />
New Zealand, and Canada that are <br />
engaged in research, development, <br />
production, integration, services, or <br />
information technology activities.
 
''Response: ''The CAICO has no FOCI
 
requirement because they do not have <br />
knowledge of the OSC’s network or <br />
potential vulnerabilities identified in <br />
the assessment process. Per <br />
§ 170.9(b)(5), the CMMC Program <br />
implements the FOCI program that is <br />
managed by DCSA. Potential FOCI <br />
exemptions are outside the scope of this <br />
32 CFR part 170 CMMC Program rule <br />
and must be addressed through <br />
international arrangements or <br />
agreements.
 
2. Personnel Security
 
''Comment: ''There were numerous
 
comments regarding the Tier 3 <br />
Personnel Security requirements. <br />
Several comments recommended <br />
editorial clarification. Multiple <br />
comments requested clarification on <br />
what ‘‘not eligible’’ meant and what is <br />
the ‘‘equivalent process’’. One comment <br />
recommended the Tier 3 background <br />
investigation be required for all <br />
authorized personnel while two <br />
comments recommended eliminating <br />
the Tier 3 background investigation <br />
requirement. Two other comments <br />
requested clarification on why a Tier 3 <br />
investigation is required when no secret <br />
information is handled and there is no <br />
clearance granted. Another comment <br />
requested clarification on the Tier 3 <br />
process. Three comments requested <br />
clarity on the citizenship requirements
 
and how the Tier 3 requirement will be <br />
enforced for international C3PAO’s.
 
Another comment recommended
 
adding a requirement for CMMC <br />
Instructors and Assessors to report to <br />
the CAICO within 30 days of conviction, <br />
or guilty pleas to certain crimes.
 
''Response: ''In coordination with the
 
OUSD/I&amp;S, the DoD CIO evaluated <br />
requirements for the CMMC Ecosystem. <br />
Based on the access to sensitive <br />
unclassified information, a Tier 3 <br />
background investigation that results in <br />
determination of national security <br />
eligibility is required as specified in this <br />
rule. The concept of ‘‘not eligible’’ in <br />
§ 170.9(b)(4) is intended to cover those <br />
applicants who do not meet the <br />
entrance requirements for a DCSA Tier <br />
3 background investigation, it is not an <br />
alternative for applicants who do not <br />
pass its Tier 3 background investigation. <br />
The DCSA maintains a record of all <br />
background investigation information in <br />
the Personnel Vetting Records system of <br />
records, DUSDI 02-DoD, as published in <br />
the '''Federal Register. '''The details of the <br />
Tier 3 background investigation are <br />
included in this rule to inform the <br />
public of the CMMC requirement and <br />
that the investigation will not result in <br />
a clearance. The DoD declines to remove <br />
reference to the Standard Form 86 from <br />
the rule. All documentation and records <br />
for the background investigation process <br />
must be provided in English; <br />
rulemaking as a Federal regulation <br />
requires this level of detail to ensure <br />
clarity of understanding and <br />
interpretation. Details about background <br />
investigation equivalency is available <br />
from DCSA at [http://www.dcsa.mil/Industrial-Security/International-Programs/Security-Assurances-for-Personnel-Facilities/ ''www.dcsa.mil/Industrial- <br />
Security/International-Programs/ <br />
Security-Assurances-for-Personnel- <br />
Facilities/''. As stated in the 32 CFR part <br />
]170 CMMC Program rule, C3PAOs must <br />
meet the criteria defined in section <br />
§ 170.9. If a non-U.S. organization, and <br />
its employees, meet all the requirements <br />
in § 170.9 and § 170.11, it would not be <br />
prohibited from operating as a C3PAO <br />
within the U.S. or abroad. The DoD <br />
declined to make recommended <br />
administrative changes to § 170.9(b)(3), <br />
because they did not result in a <br />
substantive change.
 
While a C3PAO may use its own
 
employees to staff an assessment, it also <br />
may leverage CCAs and CCPS who are <br />
independent contractors, rather than <br />
employees of a specific C3PAO. Because <br />
these independent CCAs and CCPs may <br />
not be covered by the C3PAO’s <br />
background check requirement, CMMC <br />
requires CCAs and CCPs to have their <br />
own Type 3 background checks or <br />
equivalent.
 
Section 170.10 has been updated to
 
specify the CAICO must require CMMC
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00036
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83127 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
Ecosystem members to report to the <br />
CAICO, within 30 days, if they are <br />
convicted, plead guilty, or plead no <br />
contest for certain specified legal <br />
matters or criminal activities.
 
h. ISO/IEC Standards
 
''Comment: ''Several comments
 
addressed ISO/IEC standards referenced <br />
in the proposed rule. Most of these were <br />
related to ISO/IEC 17020:2012(E). One <br />
commenter wanted to know what the <br />
proposed rule meant by ‘‘out-of-cycle <br />
from ISO/IEC 17020:2012(E).’’ Another <br />
felt the section outlining CMMC AB <br />
responsibilities should clarify that the <br />
CMMC PMO must approve all C3PAO <br />
accreditation requirements established <br />
by the Accreditation Body under ISO/ <br />
IEC 17020:2012(E). One person felt the <br />
rule should give C3PAOs more time to <br />
achieve compliance with ISO/IEC <br />
17020:2012(E) and one commenter <br />
asserted that including a revocation <br />
process in the CMMC PMO roles and <br />
responsibilities section was inconsistent <br />
with ISO/IEC 17020:2012(E) standards <br />
because the C3PAO was the certification <br />
body.
 
One comment asserted the
 
requirement in the rule for the CMMC <br />
AB to complete the ILAC Peer Review <br />
prior to accrediting C3PAOs is too <br />
onerous and not consistent with the <br />
ISO/IEC process for gaining <br />
international recognition as an <br />
accreditation body in accordance with <br />
ISO/IEC 17011:2017(E).
 
''Response: ''The rule was updated in
 
§ 170.8(a) to clarify responsibilities of <br />
the Accreditation Body. DoD agreed <br />
with the comment that the requirement <br />
to complete the Peer Review prior to <br />
accrediting C3PAOs was too onerous <br />
and inconsistent with the ISO/IEC <br />
process under ISO/IEC 17011:2017(E). <br />
The rule has been updated for clarity.
 
Using the terms of the ISO/IEC
 
17020:2012(E), the activity of the <br />
C3PAO is an ‘‘inspection’’, rather than <br />
a ‘‘certification’’. The C3PAO is an <br />
inspection body, not a certification <br />
body, and is responsible for conducting <br />
the Level 2 certification assessment <br />
[Inspection]. The rule was revised to <br />
delete terms related to granting or <br />
revoking certification assessment status. <br />
The DoD reserves the right to conduct <br />
a DCMA DIBCAC assessment of the <br />
OSA, as provided for under the DFARS <br />
clause 252.204–7012 and DFARS clause <br />
252.204–7020. DoD declines to extend <br />
the period for C3PAOs to achieve <br />
compliance with ISO/IEC <br />
17020:2012(E). The Department has <br />
determined that 27 months is reasonable <br />
and sufficient for a C3PAO to achieve <br />
compliance. The rule was also updated <br />
in § 170.9(b)(11) to clarify that audit
 
information must be provided upon <br />
request.
 
''14. Ecosystem Capacity ''
 
''Comment: ''Commenters expressed
 
concern that the demand for third-party <br />
assessments amongst the defense <br />
industrial base will exceed the capacity <br />
of available Certified CMMC Assessors <br />
and Certified CMMC Professionals and <br />
government assessors which may <br />
prevent timely and affordable audits or <br />
cause businesses to lose out on DoD <br />
contracts. To mitigate the concerns, one <br />
commenter suggested delaying phase-in <br />
of certification assessment by two years, <br />
by relying on self-assessment. One <br />
commenter warned of solicitation <br />
protests if companies are kept out of a <br />
competitive procurement due to a slow <br />
CMMC assessment process. Another <br />
suggested that insufficient assessors <br />
may shrink the market for DoD <br />
contractors and compromise assessment <br />
quality. Commenters were apprehensive <br />
that DoD projections for certification <br />
demand didn’t factor in all <br />
subcontractors and that the CMMC <br />
Accreditation Body lacks a strategy for <br />
scaling to meet increased C3PAO <br />
demand.
 
Additionally, one commenter pointed
 
out that the rule indicates companies <br />
can pursue a certification assessment at <br />
any time after the rule is published, <br />
which could tie up already limited <br />
C3PAO resources and impede <br />
assessment opportunities for other <br />
companies bidding on an upcoming <br />
contract. Another expressed concern <br />
that often-extensive travel times <br />
required for assessors to reach rural- <br />
based companies like electric <br />
cooperatives will disincentivize <br />
assessors from prioritizing these <br />
companies and prevent their timely <br />
assessment.
 
Commenters suggested several actions
 
the Department could take to mitigate <br />
capacity-related risks, including: <br />
extending the phase-in of Level 2 <br />
certification requirements; prioritizing <br />
companies for Level 2 phase-in; <br />
allowing C3PAOs to issue interim or <br />
conditional certifications when unable <br />
to timely complete contractor <br />
assessments; and waiving requirements <br />
for OSCs that are in the assessment <br />
process but not yet certified. Some <br />
asked that DoD forecast the volume and <br />
timing of Level 3 certification <br />
requirements and clearly communicate <br />
those assessment requirements with <br />
contractors. Another requested forecasts <br />
of both Level 2 and Level 3 assessment <br />
capacity against various demand <br />
scenarios for each certification level.
 
Several commenters suggested that
 
CMMC assessment requirements for
 
External Service Providers (ESPs) will <br />
also impede CMMC implementation, as <br />
ESPs (1) must be CMMC certified before <br />
an OSC can include them in their <br />
CMMC certification assessment scope <br />
and (2) will be competing with DIB <br />
companies for scarce C3PAO assessors. <br />
Commenters suggested ways to reduce <br />
burden on ESPs, which included: <br />
allowing use of non-compliant ESPs <br />
until Phase 3 and prioritizing <br />
certification assessments for ESPs ahead <br />
of other assessments.
 
Several commenters expressed
 
concern about CCA and CCP roles, <br />
based on perceived scarcity of <br />
candidates in the job market compared <br />
with demand for similar services. <br />
Concerns included the potential for <br />
CCA and CCP burnout from overwork, <br />
dissatisfaction with repetitive <br />
assessments tasks, limited career path in <br />
the roles, and the complexity of <br />
operating within the CMMC ecosystem. <br />
One commenter compared CCA and <br />
CCP roles with those of Certified Public <br />
Accountants and Certified Information <br />
System Auditors, who have access to <br />
more varied opportunities and <br />
industries.
 
''Response: ''DoD received numerous
 
comments about the use of ESPs which <br />
do not process, store, or transmit CUI. <br />
In response, the DoD revised the rule to <br />
reduce the assessment burden for ESPs. <br />
ESP assessment, certification, and <br />
authorization requirements in 32 <br />
CFR 170.19(c)(2) and (d)(2) have been <br />
updated. ESPs that are not CSPs and do <br />
NOT process, store, or transmit CUI, do <br />
not require CMMC assessment or <br />
certification. Services provided by an <br />
ESP are in the OSA’s assessment scope. <br />
The phased implementation plan <br />
described in § 170.3(e) is intended to <br />
address ramp-up issues, provide time to <br />
train the necessary number of assessors, <br />
and allow companies time to <br />
understand and implement CMMC <br />
requirements. The DoD has updated the <br />
rule to add an additional six months to <br />
the Phase 1 timeline. Phase 2 will start <br />
one calendar year after the start of Phase <br />
1. It is beyond the scope of this rule for <br />
DoD to determine the order in which <br />
organizations are assessed.
 
The DoD declined to delete text
 
stating that OSAs may elect to complete <br />
a self-assessment or pursue CMMC <br />
certification assessment to distinguish <br />
themselves as competitive because the <br />
recommendation did not result in a <br />
substantive change. CMMC rule <br />
describes anticipated impacts on the <br />
DIB in the Impact and Cost Analysis <br />
section. Speculation on market forces <br />
affecting the DIB is outside of the scope <br />
of the CMMC program. Speculation on <br />
market forces affecting CMMC
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00037
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83128 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
ecosystem CCP and CCA roles are also <br />
outside of the scope of the CMMC <br />
program. Likewise, limitations on career <br />
opportunities and associated issues <br />
such as burn-out or job satisfaction are <br />
beyond the scope of the program.
 
The DoD declines to comment on
 
external market factors impacting <br />
CMMC compliance. The seven-year <br />
timespan reflects the DoD’s estimate for <br />
all DIB members to achieve CMMC <br />
compliance. The implementation plan <br />
ramps up CMMC assessment <br />
requirements over 4 phases, such that <br />
the ecosystem will reach maximum <br />
capacity by year four. The DoD does not <br />
agree with commenter assertions that <br />
70,000 or more entities will require <br />
CMMC Level 2 assessment by October 1, <br />
2026. Table 6 of the Impact and Cost <br />
Analysis of CMMC 2.0 section provides <br />
the DoD’s estimate of CMMC assessment <br />
numbers by year and level.
 
DoD considered many alternatives
 
before deciding upon the current CMMC <br />
structure. By design, the CMMC <br />
program depends on the supply and <br />
demand dynamics of the free market, <br />
enabling it to naturally scale and adapt <br />
to capacity requirements. Planned <br />
changes to DCMA staffing levels have <br />
been considered with regard to <br />
implementation of CMMC Level 3 and <br />
C3PAO assessments as described in this <br />
rule. The DIBCAC will communicate <br />
extensively with contractors about the <br />
conduct of a Level 3 assessment during <br />
the pre-assessment planning phase.
 
''15. Assessments ''
 
a. Level 1 and Mapping of 15 Level 1 to <br />
17 Level 2 Requirements
 
''Comment: ''A few questions were
 
submitted about CMMC level 1 <br />
requirements, on topics such as whether <br />
DoD intended affirmations for CMMC <br />
level 1 be required annually versus <br />
triennially, and whether specific <br />
policies and procedures documentation <br />
is required for Level 1 self-assessments. <br />
One commenter asked about limits on <br />
deficiency remediation and re- <br />
accomplishing an assessment in the <br />
event a company fails a CMMC Level 1 <br />
self-assessment. Another commenter <br />
asked for the specific wording to reflect <br />
a CMMC Level 1 assessment score in <br />
SPRS.
 
One commenter objected to CMMC
 
level 1 annual affirmation, which they <br />
considered an unwarranted expansion <br />
of CUI safeguarding requirements to <br />
information systems that process only <br />
FCI. One commenter recommended <br />
revisions to explicitly indicate that <br />
OSAs may choose to engage the services <br />
of a C3PAO to inform the OSA’s Level <br />
1 self-assessment submission. Another
 
commenter recommended editorial <br />
revisions to avoid use of the term <br />
‘‘CMMC security requirements’’ based <br />
on the observation that CMMC <br />
requirements are aligned directly to <br />
those identified in FAR clause 52.204– <br />
21 or NIST publications.
 
One commenter asked for explanation
 
of perceived differences between tables <br />
in the published rule that map CMMC <br />
Level 1 Security Requirements to NIST <br />
SP 800–171A Jun2018, as compared <br />
with prior versions of the document.
 
One commenter asked for the
 
rationale associated with mapping 15 <br />
requirements for CMMC level 1 to 17 <br />
requirements in CMMC level 2. Two <br />
commenters asked if systems that <br />
process FCI (and require CMMC level 1) <br />
are considered within scope for CMMC <br />
level 2 or 3 assessments, and if so, how <br />
they should be documented.
 
''Response: ''When applicable, the DoD
 
does require an annual CMMC Level 1 <br />
self-assessment against the 15 <br />
safeguarding requirements aligned with <br />
FAR clause 52.204–21. Annual <br />
affirmations are required at every <br />
CMMC level. There are no explicit <br />
documentation requirements for a <br />
CMMC Level 1 Self-Assessment. The <br />
DoD modified the Level 1 Scoping <br />
Guide to provide clarity.
 
An OSA may complete as many self-
 
assessments as desired, and there is no <br />
required timeframe between Level 1 <br />
self-assessments and updating CMMC <br />
Status in SPRS. The entry in SPRS for <br />
CMMC Level 1 is a binary selection <br />
between Yes and No based on meeting <br />
all Level 1 security requirements.
 
The CMMC Program verifies
 
implementation of security <br />
requirements for FCI in accordance with <br />
FAR clause 52.204–21. The DoD has <br />
elected to use the CMMC Status <br />
postings and attestations in SPRS as the <br />
mechanism to verify compliance with <br />
applicable CMMC requirements.
 
An OSA engaging an authorized
 
C3PAO to perform the Level 1 self- <br />
assessment and then using the resulting <br />
CMMC Status when ‘‘self-assessing’’ is <br />
permissible. The OSA however retains <br />
all the responsibilities and liabilities of <br />
the affirmation. No revisions to the rule <br />
were necessary.
 
Writing style recommendations were
 
not incorporated and no responses were <br />
provided to those comments based on <br />
comparison of pre-publication draft <br />
versions with those officially published <br />
for public comment. DoD aligned the <br />
security requirements for Level 1 <br />
exactly with those in FAR clause <br />
52.204–21 and aligned the security <br />
requirements in Level 2 exactly with <br />
those in NIST SP 800–171 R2. The 15 <br />
security requirements in FAR clause
 
52.204–21, which make up CMMC Level <br />
1, were mapped by NIST into 17 <br />
security requirements in NIST SP 800– <br />
171 R2. This was accomplished by <br />
splitting 1 requirement into 3 parts, <br />
while the other 14 align. Table 2 to <br />
§ 170.15(c)(1)(ii) provides a mapping.
 
Meeting the CMMC Level 2 self-
 
assessment (§ 170.16) or CMMC Level 2 <br />
certification assessment (§ 170.17) <br />
requirements also satisfies the CMMC <br />
Level 1 self-assessment requirements <br />
detailed in § 170.15 for the same CMMC <br />
Assessment Scope.
 
b. Level 2
 
''Comment: ''Commenters provided a
 
number of very specific Level 2 <br />
assessment scenarios and asked for rule <br />
interpretation for each scenario. <br />
Scenarios included differing scores for <br />
self-assessment and third-party <br />
assessment; assessment timing; <br />
conditional assessment expiration; and <br />
CUI enclaves.
 
One commenter stated the language
 
describing certificates of assessment <br />
lacked clarity and seems to allow an <br />
OSC to be issued a certificate of <br />
assessment but not be certified. Two <br />
comments stated that wording <br />
describing the expiration of a <br />
Conditional Level 2 self-assessment or <br />
certification could be interpreted to <br />
mean that the OSA/OSC would be <br />
permanently barred from seeking further <br />
contracts using information systems <br />
within that CMMC Assessment Scope. <br />
One comment said it was not clearly <br />
stated that a Level 2 third party <br />
assessment would satisfy contractual <br />
requirements for a Level 2 self- <br />
assessment. One comment stated that <br />
the rule does not clearly indicate <br />
whether a Level 2 assessment checks for <br />
more than just proper implementation <br />
of the 110 requirements in NIST SP <br />
800–171 R2 and includes paragraphs— <br />
(c) through (g) of DFARS clause <br />
252.204–7012. This commenter <br />
advocated that those requirements be <br />
assessed only during DIBCAC <br />
assessments.
 
''Response: ''The rule has been updated
 
to clarify that meeting the requirements <br />
for a CMMC Level 2 certification <br />
assessment satisfies a CMMC Level 2 <br />
self-assessment requirement for the <br />
same CMMC Assessment Scope.
 
The term ‘‘certificate of assessment’’
 
has been replaced with the term <br />
‘‘Certificate of CMMC Status’’ in the <br />
final rule. When an OSC has met all the <br />
requirements for a Level 2 certification <br />
assessment, a Certificate of CMMC <br />
Status is obtained from the C3PAO <br />
conducting the assessment. See § 170.9. <br />
Under CMMC, OSCs are not certified; <br />
rather, the assessed network receives a
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00038
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83129 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
Certificate of CMMC Status for the <br />
CMMC Assessment Scope if the network <br />
meets all applicable certification <br />
requirements. No rule edit is necessary <br />
because § 170.19 is clear on this point.
 
The phrase ‘‘until such time as a valid
 
CMMC Level 2 self-assessment is <br />
achieved’’ is added to the rule in the <br />
event a Conditional Level 2 self- <br />
assessment or Conditional Level 3 <br />
expires [see sections <br />
§§ 170.16(a)(1)(ii)(B)) and <br />
170.17(a)(1)(ii)(B)].
 
The CMMC program does not assess
 
paragraph (c) through (g) of DFARS <br />
clause 252.204–7012. The CMMC <br />
Program assesses the security <br />
requirements set forth in the FAR clause <br />
52.204–21; National Institute of <br />
Standards and Technology (NIST) <br />
Special Publication (SP) 800–171 R2; <br />
and selected requirements from the <br />
NIST SP 800–172 Feb2021, as <br />
applicable (see table 1 to § 170.14(c)(4) <br />
CMMC Level 3 Requirements).
 
If the contract requires a Level 2 self-
 
assessment (''i.e., ''a CMMC Status of <br />
‘‘Conditional/Final Level 2 (Self)’’), then <br />
the Level 2 self-assessment score with a <br />
current affirmation is valid for that <br />
contract but not for a contract with a <br />
Level 2 certification assessment <br />
requirement. The DoD does not consider <br />
it realistic or likely that C3PAOs will <br />
purposefully ‘‘slow roll’’ completion of <br />
assessments for which they have been <br />
engaged by an OSC. However, the OSA’s <br />
CMMC Status is based on final results <br />
of an assessment and a valid <br />
affirmation. A POA&amp;M Close-out <br />
assessment need only re-assess those <br />
requirements that were assessed as NOT <br />
MET in the original assessment as <br />
addressed in § 170.21(b). The OSA <br />
status is based on the results of this <br />
POA&amp;M Close-out assessment with a <br />
valid affirmation. If the subcontractor <br />
will process, store, or transmit CUI, then <br />
the flow down requirement for a Prime <br />
contract that specifies CMMC Level 3 <br />
certification assessment is, at a <br />
minimum, CMMC Level 2 certification <br />
assessment (''i.e., ''a CMMC Status of <br />
‘‘Conditional/Final Level 2 (C3PAO)’’).
 
A POA&amp;M closeout applies to all
 
NOT–MET requirements so if one <br />
practice is not remediated within the <br />
180-day time limit, the conditional <br />
certification will expire. Scope cannot <br />
be changed in the middle of an <br />
assessment, so the conditional <br />
certification will expire. If the scope is <br />
changed, a new assessment is required.
 
The assessment is performed based on
 
the defined CMMC Assessment Scope. <br />
The OSA is only approved to process, <br />
store, or transmit FCI and CUI within <br />
the CMMC Assessment Scope defined.
 
If the conditional assessment
 
certification expires due to exceeding <br />
the 180-day limit, a new full <br />
certification assessment is required. <br />
Contracting officers can utilize standard <br />
contract remedies during any period <br />
under which the OSA is not in <br />
compliance with CMMC requirements. <br />
If an OSC closed out their POA&amp;M 32 <br />
months ago, that Level 2 Conditional <br />
certification assessment would have <br />
closed and the OSC would have <br />
received a Level 2 Final certification <br />
assessment for the remainder of the 3- <br />
year validity period. If after completing <br />
the Level 2 Final certification <br />
assessment, the OSC is reassessed and <br />
does not achieve a score of 110, then the <br />
OSC will either get a new Conditional <br />
Level 2 (C3PAO) CMMC Status <br />
certificate (if they meet the associated <br />
POA&amp;M requirements), or the OSC will <br />
not receive a new certificate.
 
c. Level 3
 
''Comment: ''Several comments
 
addressed CMMC Level 3 assessment <br />
requirements and the relationship of <br />
Level 3 assessments to Level 2 <br />
assessments. One comment noted that a <br />
final version of the Level 3 assessment <br />
guidance was not available at the same <br />
time as other CMMC assessment guides. <br />
Another recommended the DoD first <br />
pilot implementation of CMMC Level 3 <br />
security requirements and clearly <br />
identify (in advance) the data or <br />
programs that will be subject to them. <br />
One commenter asked how DoD will <br />
maintain Level 3 requirements to align <br />
with NIST’s guidance since Level 3 <br />
includes only a subset of NIST’s SP <br />
800–172 Feb2021 requirements.
 
Another asked about validating
 
compliance for assets that changed asset <br />
categories when transitioning from <br />
Level 2 certification to Level 3 <br />
certification. One comment said it was <br />
that Level 2 certification is not clearly <br />
identified as a prerequisite for Level 3 <br />
certification, and that organizations <br />
might try to bypass Level 2. One <br />
comment asked whether those entities <br />
that would need a CMMC level 3 <br />
assessment could seek a combined Level <br />
2 and Level 3 certification from the <br />
DIBCAC to reduce cost to the OSC.
 
One comment sought clarification of
 
how long an OSC would be prohibited <br />
from seeking additional contract awards <br />
if a Level 3 certification expired. Two <br />
comments were concerned about the <br />
DIBCAC’s ability to terminate a Level 3 <br />
assessment if the review identifies a <br />
Level 2 requirement that is not met.
 
''Response: ''For CMMC Level 3, the
 
DoD selected a subset of NIST SP 800– <br />
172 Feb2021 requirements for enhanced <br />
safeguarding. The CMMC Level 3
 
supplemental documents were not <br />
finalized prior to publication of the <br />
Proposed Rule. DoD’s final <br />
determination of the specific subset of <br />
NIST SP 800–172 Feb2021 requirements <br />
is included in this final rule, which <br />
defines the ODPs for Level 3 in table 1 <br />
to § 170.14(c)(4). DoD will update the <br />
rule when required to change the <br />
security requirements, to include <br />
CMMC Level 3.
 
DoD has reviewed and declined the
 
recommendation to conduct a pilot <br />
prior to phasing in CMMC Level 3 <br />
requirements. Given the evolving <br />
cybersecurity threat, DoD’s best interests <br />
are served by ensuring that the selected <br />
CMMC Level 3 NIST SP 800–172 <br />
Feb2021 security requirements are in <br />
place to provide enhanced protections <br />
for sensitive DoD CUI.
 
In those cases when DCMA DIBCAC
 
identifies that a Level 2 security <br />
requirement is NOT MET, DCMA <br />
DIBCAC may allow for remediation, <br />
place the assessment process on hold, or <br />
may immediately terminate the Level 3 <br />
assessment, depending on significance <br />
of the NOT MET security requirement(s) <br />
and the nature of the required <br />
remediation. The determination of <br />
whether a NOT MET requirement is <br />
significant is reserved for the judgment <br />
of the DCMA DIBCAC.
 
The rule has been updated to clarify
 
that DCMA DIBCAC has the <br />
responsibility to validate compliance of <br />
all assets that changed asset category <br />
(''i.e., ''CRMA to CUI Asset) or assessment <br />
requirements (''i.e., ''Specialized Assets) <br />
between the Level 2 and Level 3 <br />
assessments. As addressed in § 170.18, a <br />
condition to request a Level 3 <br />
certification assessment from DCMA <br />
DIBCAC is the receipt of a Final Level <br />
2 (C3PAO) CMMC Status. The DoD <br />
considered, but declined, the <br />
recommendation to allow OSAs to <br />
simultaneously pursue Level 2 and <br />
Level 3 in one assessment. DoD must <br />
enforce CMMC requirements uniformly <br />
across the Defense Industrial Base for all <br />
contractors and subcontractors who <br />
process, store, or transmit CUI, <br />
regardless of an OSA’s intended CMMC <br />
level. Permitting OSCs to seek combined <br />
CMMC Level 2 and 3 assessments <br />
would unfairly benefit only a subset of <br />
OSCs that were identified to meet <br />
CMMC Level 3 requirements.
 
The rule has been updated to clarify
 
that the OSC will be ineligible for <br />
additional contract awards that require <br />
a CMMC Level 3 certification <br />
assessment until such time as a valid <br />
(Conditional or Final) CMMC Level 3 <br />
(DIBCAC) CMMC Status is achieved for <br />
the information systems within the <br />
CMMC Assessment Scope.
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00039
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83130 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
d. Scoring Methodology
 
1. CMMC Point Value System
 
''Comment: ''Multiple comments were
 
received concerning the point values <br />
assigned to CMMC security <br />
requirements, their association to other <br />
frameworks, consistency between <br />
CMMC levels, and their use in POA&amp;M <br />
eligibility determination. Numerous <br />
comments recommended that the <br />
CMMC Level 2 weighted point system <br />
where security requirements are valued <br />
as 1, 3, or 5 be modeled after the one <br />
point per requirement used in CMMC <br />
Level 3 scoring. Some also questioned <br />
why the CMMC Level 2 scoring <br />
structure was the same as the NIST SP <br />
800–171 DoD Assessment Methodology <br />
(DODAM). Four comments <br />
recommended changes to the criteria for <br />
adding unimplemented security <br />
requirements to an Assessment POA&amp;M. <br />
One comment noted that temporary <br />
deficiencies which are appropriately <br />
addressed in plans of action should be <br />
assessed as implemented. Some of the <br />
comments recommended not assigning <br />
point values to determine POA&amp;M <br />
eligibility. Two other comments <br />
recommended dropping the NIST Basic <br />
and Derived security requirement <br />
designations and disassociating them <br />
from CMMC point values.
 
''Response: ''Recommendations to assign
 
a point value of 1 to all CMMC Level 2 <br />
security requirements were not <br />
accepted. CMMC adopted the scoring as <br />
included in the NIST SP 800–171 DoD <br />
Assessment Methodology (DoDAM) <br />
used by the DCMA DIBCAC and <br />
referenced in DFARS clause 252.204– <br />
7020. As addressed in § 170.20(a) in this <br />
rule, there is qualified standards <br />
acceptance between a DCMA DIBCAC <br />
High Assessment and CMMC Level 2 <br />
certification assessment. Revisions to <br />
the CMMC Scoring Methodology will be <br />
made concurrently with changes to the <br />
DoDAM. The variable point values of 1, <br />
3, and 5 are linked to the NIST <br />
determination of Basic Security <br />
Requirements and Derived Security <br />
Requirements as described in § 170.24. <br />
The DoD has updated the rule text at <br />
§ 170.24 to clarify which requirements <br />
may be included on a POA&amp;M. CMMC <br />
Level 2 security requirement SC.L2– <br />
3.13.11 can be partially effective and <br />
may be included on a POA&amp;M if <br />
encryption is employed and is not FIPS- <br />
validated.
 
The DoD added a definition for
 
enduring exceptions and temporary <br />
deficiencies to the rule. § 170.21 <br />
addresses POA&amp;Ms for assessments. <br />
Security requirement CA.L2–3.12.2 <br />
allows for the development and <br />
implementation of an operational plans
 
of action designed to correct <br />
deficiencies and reduce or eliminate <br />
vulnerabilities in organizational <br />
systems. These operational plans of <br />
action are different from POA&amp;Ms <br />
permitted under Conditional <br />
assessment. The rule has been updated <br />
to make this distinction clear. The <br />
CMMC rule does not prohibit the use of <br />
an operational plan of action to address <br />
necessary information system updates, <br />
patches, or reconfiguration as threats <br />
evolve.
 
2. NIST SP 800–171A Jun2018 <br />
Assessment Objectives
 
''Comment: ''Multiple comments
 
questioned the role of NIST SP 800– <br />
171A Jun2018 Assessment Objectives <br />
within the CMMC assessment process. <br />
Three comments asked whether all <br />
assessment objectives needed to be met <br />
to score a security requirement as MET. <br />
Two comments questioned the need to <br />
report assessment results at the <br />
assessment objective level within the <br />
CMMC instantiation of eMASS for <br />
CMMC Level 2 and CMMC Level 3 <br />
certification assessments. Some <br />
comments suggested that the DoD allow <br />
for contractors to take a more risk-based <br />
approach to include compensating <br />
controls instead of a strict security <br />
requirement-based model.
 
''Response: ''DoD must enforce CMMC
 
requirements uniformly for all defense <br />
contractors and subcontractors who <br />
process, store, or transmit CUI. Each <br />
assessment objective in NIST SP 800– <br />
171A Jun2018 must yield a finding of <br />
MET or NOT APPLICABLE for the <br />
overall security requirement to be <br />
scored as MET. Assessors exercise <br />
judgment, within CMMC guidelines, in <br />
determining when sufficient and <br />
adequate evidence has been presented <br />
to make an assessment finding. A <br />
security requirement can be applicable, <br />
even with assessment objectives that are <br />
N/A. The security requirement is NOT <br />
MET when one or more applicable <br />
assessment objectives is NOT MET. <br />
CMMC assessments are conducted at the <br />
security requirement objective level, <br />
and the results are captured at the <br />
security requirement objective level. <br />
Assessment results are entered into the <br />
CMMC instantiation of eMASS at the <br />
NIST SP 800–171A Jun2018 assessment <br />
objective level of detail to provide <br />
metrics on which assessment objectives <br />
are proving difficult to implement and <br />
to indicate where additional assessor <br />
training and guidance may be <br />
warranted.
 
The DoD declines to change
 
requirements to allow additional <br />
organization-specific risk-based <br />
approaches. National Institute of
 
Standards and Technology (NIST) <br />
determined the appropriate <br />
characteristics and considered the <br />
appropriate attack vectors when NIST <br />
SP 800–171 R2 was created, and tailored <br />
the security requirements to protect the <br />
confidentiality of CUI. Questions and <br />
comments related to NIST SP 800–171 <br />
R2 background, development and <br />
scenarios are outside the scope of the <br />
CMMC rule.
 
3. Other Scoring Comments
 
''Comment: ''Three comments were
 
received concerning the use of <br />
operational plans of action to document <br />
security requirements which are not <br />
fully implemented due to limitations <br />
beyond the ability of an OSA to address. <br />
The use of temporary deficiencies and <br />
enduring exceptions were suggested <br />
along with the recommendation that <br />
these items be scored as MET.
 
The scoring of FIPS-validated
 
modules was questioned in four <br />
comments. An error in the point value <br />
for encryption (1 and 3 points vs the <br />
correct 3 and 5 points) was identified. <br />
Clarification on full credit for <br />
incomplete implementation of FIPS <br />
encryption was also requested.
 
Two comments were received about
 
the relationship between CMMC Level 2 <br />
and CMMC Level 3 scoring asking if the <br />
point values in each assessment were <br />
cumulative and how the 80% eligibility <br />
for an assessment POA&amp;M and <br />
Conditional certification would be <br />
calculated.
 
Three comments requested
 
clarification around the use of N/A in <br />
security requirements, assessment <br />
objectives, and in matters pertaining to <br />
previously granted DoD CIO variances. <br />
One comment questioned what types of <br />
artifacts are required to substantiate a <br />
determination of N/A for a security <br />
requirement or assessment objective. <br />
Three comments addressed the need for <br />
a System Security Plan, its point value, <br />
if any, and the need for an SSP as a <br />
prerequisite for assessment as it exists <br />
in the DIBCAC DODAM.
 
''Response: ''The government cannot
 
comment on the suitability of specific <br />
implementations or products to meet <br />
CMMC security requirements and is <br />
aware that FIPS module validation can <br />
exceed the 180-day CMMC assessment <br />
POA&amp;M threshold. Guidance regarding <br />
FIPS implementation on Windows 11 is <br />
not appropriate for inclusion in the rule <br />
text and DoD declines to make an <br />
update. Limitations of the FIPS- <br />
validated module process do not impact <br />
the implementation status of FIPS <br />
cryptography. The rule has been <br />
updated to include enduring exceptions <br />
and temporary deficiencies. Vendor
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00040
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83131 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
limitations with respect to FIPS <br />
validation could be considered enduring <br />
exceptions or temporary deficiencies <br />
and should be addressed in an OSA’s <br />
operational plan of action.
 
Several requirements within NIST SP
 
800–171 R2 specify the use of <br />
encryption without consideration of the <br />
processing, storage, or transmission of <br />
CUI. Requirement 3.13.11 requires that <br />
the encryption used be a FIPS-validated <br />
module if the encryption is used to <br />
protect the confidentiality of CUI. The <br />
scoring in § 170.24(c)(2)(i)(B)(4)(ii) is <br />
based on the use of encryption and <br />
whether the encryption uses a FIPS- <br />
validated module. There is no <br />
consideration for multiple layers of <br />
encryption so specific guidance to <br />
assessors regarding layers of encryption <br />
is not needed and DoD declines to make <br />
the suggested addition. OSAs may <br />
choose how they implement security <br />
requirements and C3PAOs will assess <br />
based on the stated implementations. <br />
CCAs are trained in the correct process <br />
to assess security requirements. The <br />
DoD has updated the rule text at <br />
§ 170.24(c) to clarify which <br />
requirements may be included on a <br />
POA&amp;M, which addresses the error in <br />
the point value for encryption.
 
The scoring for CMMC Level 3 is
 
separate from the scoring for CMMC <br />
Level 2. As stated in § 170.24(c)(3), the <br />
CMMC Level 3 assessment score is <br />
equal to the number of CMMC Level 3 <br />
security requirements that are assessed <br />
as MET. There are twenty-four CMMC <br />
Level 3 security requirements, identified <br />
in table 1 to § 170.14(c)(4). CMMC Level <br />
3 POA&amp;M eligibility is based on the <br />
number of CMMC Level 3 security <br />
requirements and does NOT include the <br />
110 CMMC Level 2 requirements.
 
‘‘Not applicable’’ was removed from
 
§ 170.24(c)(9) for the case where the <br />
DoD CIO previously approved a <br />
variance. The rule has been updated to <br />
reflect the language of DFARS clause <br />
252.204–7012 and the DoDAM, <br />
including nonapplicable or to have an <br />
alternative, but equally effective, <br />
security measure. Regarding the <br />
comment on N/A objectives, § 170.23 is <br />
clear that MET means all applicable <br />
objectives for the requirement and that <br />
if an objective does not apply, then it is <br />
equivalent to being MET. A security <br />
requirement can be applicable, even <br />
with one or more objectives that are N/ <br />
A. The overall requirement is only NOT <br />
MET when one or more applicable <br />
objectives is not satisfied. The <br />
determination of assessment findings is <br />
made by an Assessor following the <br />
assessment methodology. In the case of <br />
a self-assessment, the Assessor is from <br />
the OSA. In the case of a certification
 
assessment, the Assessor is from the <br />
C3PAO or DIBCAC. An assessment <br />
finding of NOT APPLICABLE (N/A) <br />
means a security requirement (or <br />
assessment objective) does not apply at <br />
the time of the CMMC assessment. For <br />
each assessment objective or security <br />
requirement marked N/A, the Certified <br />
Assessor includes a statement that <br />
explains why it does not apply to the <br />
contractor. The OSC should document <br />
in its SSP why the security requirement <br />
does not apply and provide justification. <br />
There is no standard set of artifacts <br />
required to justify a finding of N/A.
 
A System Security Plan as described
 
in security requirement CA.L2–3.12.4 is <br />
required to conduct an assessment. The <br />
rule has been updated at <br />
§ 170.24(c)(2)(i)(B)(6) for clarity. <br />
Security requirement CA.L2–3.12.4 does <br />
not have an associated point value. The <br />
OSA will not receive a -1 for a missing <br />
or incomplete SSP. The absence of an <br />
up-to-date system security plan at the <br />
time of the assessment would result in <br />
a finding that ‘an assessment could not <br />
be completed due to incomplete <br />
information and noncompliance with <br />
DFARS clause 252.204–7012.’ The rule <br />
has been updated in § 170.24(c)(6) to <br />
clarify this.
 
e. Artifacts
 
''Comment: ''Several comments and
 
requests for clarification dealt with <br />
artifacts that are reviewed or created <br />
during a CMMC assessment, or as part <br />
of compliance with other contractual <br />
requirements, including DFARS clause <br />
252.204–7012. Some commenters asked <br />
whether standardized SSP and POA&amp;M <br />
templates would be provided to assist <br />
with compliance. Other templates <br />
requested included pre-assessment <br />
planning materials, final assessment <br />
reports, and the resulting Certificate of <br />
CMMC Status.
 
Others expressed concern that sharing
 
certain artifacts during the assessment <br />
process or permitting assessors to retain <br />
them would create vulnerability. In <br />
addition, commenters asked whether <br />
security protections are required for <br />
documents held due to the artifact <br />
retention requirements. One commenter <br />
asked how CMMC assessment scores, or <br />
affirmation information will be <br />
protected, and whether the CMMC <br />
program office will share this <br />
information outside of DoD. Another <br />
suggested that C3PAOs should not be <br />
required to retain any OSC provided <br />
materials.
 
One commenter misinterpreted the
 
supplemental hashing guide as <br />
requiring use of the MS PowerShell <br />
script with the SHA256 algorithm. The <br />
commenter also stated it would be more
 
efficient to specify a single hash be <br />
provided for combined artifacts rather <br />
than requiring separate hash values for <br />
each artifact. They recommended <br />
deletion of the hashing requirement. <br />
Another commenter suggested requiring <br />
OSCs to generate hashes for artifacts as <br />
part of a Level 2 self-assessment. One <br />
comment also asked whether hashing is <br />
required for Level 3 artifacts. One <br />
comment asked how long OSAs must <br />
retain artifacts following an assessment.
 
Some comments expressed concern
 
that C3PAOs that receive or retain OSA <br />
artifacts identified as CUI would be <br />
required to undergo assessment by both <br />
the DIBCAC and another C3PAO. Four <br />
commenters objected to the 6-year <br />
artifact retention requirement for <br />
C3PAOs and requested reduction to 1 <br />
year. Three commenters asked whether <br />
self-assessors at level 1 or level 2 must <br />
also retain supporting artifacts for 6 <br />
years. Two commenters recommended <br />
revised wording of CMMC Level 3 <br />
requirements to provide greater clarity <br />
about artifact retention and integrity.
 
One commenter requested edits to the
 
description of SSP content, advocating <br />
for deletion of references to <br />
organizational policies and procedures <br />
in place to comply with NIST SP 800– <br />
171 R2. The recommended edits also <br />
changed attribution of the requirement <br />
to create an SSP to reflect DFARS clause <br />
252.204–7020 rather than DFARS clause <br />
252.204–7012. This commenter also <br />
suggested additional wording to specify <br />
that the OSA need not define roles and <br />
responsibilities of security personnel in <br />
the SSP but may do so in ancillary <br />
documents.
 
''Response: ''This rule retains the
 
reference to DFARS clause 252.204– <br />
7012 that implements NIST SP 800–171 <br />
as the basis for the requirement to create <br />
and update an SSP. The DoD has <br />
considered the recommended changes <br />
to the rule regarding the SSP content <br />
and declines to make the revision. The <br />
NIST SP 800–171 R2 requirement for an <br />
SSP is foundational to performing a <br />
NIST SP 800–171 R2 self-assessment <br />
and its purpose is to provide critical <br />
information for performing the <br />
assessment. The SSP should detail the <br />
policies and procedures that support <br />
‘‘. . . how security requirements are <br />
implemented . . .’’ for all NIST SP 800– <br />
171 R2 controls. DoD declines to <br />
establish a specific SSP format, as OSAs <br />
should define the best format for their <br />
organizations. The Overview section of <br />
the rule has been updated to remove the <br />
statement indicating SSPs will outline <br />
the roles and responsibilities of security <br />
personnel. DoD does not plan to provide <br />
document templates for SSPs and <br />
POA&amp;Ms, as they are already available
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00041
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83132 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
in existing NIST guidance. Templates <br />
and schemas for the pre-assessment and <br />
assessment results documents are <br />
available to authorized CMMC eMASS <br />
[https://cmmc.emass.apps.mil users at ''https://cmmc.emass.apps.mil''. ]
 
Commenter concerns about artifact
 
retention reflect misunderstanding of <br />
the assessment process. Assessors and <br />
C3PAOs do not retain OSC artifacts, <br />
they only retain the hash value captured <br />
during the assessment process. <br />
Assessors will retain documents created <br />
during the assessment such as their <br />
notes and the Assessment Findings <br />
Reports. To facilitate the protection of <br />
these documents, authorized C3PAOs <br />
are required to go through a DIBCAC <br />
conducted CMMC Level 2 assessment <br />
and CMMC Assessors are only <br />
authorized to use C3PAO issued <br />
equipment that was within the scope of <br />
the DIBCAC assessment. Separately, the <br />
DIBCAC processes, stores, and transmits <br />
its assessment related data on DoD <br />
networks. Assessment Reports are <br />
submitted to DoD via eMASS, which is <br />
a government-owned, secured database. <br />
Sharing of this information is subject to <br />
DoD policies.
 
The OSC is responsible for
 
maintaining and hashing all artifacts <br />
that supported the assessment. The rule <br />
has been modified to clarify C3PAOs do <br />
not maintain artifacts from the OSC. The <br />
OSCs artifacts must be hashed, and the <br />
value provided to the assessor for <br />
submission into CMMC eMASS. That <br />
hash value contains no sensitive <br />
information. An OSC’s System Security <br />
Plan (SSP) will be reviewed as part of <br />
a CMMC certification assessment, but <br />
not shared outside of the OSC. <br />
Assessors will not retain copies of the <br />
SSP or any other proprietary OSC <br />
information. Assessors will retain the <br />
name, date, and version of the SSP for <br />
uploading in SPRS or eMASS, as <br />
appropriate for the level of assessment. <br />
Assessors will upload assessment <br />
information (''e.g., ''list of artifacts, hash of <br />
artifacts, and hashing algorithm used) <br />
into CMMC eMASS as addressed in <br />
§ 170.9(b)(17), and the OSC will retain <br />
its assessment documentation as <br />
addressed in § 170.17(c)(4) and <br />
§ 170.18(c)(4)
 
CMMC Level 2 self-assessments
 
procedures as described in <br />
§ 170.16(c)(1) require assessment in <br />
accordance with NIST SP 800–171A <br />
Jun2018, which if conducted properly <br />
will generate evidence. The rule has <br />
been modified to incorporate data <br />
retention requirements for self- <br />
assessments into §§ 170.15 and 170.16. <br />
OSAs are not required to generate <br />
hashes for self-assessment artifacts. <br />
Hashing is only required for Level 2 or <br />
Level 3 assessments by C3PAOs and
 
DCMA DIBCAC. The rule and Hashing <br />
Guide have been updated to add clarity <br />
that only a single hash is required, and <br />
that artifact retention is for six years. <br />
The use of SHA256 algorithm is not <br />
mandatory and therefore, the name of <br />
the hash algorithm needs to be stored in <br />
eMASS.
 
There are no additional requirements
 
for artifact storage and retention beyond <br />
those identified in the rule. It is up to <br />
the OSA to determine the best way to <br />
ensure artifact availability during the <br />
six-year retention period. The rule has <br />
been updated in §§ 170.15 through <br />
170.18 to clarify artifact retention <br />
requirements.
 
DoD declines to reduce the artifact
 
retention period from six years to one <br />
year. The rule has been updated to <br />
clarify that all OSAs and Assessors are <br />
required to retain their respective <br />
assessment data for six years. The <br />
requirement for an artifact retention <br />
period of six years is a result of the <br />
Department of Justice’s input to the <br />
proposed rule.
 
f. POA&amp;Ms
 
''Comment: ''Over forty comments were
 
received about POA&amp;Ms seeking <br />
clarification or revision to the rule <br />
content on that topic.
 
Several commenters misinterpreted
 
the requirement to remediate or close <br />
POA&amp;M items within 180 days as <br />
eliminating acceptability of operational <br />
plans of action for normal corrective <br />
actions such as patching or other <br />
routine maintenance activities, thus <br />
making the achievement of 100% <br />
compliance impossible. Some <br />
commenters requested rule revisions to <br />
describe operational plans of action in <br />
more detail. One commenter asked that <br />
the concept of Enduring Exceptions be <br />
added to the rule to address special <br />
circumstances when remediation and <br />
full compliance with CMMC security <br />
requirements is not feasible as described <br />
in the NIST SP 800–171A Jun2018 <br />
assessment methodology.
 
Several commenters expressed
 
concern with the 180-day timeline to <br />
close out POA&amp;Ms or limits on which <br />
practices can be placed on them. <br />
Recommendations for changing the <br />
POA&amp;M timeline ranged from <br />
completely deleting the time limit to <br />
extending it by 1 to 3 years. One <br />
variation was to permit more than 180 <br />
days for closeout only during an initial <br />
one-year ‘‘ramp-up’’ period. One <br />
commenter encouraged DoD to reduce <br />
POA&amp;M restrictions to facilitate <br />
contractors’ genuine attempts to meet <br />
requirements and mitigate information <br />
security risks. Three commenters also <br />
thought the rule should allow
 
contractors to request approval to delay <br />
POA&amp;M close-out when meeting the <br />
original timeline is impracticable, while <br />
another commenter suggested defining <br />
the close-out timeline in the contract, <br />
allowing negotiation of extension or <br />
renewal of POA&amp;Ms through the <br />
contracting officer. Two commenters <br />
asked when the 180-day timeline begins <br />
and one asked what actions occur if the <br />
POA&amp;M is not closed out within that <br />
period.
 
Four commenters noted that the
 
number of security requirements <br />
explicitly precluded from POA&amp;Ms <br />
makes CMMC challenging and <br />
requested greater flexibility in how <br />
many, and which practices may be <br />
included. Three commenters <br />
recommended that companies be <br />
allowed to have any number of failed <br />
practices reassessed for up to six- <br />
months after an assessment without <br />
having to complete and pay for a new <br />
full assessment. Three other <br />
commenters recommended that the DoD <br />
allow for risk informed POA&amp;Ms, while <br />
one stated that the rule should not <br />
specify which requirements must be <br />
met. One commenter requested <br />
clarification on how many items of each <br />
point value may be included on a <br />
POA&amp;M for CMMC Level 2 conditional <br />
certification. One commenter also asked <br />
DoD to consider abandoning controls <br />
with high failure rates, lowering score <br />
requirements based on evidence of <br />
sufficient mitigation.
 
Several comments expressed concern
 
that CMMC conditional certification <br />
does not allow higher weighted <br />
practices on a POA&amp;M and <br />
recommended the rule reduce those <br />
restrictions to allow more security <br />
practices. One commenter also <br />
recommended eliminating weighting <br />
altogether, permitting any requirement <br />
to be part of the POA&amp;M. As rationale, <br />
one commenter referenced DFARS <br />
clause 252.204–7012 verbiage that <br />
permits contractors to request DoD CIO <br />
approval to vary from NIST SP 800–171 <br />
requirements, saying that since all <br />
approved variances are considered as <br />
‘‘Not Applicable’’, all requirements <br />
should be POA&amp;M eligible.
 
Two commenters asked where
 
POA&amp;Ms are maintained, who is <br />
responsible for validating close-out, and <br />
whether affirmation is required after <br />
each assessment (including POA&amp;M <br />
close-out). One commenter asked about <br />
applicability of the 180-day POA&amp;M <br />
close-out requirement to Critical, High, <br />
Medium, or Low findings against <br />
Service Level Agreements.
 
One commenter recommended that a
 
description of appropriate POA&amp;M <br />
entries to be added to the rule and
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00042
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83133 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
provided other recommended edits to <br />
the POA&amp;M section, including addition <br />
of terms of art such as ‘‘assessment- <br />
related’’ and ‘‘non-assessment-related’’, <br />
and deletion of the words ‘‘as <br />
applicable.’’
 
''Response: ''The CMMC Program allows
 
the use of POA&amp;Ms. Section 170.21 <br />
delineates the requirements that may be <br />
addressed as part of an assessment with <br />
a POA&amp;M, that must be closed out by <br />
a POA&amp;M closeout assessment within <br />
180 days of the initial assessment to <br />
achieve the assessment requirement for <br />
Final certification. At Level 1, the OSA <br />
must affirm annually that it has <br />
reassessed its environment. Security <br />
requirement CA.L2–3.12.2 allows for the <br />
development and implementation of an <br />
operational plans of action designed to <br />
correct deficiencies and reduce or <br />
eliminate vulnerabilities in <br />
organizational systems. The CMMC rule <br />
does not prohibit an OSA from using an <br />
operational plan of action at any CMMC <br />
level to address necessary information <br />
system updates, patches, or <br />
reconfiguration as threats evolve. These <br />
are different from POA&amp;Ms permitted <br />
under a Conditional certification <br />
assessment. The DoD has updated the <br />
rule to make this distinction clear. The <br />
Department also updated the rule to <br />
include a definition and clarity for <br />
enduring exceptions. The DoD CIO <br />
option for variances in DFARS clause <br />
252.204–7012 is beyond the scope of <br />
this rule.
 
Operational plans of action are the
 
appropriate mechanism to handle CSPs, <br />
ESPs (not a CSP) and third-party <br />
vendors that are no longer compliant <br />
with a CMMC requirement. Operational <br />
plans of action may be necessary when <br />
the relevant security requirement or <br />
control was fully implemented, but a <br />
vulnerability or deficiency is discovered <br />
after gaining a CMMC final compliance <br />
status, such as, but not limited to, <br />
routine updates, patches, or updates to <br />
CMMC compliance status. For purposes <br />
of CMMC compliance, operational plans <br />
of action are acceptable and are not <br />
subject to the 180-day timetable <br />
established for initial assessment. In <br />
addition, the rule has been modified to <br />
include a definition for Enduring <br />
Exceptions.
 
The DoD does not accept the
 
recommendation to change the criteria <br />
for POA&amp;Ms or the timeline allowed to <br />
remediate open POA&amp;M items. The 180- <br />
day period allowed for POA&amp;Ms and the <br />
determination of which weighted <br />
practices can be placed on a POA&amp;M <br />
was a risk-based decision. The <br />
determination considers the relative risk <br />
DoD is willing to accept when a <br />
particular practice is not met and the
 
amount of risk the DoD is willing to <br />
accept for those security practices that <br />
go ‘‘NOT MET’’ for an extended period. <br />
The DoD declined to edit the rule <br />
regarding the closeout of security <br />
requirements that are not allowed on the <br />
POA&amp;M as stated in § 170.21. The <br />
decision in this scenario is a business <br />
decision between the applicable C3PAO <br />
and the OSC.
 
Given the evolving cybersecurity
 
threat, DoD’s best interests are served by <br />
ensuring that POA&amp;Ms remain open for <br />
no longer than 180 days, regardless of <br />
which controls are included or the plan <br />
for remediation.
 
The 180-day period starts when the
 
CMMC assessment results are finalized <br />
and submitted to SPRS or eMASS, as <br />
appropriate. As addressed in <br />
§§ 170.17(a)(1)(ii)(B) and <br />
170.18(a)(1)(ii)(B), if the POA&amp;M is not <br />
closed out within the 180-day <br />
timeframe, the Conditional Certification <br />
will expire. If the Conditional <br />
Certification expires within the period <br />
of performance of a contract, standard <br />
contractual remedies will apply, and the <br />
OSC will be ineligible for additional <br />
awards with CMMC Level 2 or 3 <br />
requirements for the information <br />
systems within the same CMMC <br />
Assessment Scope. The scoring <br />
methodology created by the DoD reflects <br />
the relative risk to DoD information <br />
when a security requirement is NOT <br />
MET. As defined in § 170.17(c)(2), a <br />
security requirement that is NOT MET <br />
may be re-evaluated during the Level 2 <br />
certification assessment and for 10 <br />
business days following the active <br />
assessment period under certain <br />
conditions. Likewise, when an OSC <br />
executes a contract with a C3PAO it <br />
may account for the timeliness of any <br />
re-assessments. The language in DFARS <br />
clause 252.204–7012 describing the DoD <br />
CIO’s authority to approve variances is <br />
beyond the scope of this rule.
 
A POA&amp;M for CMMC Level 2 can
 
include up to 22 security requirements <br />
that have a value of 1, excluding those <br />
in § 170.21(a)(2)(iii), or may include <br />
non-FIPS-validated encryption and up <br />
to 19 security requirements that have a <br />
value of 1.
 
The OSA is responsible for
 
maintaining the POA&amp;M that resulted <br />
from a CMMC assessment; however, <br />
those security requirements that were <br />
NOT MET and placed on a POA&amp;M are <br />
recorded in eMASS. The OSA is <br />
responsible for validating the close-out <br />
of the security requirements on the <br />
POA&amp;M within 180 days of a self- <br />
assessment. The C3PAO or DCMA (as <br />
applicable) must perform the POA&amp;M <br />
Close-out Assessment for a Final <br />
certification assessment. An affirmation
 
of compliance is required upon the <br />
completion of any assessment— <br />
Conditional, Close-out, or Final—and <br />
annually after the completion of a Final <br />
assessment. The requirement outlined <br />
in § 170.21 for POA&amp;M close out does <br />
not apply to Service Level Agreement <br />
(SLA) severity levels.
 
The Department declines to include
 
recommended POA&amp;M examples in the <br />
rule, as they are already available in <br />
existing NIST guidance, or make other <br />
word changes to § 170.21. This section <br />
of the CMMC rule has been updated to <br />
add clarity when discussing the POA&amp;M <br />
regarding security requirements that <br />
were assessed as NOT MET during a <br />
CMMC assessment. These POA&amp;Ms are <br />
distinct from an operational plan of <br />
action.
 
g. Assessment Activities and Reporting
 
1. Data Entry
 
''Comment: ''One comment requested
 
the rule state that records in SPRS must <br />
be updated within six months of the <br />
rule’s effective date or when the <br />
functionality is in place, whichever is <br />
longer. Two comments asked for <br />
mitigations for assessment delays that <br />
could impact the timeliness of <br />
certification. One comment asked for <br />
more information about assessment <br />
frequency guidelines, and one asked <br />
which date would be used to determine <br />
timing of CMMC Level 2 triennial <br />
assessments, where this date is <br />
maintained, and who is responsible for <br />
ensuring contractors meet all applicable <br />
security requirements.
 
''Response: ''To be eligible for a contract
 
with a CMMC Level 1 self-assessment <br />
requirement, the OSA must perform a <br />
Level 1 self-assessment, input the result <br />
into SPRS, and submit an affirmation. <br />
The timeline for initiating and reporting <br />
a self- assessment is a business decision <br />
to be made by each contractor <br />
considering contract opportunities it <br />
wishes to pursue. Because the OSA can <br />
fully control timelines for completion of <br />
self-assessments and plan for changes <br />
within the assessment scope, and <br />
because CMMC certification <br />
assessments occur on a standard 3-year <br />
cycle, the DoD expects that companies <br />
will plan assessments well in advance <br />
of need. The required assessment <br />
frequency is every year for CMMC Level <br />
1, and every 3 years for CMMC Levels <br />
2 and 3, or when changes within the <br />
CMMC Assessment Scope invalidate the <br />
assessment.
 
Certification dates for CMMC levels 2
 
and 3 are set to the date the certification <br />
assessment results are entered into <br />
SPRS for self-assessments or the date <br />
the Certificate of CMMC Status is
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00043
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83134 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
entered into eMASS for third-party <br />
assessments. The triennial requirement <br />
renews on that date; there is no grace <br />
period. Each OSA’s annual affirmation <br />
attests that they have implemented, and <br />
are maintaining their implementation <br />
of, the security requirements.
 
2. Supplier Risk Performance System <br />
and eMASS
 
''Comment: ''Three commenters viewed
 
CMMC’s intent to store CMMC related <br />
data in an existing DoD system, SPRS, <br />
as an indication that SPRS would <br />
replace other DoD risk tracking systems <br />
or the risk monitoring responsibilities of <br />
other agencies. One commenter asked <br />
whether other Services would have their <br />
own systems, as the SPRS Program <br />
Office is within the Navy. Another <br />
comment stated CMMC and SPRS <br />
should not be tasked with the <br />
responsibility of addressing Supply <br />
Chain Risk Management (SCRM). One <br />
comment asked if the DoD intended to <br />
make CMMC Level 2 and 3 certification <br />
information available to other agencies, <br />
which could reduce the cost burden of <br />
compliance with assessment/ <br />
certification programs adopted by other <br />
agencies. One comment asked how PII <br />
would be protected in SPRS. Another <br />
comment asked for SPRS to be <br />
redesigned to list assessment results for <br />
each security requirement instead of the <br />
aggregate level. One comment asked for <br />
a CMMC-specific process for entering <br />
data into SPRS to make it easier for <br />
small businesses and another comment <br />
asked for vendor visibility into a <br />
potential sub-contractor’s SPRS score.
 
Several comments asked about the
 
CAGE code requirement and noted a <br />
perception that businesses outside the <br />
U.S are unable to obtain a CAGE or <br />
become a member of PIEE and therefore <br />
unable to access SPRS. One comment <br />
asked whether each contract would <br />
require a new SPRS entry.
 
One comment asked if OSCs that
 
already have an eMASS account would <br />
be able to access the CMMC <br />
instantiation of eMASS and one <br />
comment questioned the cost/benefit of <br />
entering pre-assessment data into <br />
eMASS. Another comment asked for <br />
clarification on the roles and <br />
responsibilities of DoD Program <br />
Managers regarding the data uploaded <br />
into eMASS. One commenter suggested <br />
that eMASS be modified to permit <br />
tracking of self-assessment, in addition <br />
to certification assessments.
 
''Response: ''SPRS is used to provide
 
CMMC Status, score results, and <br />
affirmation status to contracting officers <br />
and program managers as part of the <br />
contract award process. It does not <br />
supersede other DoD program office risk
 
register systems. SPRS will be used for <br />
reporting CMMC Status of all <br />
contractors, regardless of which service <br />
issued the contract. Although the SPRS <br />
program is managed by the Department <br />
of the Navy, its use spans across the <br />
Department. There is no role for other <br />
agencies associated with this CMMC <br />
rule, which applies only to DoD <br />
contractors that process, store, or <br />
transmit FCI or CUI. The CMMC PMO <br />
has no current agreements with other <br />
Federal agencies to share CMMC <br />
assessment results. There is nothing that <br />
prevents an OSA from sharing their <br />
CMMC Status with other entities.
 
SPRS is an existing DoD database that
 
is compliant with DoD regulations, <br />
which includes meeting Privacy <br />
requirements. DoD suppliers are already <br />
required to use SPRS to record NIST SP <br />
800–171 self-assessment scores, as <br />
referenced in DFARS clause 252.204– <br />
7020. The CMMC rule expands the use <br />
of SPRS to include CMMC Status, <br />
certification assessment scores, and <br />
affirmations.
 
SPRS is the tool that the DoD
 
acquisition workforce will use to verify <br />
companies meet CMMC requirements to <br />
be eligible for contract award. SPRS data <br />
entry does not make available to <br />
Contracting Officers scoring of <br />
individual security requirements.
 
The DoD does not concur with
 
granting prime contractors access to <br />
view the CMMC scores or Certificates of <br />
CMMC Status for potential <br />
subcontractors in SPRS. Subcontractors <br />
may voluntarily share their CMMC <br />
Status, assessment scores, or certificates <br />
to facilitate business teaming <br />
arrangements. Changing access to PIEE <br />
and SPRS is outside the scope of this <br />
rule.
 
CMMC eMASS is a tailored, stand-
 
alone instantiation of eMASS for use by <br />
authorized representatives from <br />
C3PAOs, the DCMA DIBCAC, and the <br />
CMMC PMO. Individuals from each <br />
C3PAO will have access to CMMC <br />
eMASS to upload Level 2 assessment <br />
data. DCMA DIBCAC personnel will <br />
have access to CMMC eMASS to upload <br />
Level 3 assessment data. OSAs will not <br />
have access to CMMC eMASS. <br />
Authorized personnel from OSAs may <br />
access SPRS, which will host <br />
assessment certification and self- <br />
assessment data, and will be able to <br />
upload and view scores only for their <br />
OSA.
 
The DOD declines to add
 
requirements for submitting self- <br />
assessments in eMASS. The <br />
requirement is for the OSA to enter <br />
scores into SPRS. There is value to the <br />
DoD in having the pre-assessment <br />
information in CMMC eMASS for
 
overall program management and <br />
oversight. The information indicates <br />
that an assessment is either scheduled <br />
or in-process. The CMMC PMO seeks to <br />
track CMMC program adoption, and pre- <br />
assessment information allows reporting <br />
on upcoming assessments. Based on the <br />
DoD cost analysis, the effort to upload <br />
pre-assessment material is minimal.
 
DoD Program Managers are not
 
responsible for uploading data into <br />
eMASS, nor do they have any <br />
responsibility regarding the data <br />
uploaded to eMASS by DCMA. An ESP, <br />
OSA, or OSC seeking CMMC assessment <br />
will need a CAGE code and an account <br />
in SPRS to complete the annual <br />
attestation required of all CMMC <br />
certified or CMMC compliant <br />
organizations.
 
An OSA/OSC must obtain a CAGE
 
code via [https://sam.gov ''https://sam.gov '']before <br />
registering in PIEE. Step by Step <br />
instructions for how to obtain an <br />
account can be found on the PIEE <br />
Vendor Account website: [https://piee.eb.mil/xhtml/unauth/web/homepage/vendorGettingStartedHelp.xhtml ''https://<br />
piee.eb.mil/xhtml/unauth/web/ <br />
homepage/vendorGettingStartedHelp.<br />
xhtml''. ]
 
CAGE codes (or NCAGE codes for
 
non-US-based companies) are also <br />
required. US-based contractors obtain a <br />
Commercial and Government Entity <br />
(CAGE) code from [https://cage.dla.mil/Home/UsageAgree ''https://cage.dla.mil/ <br />
Home/UsageAgree''. Businesses outside <br />
]of the US must obtain a NATO <br />
Commercial and Government Entity <br />
[https://eportal.nspa.nato.int/Codification/CageTool/home (NCAGE) code from ''https://<br />
eportal.nspa.nato.int/Codification/ <br />
CageTool/home''. ]
 
As specified in §§ 170.15 and 170.16,
 
SPRS inputs include the industry CAGE <br />
codes(s) associated with the information <br />
system(s) addressed by the CMMC <br />
Assessment Scope. For each new <br />
information system used to support a <br />
DoD contract with FCI or CUI, a new <br />
SPRS entry is required. If the contractor <br />
or subcontractor will use an information <br />
system associated with a CAGE code <br />
already recorded in SPRS then a new <br />
entry is not required.
 
3. Assessors and Certificates
 
''Comment: ''One commenter asked if an
 
assessor is prohibited from interacting <br />
with OSA IT tools such as MS Office <br />
365 or cloud based GRC tools. One <br />
commenter requested the CMMC rule <br />
require C3PAOs to clearly indicate the <br />
CMMC Assessment Scope on the CMMC <br />
Certificate of CMMC Status, to include <br />
CAGE codes, that could be shared with <br />
trusted partners.
 
''Response: ''The rule text in
 
§ 170.11(b)(7) does not prohibit <br />
collecting assessment evidence within <br />
the OSC environment using the OSC’s <br />
IT. This section applies only to IT used
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00044
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83135 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
by the assessors to process, store, or <br />
transmit assessment-related information <br />
once it leaves the OSC environment. <br />
The rule has been modified to list the <br />
minimum required information to be <br />
included on the Certificate of CMMC <br />
Status, including CAGE code.
 
h. Reassessment
 
''Comment: ''Some commenters
 
interpreted the end of a CMMC <br />
assessment validity period (and need for <br />
new assessment) as having the same <br />
significance or meaning as a <br />
‘‘reassessment’’, which the rule <br />
describes as potentially necessary only <br />
in rare circumstances when <br />
cybersecurity risks, threats, or <br />
awareness have changed.
 
Another commenter asked for
 
examples of circumstances that might <br />
prompt a re-assessment and description <br />
of the process for completing one. Four <br />
commenters expressed concern that re- <br />
assessments might be frequent, costly, <br />
and time-consuming. These commenters <br />
sought confirmation that relatively <br />
common system maintenance activities <br />
would not require a new assessment or <br />
prevent annual affirmation.
 
One commenter questioned the
 
rationale for differences between <br />
validity periods for CMMC Level 1 <br />
versus Levels 2 and 3 assessment and <br />
recommended standardization on either <br />
a 1-year or 3-year frequency for all <br />
levels. Other commenters asserted that <br />
annual affirmations would drive a need <br />
for annual assessments at levels 2 or 3 <br />
and requested deletion of the <br />
affirmation requirement.
 
One commenter asked whether
 
system changes within an assessment <br />
scope would require notification to the <br />
contracting agency. Another asked for <br />
guidance on remediation of POA&amp;M <br />
items and asked whether systems that <br />
fall out of compliance must be <br />
identified to the contracting agency.
 
''Response: ''The DoD considered
 
duration of assessment validity periods <br />
and has chosen to require self- <br />
assessment of the basic Level 1 <br />
requirements every year, rather than <br />
every three years. Levels 2 and 3 require <br />
implementation of a significantly larger <br />
number of more complex security <br />
requirements, which require more time <br />
and attention to assess.
 
The DoD also declines to delete the
 
annual affirmation requirement and <br />
does not agree that it equates to an <br />
annual assessment. The rule was <br />
modified to clarify that reassessments <br />
may be required based on post- <br />
assessment indicators of cybersecurity <br />
issues or non-compliance and are <br />
different from new assessments that <br />
occur when an assessment validity
 
period expires. Reassessment is <br />
expected to be infrequent, conducted by <br />
the DoD, and necessary when <br />
cybersecurity risks, threats, or <br />
awareness have changed, or indicators <br />
of cybersecurity deficiencies and/or <br />
non-compliance are present. When <br />
required, DCMA DIBCAC will initiate <br />
the re-assessment process using <br />
established procedures. The rule has <br />
been further updated to add this DCMA <br />
DIBCAC responsibility in § 170.7. OSCs <br />
seeking confirmation upon CMMC Level <br />
2 POA&amp;M close-out may undergo <br />
POA&amp;M close-out assessment by a <br />
C3PAO, which is different from <br />
reassessment.
 
Self-assessments and certification
 
assessments are valid for a defined <br />
CMMC Assessment Scope as outlined in <br />
§ 170.19 CMMC Scoping. A new <br />
assessment is required if there are <br />
significant architectural or boundary <br />
changes to the previous CMMC <br />
Assessment Scope. Examples include, <br />
but are not limited to, expansions of <br />
networks or mergers and acquisitions. <br />
Operational changes within a CMMC <br />
Assessment Scope, such as adding or <br />
subtracting resources within the existing <br />
assessment boundary that follow the <br />
existing SSP do not require a new <br />
assessment, but rather are covered by <br />
the annual affirmations to the <br />
continuing compliance with <br />
requirements. The CMMC rule does not <br />
prohibit an OSA from using an <br />
operational plan of action at any CMMC <br />
Level to address necessary information <br />
system updates, patches, or <br />
reconfiguration as threats evolve.
 
If the CMMC Assessment Scope
 
changes, then the current assessment is <br />
no longer valid and a new assessment is <br />
required. Requirements to notify the <br />
contracting agency of compliance <br />
changes are described in the 48 CFR <br />
part 204 CMMC Acquisition rule. An <br />
annual affirmation is required at each <br />
CMMC level.
 
''16. CMMC Assessment Scoping Policy ''
 
''Comment: ''One comment asked
 
whether the requirements of DFARS <br />
clause 252.204–7012 apply to the entire <br />
contractor-owned information system, <br />
or only those components of the system <br />
that process, store, or transmit the CUI. <br />
Another questioned whether assets that <br />
process both FCI and CUI require <br />
CMMC Level 1 assessment.
 
One comment asserted that
 
assessments described in DFARS <br />
provision 252.204–7019 and 7020 are <br />
scoped differently than CMMC <br />
assessments, and requested the rule be <br />
revised to avoid duplication with those <br />
assessments, where applicable. Another <br />
recommended that DoD determine
 
scoping, boundaries, standards, and <br />
assessments based on CUI data rather <br />
than by systems.
 
One comment suggested that the rule
 
be modified to address CMMC <br />
applicability to service providers that <br />
only provide temporary services, such <br />
as penetration testing, cyber incident <br />
response, or forensic analysis.
 
''Response: ''OSAs determine the CMMC
 
Assessment Scope based on how and <br />
where they will process, store, and <br />
transmit FCI and CUI. DoD has reviewed <br />
the suggested changes and declines to <br />
make any updates. Additional <br />
information for CMMC Scoping <br />
(§ 170.19) can be found in the relevant <br />
scoping guides. The applicability of <br />
DFARS clause 252.204–7012 <br />
requirements is not within the scope of <br />
this rule.
 
Meeting CMMC Level 2 self-
 
assessment or certification assessment <br />
requirements also satisfies CMMC Level <br />
1 self-assessment requirements for the <br />
same CMMC Assessment Scope. One <br />
commenter incorrectly assumes that <br />
CMMC asset categories drive a change to <br />
the assessment scope from what exists <br />
in DFARS clause 252.204–7012, which <br />
implements NIST SP 800–171 R2. No <br />
conflicts exist between the DFARS <br />
clause 252.204–7012 requirements and <br />
the CMMC requirements in this rule.
 
The DoD declines to change the rule
 
to base scoping, boundaries, standards, <br />
or assessments solely on CUI data rather <br />
than on systems. The purpose of the <br />
CMMC Program is for contractors and <br />
subcontractors to demonstrate that FCI <br />
and CUI is adequately safeguarded <br />
through the methodology provided in <br />
the rule. The decision on what CMMC <br />
level is required for a contract is made <br />
by the Government after considering the <br />
nature of the planned effort, associated <br />
risks, and CUI to be shared. OSAs <br />
determine the CMMC Assessment Scope <br />
based on how and where they will <br />
process, store, and transmit FCI and <br />
CUI.
 
Service providers who only need
 
temporary access to perform services <br />
such as penetration testing, cyber <br />
incident response, or forensic analysis <br />
do not meet the definition of an ESP in <br />
§ 170.4 and do not process, store, or <br />
transmit CUI. Therefore, they are not <br />
within scope and the DoD declines to <br />
modify the rule to include them.
 
''17. CMMC Assessment Scope for ESPs ''
 
a. CMMC Applicability to ESPs
 
''Comment: ''DoD received numerous
 
comments about the implications of <br />
using an ESP while seeking to comply <br />
with CMMC requirements. Many <br />
comments were concerns that the ESP
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00045
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83136 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
assessment requirements expanded the <br />
scope and cost of the CMMC program. <br />
Additionally, some comments described <br />
overarching concerns about <br />
applicability of CMMC requirements to <br />
an ESP when it only provided a Security <br />
Protection Asset or processed Security <br />
Protection Data. In general, commenters <br />
requested to narrow the rule while <br />
providing more clarity and definition <br />
related to CMMC requirements for ESPs <br />
and CSPs. Many comments gave either <br />
hypothetical or actual scenarios and <br />
asked whether the ESP in that scenario <br />
would be required to complete a CMMC <br />
assessment at the level required for the <br />
OSA being supported.
 
One comment suggested that ESPs
 
should be treated the same as Risk <br />
Managed Assets. Another comment <br />
suggested that they be treated as <br />
Specialized Assets. Two comments <br />
proposed that DoD restrict DoD <br />
contractors to the use of an ESP/MSP/ <br />
MSSP that is ISO/IEC 27001:2022(E) <br />
certified. Two comments suggest that <br />
OSA’s be allowed to use non-certified or <br />
some form of conditionally certified <br />
ESPs if they retain the appropriate <br />
artifacts for review.
 
''Response: ''The DoD has revised the
 
rule to reduce the assessment burden on <br />
External Service Providers (ESP). ESP <br />
assessment, certification, and <br />
authorization requirements in <br />
§§ 170.19(c)(2) and (d)(2) have been <br />
updated. The use of an ESP, its <br />
relationship to the OSA, and the <br />
services provided need to be <br />
documented in the OSA’s SSP and <br />
described in the ESP’s service <br />
description and customer responsibility <br />
matrix (CRM), which describes the <br />
responsibilities of the OSA and ESP <br />
with respect to the services provided.
 
ESPs that are CSPs, and process, store,
 
or transmit CUI, must meet the <br />
FedRAMP requirements in DFARS <br />
clause 252.204–7012. ESPs that are <br />
CSPs and do NOT process, store, or <br />
transmit CUI, are not required to meet <br />
FedRAMP requirements in DFARS <br />
clause 252.204–7012. Services provided <br />
by the CSP are in the OSA’s scope.
 
When ESPs that are not CSPs, process,
 
store, or transmit CUI, a CMMC <br />
assessment is required to verify <br />
compliance with requirements for <br />
safeguarding CUI. Any ESP services <br />
used to meet OSA requirements are <br />
within the scope of the OSA’s CMMC <br />
assessment.
 
When ESPs that are not CSPs do NOT
 
process, store, or transmit CUI, they do <br />
not require CMMC assessment or <br />
certification, however, services they <br />
provide are in the OSA’s assessment <br />
scope. There is nothing in the rule that <br />
precludes an ESP, that is not a CSP,
 
from voluntarily requesting a C3PAO <br />
assessment. A C3PAO may perform <br />
such an assessment if the ESP makes <br />
that business decision.
 
ESPs can be part of the same
 
corporate/organizational structure but <br />
still be external to the OSA such as a <br />
centralized Security Operations Center <br />
(SOC) or Network Operations Center <br />
(NOC) which supports multiple <br />
business units. The same requirements <br />
apply and are based on whether the ESP <br />
provides cloud services and whether the <br />
ESP processes, stores, or transmits CUI <br />
on their systems.
 
An ESP that is used as on-site staff
 
augmentation only, ''i.e., ''the OSA <br />
provides all processes, technology, and <br />
facilities, does not need CMMC <br />
assessment. When ESPs are assessed as <br />
part of an OSA’s assessment, the <br />
assessment type is dictated by the <br />
OSA’s DoD contract CMMC <br />
requirement. The DoD declines to make <br />
any other suggested changes to the <br />
assessment of ESPs.
 
b. Definitions
 
''Comment: ''Multiple comments state
 
that the definition of CSP in the rule is <br />
overly broad and overlaps with the <br />
definition of ESP. One comment <br />
questioned whether a C3PAO is also a <br />
Security Protection Asset and by <br />
extension an ESP. Two comments <br />
requested change to the definition of <br />
Out-of-Scope Assets to stipulate that <br />
SPD is Out-of-Scope.
 
''Response: ''Several comments
 
requested clarification on when an ESP <br />
would be considered a CSP. CSPs, <br />
MSPs, and MSSPs are always <br />
considered ESPs. The DoD has updated <br />
the rule to narrow the definition of <br />
Cloud Service Provider based on the <br />
definition for cloud computing from <br />
NIST SP 800–145 Sept2011. An ESP <br />
would be considered a CSP when it <br />
provides its own cloud services based <br />
on a model for enabling ubiquitous, <br />
convenient, on-demand network access <br />
to a shared pool of configurable <br />
computing that can be rapidly <br />
provisioned and released with minimal <br />
management effort or service provider <br />
interaction on the part of the OSA.
 
An ESP (not a CSP) that provides
 
technical support services to its clients <br />
would be considered an MSP. It does <br />
not host its own cloud platform offering. <br />
An ESP may utilize cloud offerings to <br />
deliver services to clients without being <br />
a CSP. An ESP that manages a third- <br />
party cloud service on behalf of an OSA <br />
would not be considered a CSP.
 
C3PAOs need not ‘‘receive’’ security
 
protection data as part of an assessment; <br />
they view the security protection data <br />
while on premises at the OSC for the
 
assessment. A C3PAO is not an ESP or <br />
security protection asset and is therefore <br />
not within the OSA assessment <br />
boundary. DoD declines to delete the <br />
phrase ‘‘except for assets that provide <br />
security protection for a CUI asset’’ from <br />
the definition of Out-of-Scope Assets. <br />
Assets that provide security protection <br />
for CUI are not Out-of-Scope Assets. A <br />
CMMC definition for Security <br />
Protection Data has been added to the <br />
rule.
 
c. OSA Relationship to ESP
 
''Comment: ''Several comments request
 
clarification related to use of an ESP <br />
that is internal to the OSA. One <br />
comment requested that DoD require <br />
CSPs grant the US Government, as part <br />
of the contract between the OSA and the <br />
CSP, access to any CUI that is subject to <br />
CMMC requirements in the event of <br />
contractual failures, criminal actions or <br />
other legal situations that warrant <br />
seizure of CUI data. Some comments <br />
also asked whether the DoD has <br />
standing or authority to require C3PAO <br />
assessment or conduct CMMC level 3 <br />
assessments of ESPs, given that the <br />
ESP’s direct contractual relationship is <br />
not with the Government but with the <br />
OSA. Two comments suggest that ESPs <br />
will be covered by the subcontractor <br />
flow down requirements from an OSA.
 
''Response: ''DoD agrees with the need
 
for added clarity around internal ESPs <br />
and the rule was modified to remove the <br />
term internal ESP. An ESP that provides <br />
staff augmentation, where the OSA <br />
provides all processes, technology, and <br />
facilities, does not need CMMC <br />
assessment. Alternatively, an ESP can <br />
be part of the same organizational <br />
structure but still be external to the <br />
OSA, such as a centralized SOC or NOC <br />
which supports multiple business units. <br />
The CMMC requirements apply and are <br />
based on whether the ESP provides <br />
cloud services and whether the ESP <br />
processes, stores, or transmits CUI on <br />
their systems.
 
The OSA’s contractual rights with its
 
CSP are beyond the scope of this rule.
 
The rule states requirements for the
 
OSA, not the ESP. The rule requires <br />
OSAs that process, store, or transmit FCI <br />
and CUI to protect that data. If those <br />
OSAs elect to use an ESP, and that ESP <br />
processes, stores, or transmits FCI or <br />
CUI from the OSA, then the OSA must <br />
require that the ESP protect the FCI and <br />
CUI and the ESP will be assessed as part <br />
of the OSA’s assessment or require <br />
FedRAMP Moderate or equivalent.
 
Specifically for Level 3, if an OSC is
 
seeking Level 3 certification and uses an <br />
ESP that is not a CSP and that DOES <br />
process, store, or transmit CUI, then the <br />
ESP will need to be assessed by DIBCAC
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00046
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83137 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
against the same Level 3 requirements <br />
as the OSC as part of the OSC’s <br />
assessment unless the ESP voluntarily <br />
seeks a DIBCAC Assessment. If an OSC <br />
is seeking Level 3 certification and uses <br />
an ESP that DOES NOT process, store, <br />
or transmit CUI, then the ESP will NOT <br />
need to be assessed by DIBCAC against <br />
the same Level 3 requirements as the <br />
OSC. ESPs provide a service that meets <br />
the requirements specified by the OSA, <br />
and therefore ESPs are not <br />
subcontractors on a DoD contract and <br />
are not bound by subcontractor flow <br />
down requirements.
 
d. Assessment of ESPs
 
''Comment: ''There were multiple
 
comments regarding the assessment of <br />
an ESP. One comment recommends the <br />
rule be revised to identify the specific <br />
assessment requirements that would be <br />
considered NOT MET by the OSA when <br />
using a non-compliant ESP, and to <br />
further require C3PAOs to validate the <br />
OSCs use of compliant ESPs during a <br />
CMMC Level 2 assessment. One <br />
comment asks if an ESP, when assessed, <br />
will require a CAGE code, and enter <br />
scores into SPRS. Another comment <br />
asked whether CMMC certification <br />
would be required when offering full IT <br />
management and online storage, <br />
including CUI, if the MSP policies <br />
prevent employees from accessing <br />
customer data.
 
One comment asks for clarification on
 
the contents of the System Security Plan <br />
when documenting the use of an ESP. <br />
Two comments ask how to assess an <br />
OSA that is using a CSP to store CUI <br />
that does not meet the FedRAMP <br />
requirements. One comment asks how <br />
C3PAOs can check on the assessment <br />
status of an ESP. Three comments ask <br />
how to avoid redundant assessments of <br />
ESPs. One comment asks to clarify how <br />
to handle ESPs at Level 3 with respect <br />
to requirement AC.L3–3.1.2e that <br />
restricts access to systems that are <br />
owned, provisioned, or issued by the <br />
organization. One comment <br />
recommends DoD exempt CSPs that <br />
provide service with end-to-end <br />
encryption from CMMC requirements, <br />
similar to a common carrier.
 
Several comments inquired about
 
guidelines and practices for obtaining <br />
Customer Responsibility Matrices <br />
(CRM) from CSPs and suggest the rule <br />
be modified to also require them from <br />
ESPs. One comment asks about how to <br />
obtain a CSP’s System Security Plan.
 
''Response: ''Implications for OSAs and
 
C3PAOs for using non-compliant ESPs <br />
are adequately addressed in the rule. <br />
The CMMC compliance of an ESP, <br />
including a CSP, falls under the OSA’s <br />
assessment. If an ESP is used to meet
 
any of the CMMC requirements for the <br />
OSA, then the ESP is part of the scope <br />
of the OSA’s assessment, and the <br />
compliance of the ESP will be verified.
 
An ESP that is seeking CMMC
 
assessment will need to obtain a CAGE <br />
code and an account in SPRS to enable <br />
the reporting of its assessment results <br />
via CMMC eMASS. A SPRS account is <br />
required to complete the CMMC annual <br />
affirmation requirement included in <br />
DoD contracts that include a CMMC <br />
certification requirement.
 
An ESP that processes, stores, or
 
transmits CUI, is an extension of the <br />
OSA’s environment. As part of that <br />
environment, the ESP will be assessed <br />
against all requirements and <br />
accountable for all users who have <br />
access to CUI as part of the ESP’s <br />
service, not just OSA employees. The <br />
government cannot comment on specific <br />
implementation or documentation <br />
choices of an OSA, including the use of <br />
an ESP.
 
The C3PAO can only give credit to a
 
FedRAMP Moderate Authorized or <br />
equivalent CSP. Any requirements <br />
dependent on contributions from a CSP <br />
in any other stage of compliance are <br />
considered NOT MET. The <br />
requirements in the rule for FedRAMP <br />
Moderate equivalency have been <br />
updated to reflect DoD policy. OSAs can <br />
consider CSPs in the FedRAMP process <br />
for equivalency if they meet the <br />
requirements in DoD policy.
 
An ESP that is a CSP will be listed on
 
the FedRAMP Marketplace. An ESP that <br />
is not a CSP and processes, stores, or <br />
transmits CUI will be within the OSA’s <br />
assessment scope. An ESP can also <br />
volunteer to have a C3PAO assessment <br />
and could make that information <br />
available to the OSA.
 
ESPs that are not CSPs may request
 
voluntary CMMC assessments of their <br />
environment and use that as a business <br />
discriminator. The marketplace for ESP <br />
services will adjust to find the efficient <br />
manner for ESPs to support OSA <br />
assessments that may include their <br />
services. With respect to requirement <br />
AC.L3–3.1.2e, when an OSA adds an <br />
ESP’s services to its network, the ESP is <br />
considered to be provisioned by the <br />
OSA. It is subject to the requirements <br />
for the use of an ESP.
 
A common carrier’s information
 
system is not within the contractor’s <br />
CMMC Assessment Scope if CUI is <br />
properly encrypted during transport <br />
across the common carrier’s information <br />
system.
 
In a cloud model, the end-to-end
 
encryption would apply when <br />
transmitting between OSA CUI assets <br />
and a cloud service. Once within the <br />
security boundary of the CSP, the
 
common carrier’s system no longer <br />
contributes to the handling of the CUI <br />
and the CSP’s security practices apply. <br />
If an OSA chooses to use a CSP to <br />
process, store, or transmit CUI, <br />
FedRAMP Moderate or equivalency <br />
requirements apply.
 
The rule has been updated to include
 
the use of a Customer Responsibility <br />
Matrix by all ESPs, not just CSPs. <br />
Obtaining a copy of a CSP’s SSP is not <br />
required for a CSP that is FedRAMP <br />
Authorized. Documentation on the <br />
services provided by the CSP and a <br />
CRM will be required.
 
e. Capacity for Assessment of ESPs
 
''Comment: ''Some comments
 
questioned whether the CMMC <br />
ecosystem would be adequate to provide <br />
the number of CMMC assessments <br />
necessary for ESPs. In response, some <br />
comments recommend ESPs be given <br />
priority for completing assessments. <br />
Others recommend different phasing or <br />
forms of assessment and certification <br />
during ramp up.
 
''Response: ''DoD declines to make
 
suggested changes to the ramp up and <br />
phasing of assessments for ESPs. DoD <br />
considered many alternatives before <br />
deciding upon the current CMMC <br />
assessment structure. By design, the <br />
CMMC program depends on the supply <br />
and demand dynamics of the free <br />
market, enabling it to naturally scale <br />
and adapt to capacity requirements. <br />
DoD declines to set priorities for the <br />
assessment marketplace. The DoD has <br />
utilized a phased implementation <br />
approach to reduce implementation <br />
risk. DoD expects that the public has <br />
utilized the lead-time prior to the <br />
publication of this rule to prepare for <br />
CMMC implementation and buy-down <br />
risk. CMMC Program requirements make <br />
no changes to existing policies for <br />
information security requirements <br />
implemented by the DoD. It is beyond <br />
the scope of this rule for DoD to <br />
determine the order in which <br />
organizations are assessed.
 
f. Remote Access by ESPs
 
''Comment: ''Two comments ask for
 
clarification on requirements for remote <br />
access by an ESP to an OSA, whether <br />
with OSA provided equipment or a <br />
VPN.
 
''Response: ''The assessment of remote
 
access may fall into several categories <br />
and is dependent on the specific <br />
architecture used and how the OSA <br />
creates its assessment environment. <br />
When an ESP is providing staff <br />
augmentation to the OSA and the OSA <br />
is providing all the systems used for <br />
remote access, then the OSA’s policies <br />
and procedures apply and the ESP is not
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00047
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83138 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
considered to be processing, storing, or <br />
transmitting CUI. When the ESP is using <br />
a Virtual Desktop solution, then the <br />
endpoint client device will be <br />
considered out of scope when it is <br />
configured to prevent storage, <br />
processing, or transmission of CUI on <br />
the end client beyond the Keyboard, <br />
Video, Mouse input that is part of the <br />
Virtual Desktop Infrastructure (VDI) <br />
solution.
 
Establishing a VPN connection with
 
MSP equipment brings that equipment <br />
into the OSA’s assessment scope. The <br />
equipment must meet the OSA’s <br />
requirements for external access and <br />
connection to the network. Depending <br />
on the processing performed by the ESP <br />
with the VPN connection, other <br />
requirements may apply.
 
''18. CMMC Assessment Scope for <br />
Security Protection Assets and Data ''
 
a. Scope and Authority
 
''Comment: ''Multiple comments
 
asserted that the use of Security <br />
Protection Data and Security Protection <br />
Assets increases the scope and cost of <br />
CMMC assessments and recommend <br />
changes to the costs or removing SPD <br />
and SPA from the rule. One comment <br />
presented the increased scope as an <br />
inconsistency between NARA and NIST <br />
SP 800–171A Jun2018. A few comments <br />
asked what authority DoD uses to <br />
include SPD as part of CMMC <br />
assessment.
 
''Response: ''The commenter misread
 
the rule’s application to ESPs and SPA/ <br />
SPD. Security Protection Assets are <br />
specified in NIST SP 800–171 R2 Sec <br />
1.1 which states: ‘‘The requirements <br />
apply only to components of nonfederal <br />
systems that process, store, or transmit <br />
CUI, or that provide security protection <br />
for such components.’’ The rule has <br />
been updated in table 3 to § 170.19(c)(1) <br />
and table 5 to § 170.19(d)(1) to change <br />
the definition and requirements of <br />
Security Protection Assets. The phrase <br />
‘‘irrespective of whether or not these <br />
assets process, store, or transmit CUI’’ <br />
has been removed from the SPA <br />
description and the CMMC assessment <br />
requirements have been changed to read <br />
‘‘Assess against CMMC security <br />
requirements that are relevant to the <br />
capabilities provided.’’ Similar changes <br />
were made to the guidance documents. <br />
In order to clarify and address concerns <br />
about the perceived ‘‘expansion’’ of <br />
requirements, the rule was revised to <br />
reflect that ESPs that only store SPD or <br />
provide an SPA and do not process, <br />
store, or transmit CUI do not require <br />
CMMC assessment or certification.
 
b. Definition and Requirements
 
''Comment: ''Numerous comments
 
requested that the DoD provide a <br />
definition for Security Protection Data <br />
(SPD) and configuration data, as well as <br />
requirements for SPD to help <br />
understand the scope of SPD and how <br />
that impacts the scope of Security <br />
Protection Assets and the assessment <br />
requirements of ESPs. One comment <br />
recommended the removal of the <br />
definition and use of SPD.
 
Multiple comments requested more
 
information on the definition and <br />
scoping of Security Protection Assets, <br />
their relationship to CUI, and their <br />
requirements. Some comments <br />
suggested that the definition narrow the <br />
scope of Security Protection Assets and/ <br />
or their security and assessment <br />
requirements. Other comments <br />
recommended eliminating the concept <br />
of SPA. Additional comments <br />
recommended changing the assessment <br />
requirements for SPAs to be the same as <br />
CRMAs Specialized Assets applicable <br />
NIST SP 800–171 R2 requirements, <br />
commensurate with the level of <br />
involvement with the security of CUI or <br />
to only assess the requirements <br />
provided by the SPA. Two comments <br />
recommended that the phrase’’ <br />
irrespective of whether these assets <br />
process, store, or transmit CUI’’ be <br />
removed from the definition of SPA.
 
Two comments asked for clarification
 
on the requirements for CSPs that only <br />
handle SPD.
 
Two comments recommended
 
different security and assessment <br />
requirements for ESPs that host SPD but <br />
do not process, store, or transmit CUI.
 
''Response: ''DoD added a CMMC
 
definition for Security Protection Data <br />
to the rule. The DoD considered the <br />
NIST definitions for System Information <br />
and Security Relevant Information in <br />
the development of the CMMC <br />
definition for SPD.
 
This rule does not regulate OSA
 
Security Protection Data, but instead <br />
implements existing regulatory <br />
requirements for the safeguarding of <br />
CUI, as defined in 32 CFR 2002.14(h)(2) <br />
and implemented by DFARS clause <br />
252.204–7012. This clause requires <br />
protection of security protection assets <br />
and security protection data through its <br />
specification of NIST SP 800–171.
 
DoD does not agree with the
 
commentor’s statement that the <br />
definition of Security Protection Assets <br />
‘‘is an exceedingly dangerous <br />
adjustment to the NIST SP 800–171 <br />
Revision 2 Paragraph 1.1 Scope of <br />
Applicability.’’ Security Protection <br />
Assets provide security to the entirety of <br />
an OSA’s assessment scope which
 
includes CUI Assets and other in-scope <br />
assets.
 
The SPD definition also defines
 
configuration data as data required to <br />
operate a security protection asset. This <br />
limits the possible interpretations of <br />
configuration data. Further, the rule has <br />
been updated to reflect that ESPs that do <br />
NOT process, store, or transmit CUI do <br />
not require CMMC assessment or <br />
certification.
 
All assets within an OSA defined
 
CMMC Level 2 or 3 assessment <br />
boundary have access to CUI and can <br />
process, store, or transmit CUI. They are <br />
therefore subject to DFARS clause <br />
252.204–7012 and required to meet <br />
NIST SP 800–171 requirements. This is <br />
the authority for including Contractor <br />
Risk Managed Assets (CRMAs) within <br />
CMMC assessments. For Level 2, DoD <br />
has decided to assume some risk and <br />
lessen the assurance burden for a class <br />
of these assets called Contractor Risk <br />
Managed Assets, as specified in table 3 <br />
to § 170.19(c)(1). DoD does not assume <br />
this risk at Level 3. CRMAs are subject <br />
to assessment against all CMMC <br />
requirements as specified in table 5 to <br />
§ 170.19(d)(1).
 
''19. CMMC Assessment Scope and <br />
FedRAMP Moderate Equivalency <br />
Requirements ''
 
''Comment: ''Several commenters
 
identified inconsistencies between rule <br />
content and a separate DoD policy <br />
memo that defines requirements Cloud <br />
Service Providers (CSPs) must meet to <br />
be considered FedRAMP moderate <br />
‘‘equivalent’’ in the context of DFARS <br />
clause 252.204–7012. One commenter <br />
requested administrative changes to the <br />
rule for consistency, while others <br />
requested more substantive changes to <br />
deconflict the rule with DoD’s policies. <br />
Differences between the two documents <br />
left some commenters unclear about <br />
when a CSP would be considered <br />
within a CMMC assessment scope or <br />
required to meet CMMC requirements. <br />
They also noted that some CSPs refuse <br />
to provide clients with Customer <br />
Responsibility Matrices (CRMs), which <br />
could impede an OSAs ability to meet <br />
CMMC requirements. One commenter <br />
asked for specific instances when a <br />
FedRAMP-moderate-authorized CSP <br />
would not be accepted as meeting <br />
CMMC requirements or which <br />
requirements such a CSP could not <br />
meet.
 
Another commenter stated the
 
FedRAMP moderate equivalency <br />
requirements for CSPs in this rule will <br />
create confusion because they address <br />
only the NIST SP 800–171 requirements <br />
and do not include the additional cyber <br />
incident reporting requirements
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00048
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83139 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
identified in DFARS clause 252.204– <br />
7012. One comment suggested that any <br />
expectation for CSPs to meet the DFARS <br />
clause 252.204–7012 requirements for <br />
cyber incident reporting or completion <br />
of a System Security Plan should be <br />
referenced in this CMMC rule. Another <br />
commenter suggested that all DoD <br />
contracts with CUI should include <br />
clauses and provisions for CSPs to meet <br />
Federal requirements, including a self- <br />
assessment and certification of their <br />
systems.
 
One commenter asked whether it is
 
sufficient for MSP/MSSPs to have <br />
FedRAMP certification instead of <br />
CMMC certification. Another <br />
interpreted the rule’s wording related to <br />
security protection assets and data as <br />
expanding requirements levied on CSPs.
 
One commenter interpreted CMMC
 
Level 3 assessment requirements as <br />
meaning all parts of an OSCs <br />
infrastructure are within scope for <br />
CMMC assessment if the OSC uses a <br />
CSP, and recommended the rule specify <br />
that security requirements from the <br />
CRM must be documented in the SSP. <br />
Another asked whether OSCs must track <br />
all FedRAMP controls in their SSP or <br />
only those relevant to NIST SP 800–171 <br />
R2.
 
''Response: ''Requirements associated
 
with the use of cloud service providers <br />
(CSPs) are covered under section <br />
(b)(2)(ii)(D) of DFARS clause 252.204– <br />
7012. When a CSP is used, it must meet <br />
the requirements of the FedRAMP <br />
moderate baseline or the equivalent. <br />
The rule was updated for consistency <br />
with those requirements, and now <br />
requires FedRAMP moderate or <br />
FedRAMP moderate equivalency as <br />
defined in DoD Policy.
 
§§ 170.16(c)(2), 170.17(c)(5),
 
170.18(c)(5) address CMMC <br />
requirements for CSPs. The CMMC rule <br />
does not add new requirements on the <br />
use of CSPs, which are found in DFARS <br />
clause 252.204–7012. A CSP must be <br />
assessed against the FedRAMP moderate <br />
baseline when the CSP processes, stores, <br />
or transmits CUI. The CMMC rule does <br />
not oppose or contradict the <br />
requirements of DFARS clause 252.204– <br />
7012, nor does this rule relieve a CSP <br />
from any requirement defined in DFARS <br />
clause 252.204–7012.
 
§ 170.17(c)(5)(iii) and the
 
corresponding requirement in <br />
§ 170.18(c)(5)(iii) only apply to CSPs <br />
used to process, store, or transmit CUI <br />
in the execution of the contract or <br />
subcontract requiring CMMC <br />
assessment. It does not expand to any <br />
cloud provider outside the scope of the <br />
assessment. Interactions between DoD <br />
contractors and their service providers <br />
are beyond the scope of the rule.
 
CMMC Level 2 self-assessment and
 
affirmation requirements described in <br />
§ 170.16 make clear that an OSA using <br />
a FedRAMP Authorized CSP (at the <br />
FedRAMP Moderate or higher baseline) <br />
is not responsible for the CSP’s <br />
compliance. The OSA needs to <br />
document in its SSP how the OSA <br />
meets its requirements assigned in the <br />
CSP’s CRM. When using a CSP that is <br />
not FedRAMP Authorized, the OSA is <br />
responsible for determining if the CSP <br />
meets the requirements for FedRAMP <br />
Moderate equivalency as specified in <br />
DoD policy. In this case, the OSA also <br />
needs to document in its SSP how the <br />
OSA meets the requirements assigned to <br />
it in the CSP’s CRM.
 
The rule has been updated to include
 
verbiage from the DFARS clause <br />
252.204–7012 ‘‘in the performance of a <br />
contract’’ for consistency. Use of the <br />
term CUI in this rule is deliberate <br />
because DoD intends to assess <br />
compliance with NIST SP 800–171 R2 <br />
for all CUI. The DoD declines to replace <br />
the word CUI with the word CDI, as the <br />
term CUI more clearly conveys that <br />
NIST SP 800–171 is the requirement for <br />
all CUI information, as described in 32 <br />
CFR 2002.14.
 
DoD received numerous comments
 
about the use of ESPs which do not <br />
process, store, or transmit CUI. In <br />
response to comments, the DoD has <br />
reduced the assessment burden on ESPs. <br />
ESP assessment, certification, and <br />
authorization requirements in <br />
§§ 170.19(c)(2) and (d)(2) have been <br />
updated.
 
''20. CMMC Assessment Scope for <br />
Devices and Asset Categorization ''
 
a. Asset Categorization
 
''Comment: ''There were many
 
comments regarding the scoping and <br />
treatment of assets when using table 3 <br />
to § 170.19(c)(1) and table 5 to <br />
§ 170.19(d)(1). Several comments asked <br />
about when asset categorization occurs, <br />
who approves it and how to document <br />
it. Two comments questioned the <br />
applicability of using NIST SP 800–171 <br />
R2 for Specialized Assets. Two <br />
comments suggested modifying the <br />
definition of Out-of-Scope assets by <br />
removing the last bullet or discussing <br />
the use of encryption. One commenter <br />
suggested adding more detailed <br />
definitions of the asset categories to the <br />
rule. One comment recommended <br />
removing asset categories from the rule.
 
Many comments requested scoping
 
and categorization of specific scenarios, <br />
such as ERP systems, MRP systems, <br />
quantum computing systems, data <br />
diodes, asset isolation, and encrypted <br />
CUI. Numerous additional comments
 
requested clarification on scoping and <br />
categorization of various security <br />
product classes.
 
''Response: ''The OSA performs asset
 
categorization and documents it in their <br />
SSP. The OSA may choose the format <br />
and content of its SSP. Table 3 to <br />
§ 170.19(c)(1) requires that all asset <br />
categories, including Specialized Assets, <br />
be included in the asset inventory. <br />
There is no requirement to embed every <br />
asset in the SSP. In the SSP for Level 2, <br />
the OSA must show how Specialized <br />
Assets are managed using the <br />
contractor’s risk-based security policies, <br />
procedures, and practices. Prior to the <br />
conduct of an assessment, the OSC <br />
engages with the C3PAO assessor. It is <br />
during this time that the classification of <br />
assets should be agreed upon, and the <br />
results of these discussions are <br />
documented in pre-planning materials. <br />
This is an example of the pre- <br />
assessment and planning material <br />
submitted by the C3PAO as required in <br />
§ 170.9(b)(8) and the CMMC Assessment <br />
Scope submitted to eMASS as required <br />
in § 170.17(a)(i)(D). It is beyond the <br />
scope of this rule to address DoD review <br />
of specific Specialized Assets for <br />
individual contractors.
 
DoD does not agree with a
 
commentor’s statement that Specialized <br />
Assets are not actually assessed against <br />
CMMC security requirements. As <br />
documented in § 170.19, Specialized <br />
Assets are identified by the OSC. <br />
Assessment requirements of Specialized <br />
Assets differ between CMMC Level 2 <br />
and CMMC Level 3. If Specialized <br />
Assets are part of a CMMC Level 2 <br />
assessment, the OSA must document <br />
them in the asset inventory, document <br />
them in the SSP, and show how these <br />
assets are managed using the <br />
contractor’s risk-based security policies, <br />
procedures, and practices. If Specialized <br />
Assets are part of a CMMC Level 3 <br />
assessment, they must be assessed <br />
against all CMMC Level 2 security <br />
requirements and CMMC Level 3 <br />
security requirements, identified in <br />
§ 170.14(c)(4).
 
DoD agrees with one comment that
 
even if NIST SP 800–171 R2 cannot be <br />
implemented, that does not mean the <br />
Specialized Assets cannot be secured. <br />
CMMC requirements are defined to <br />
align directly to NIST SP 800–171 R2 <br />
and NIST SP 800–172 Feb2021 <br />
requirements. For additional ease of <br />
burden, at Level 1, IoT and OT are not <br />
in scope, at Level 2 there are reduced <br />
requirements, but they become in-scope <br />
at Level 3, unless they are physically or <br />
logically isolated.
 
DoD has reviewed the text and
 
declines to change the definition of Out- <br />
of-scope assets because CUI should not
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00049
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83140 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
be transmitted via clear-text per NIST <br />
SP 800–171 R2. The DoD has reviewed <br />
the suggested changes to asset categories <br />
and scoping tables and declines to make <br />
an update. The asset categories in the <br />
rule help the OSA understand the <br />
requirements of various asset types that <br />
might be found within the assessment <br />
boundary.
 
OSAs determine the asset categories
 
and assessment scope based on how and <br />
where they will process, store, and <br />
transmit FCI and CUI. DoD cannot <br />
comment on the suitability of any <br />
specific approach or technology to <br />
successfully implement CMMC security <br />
requirements.
 
b. Virtual Desktop Infrastructure
 
''Comment: ''Several comments
 
requested clarification on the use of <br />
Virtual Desktop Infrastructures and how <br />
to scope its components.
 
''Response: ''The rule has been updated
 
in table 3 to § 170.19(c)(1) and table 5 <br />
to § 170.19(d)(1) to state that an <br />
endpoint hosting a VDI client <br />
configured to not allow any processing, <br />
storage, or transmission of FCI and CUI <br />
beyond the Keyboard/Video/Mouse sent <br />
to the VDI client is considered out of <br />
scope.
 
c. Contractor Risk Managed Assets
 
''Comment: ''There were numerous
 
comments regarding Contractor Risk <br />
Managed Assets. Several comments <br />
perceived conflicts in the changes <br />
between the current rule and previous <br />
intermediate documents regarding <br />
CRMA requirements. Multiple <br />
comments recommended additional <br />
details explaining risk-based <br />
management of assets. Two comments <br />
requested additional details on the <br />
limited checks that are permitted during <br />
assessment of CRMAs. Multiple <br />
comments requested clarification on <br />
CRMA requirements at Level 3 for the <br />
OSA and ESP. One comment requested <br />
clarification about the documentation <br />
requirements for CRMAs.
 
One comment asserted that the rule
 
co-mingled CRMAs with assets of an <br />
ESP. One comment questioned why <br />
CRMAs were being included as in-scope <br />
assets subject to CMMC security <br />
requirements. One comment asked for <br />
clarification between the security <br />
requirements and assessment <br />
requirements for CRMAs.
 
''Response: ''There was confusion and
 
concern over conflicts from commenters <br />
regarding responses to comments on a <br />
previous version of the rule, other <br />
documentation, and the current rule. <br />
The DoD did not find any conflicting <br />
language around CRMAs. There is no <br />
conflict between CRMAs and the
 
requirements for logical or physical <br />
boundaries. CRMAs are only applicable <br />
within the CMMC Assessment Scope. <br />
DoD does not agree with the statement <br />
that the wording change around <br />
Contractor Risk Managed Asset (CRMA) <br />
effectively makes the asset category <br />
moot.
 
The CRMA category was created to
 
ease the assessment burden, based on <br />
the Department’s risk tolerance. It is not <br />
intended to reduce the level of <br />
protection and the CMMC security <br />
requirements which apply to the assets. <br />
Despite the wording changes identified <br />
by the commentor, the CMMC security <br />
requirements and the assessor’s ability <br />
to conduct a limited check to identify <br />
deficiencies as addressed in table 3 to <br />
§ 170.19(c)(1) are unchanged.
 
Contractor Risk Managed Assets
 
(CRMA) should be prepared to be <br />
assessed against CMMC security <br />
requirements at Level 2, and included in <br />
the SSP, asset inventory, and network <br />
diagrams.
 
Table 3 to § 170.19(c)(1) clearly
 
addresses the assessment requirements <br />
for Contractor Risk Managed Assets. All <br />
CMMC security requirements must be <br />
MET when the OSA chooses to <br />
designate certain assets as Contractor <br />
Risk Managed Assets.
 
Eight guidance documents for the
 
CMMC Program are listed in Appendix <br />
A to Part 170—Guidance. These <br />
documents provide additional guidance <br />
for the CMMC model, assessments, <br />
scoping, and hashing. Use of the <br />
guidance documents is optional.
 
The OSA is responsible for
 
determining its CMMC Assessment <br />
Scope and its relationship to security <br />
domains. Assets are out-of-scope when <br />
they are physically or logically <br />
separated from the assessment scope. <br />
Contractor Risk Managed Assets are <br />
only applicable within the OSA’s <br />
assessment scope. Table 3 to <br />
§ 170.19(c)(1) is used to identify the <br />
asset categories within the assessment <br />
scope and the associated requirements <br />
for each asset category. Contractor’s <br />
risk-based security policies, procedures, <br />
and practices are not used to define the <br />
scope of the assessment, they are <br />
descriptive of the types of documents an <br />
assessor will use to meet the CMMC <br />
assessment requirements.
 
It is beyond the scope of the CMMC
 
rule to provide a detailed explanation of <br />
the usage of ‘‘risk-based’’ terminology <br />
when implementing or assessing CMMC <br />
requirements. DoD declines to speculate <br />
and clarify the relationship between any <br />
NIST SP 800–171 R2 definitions and <br />
any pending NIST SP 800–171 Revision <br />
3 definitions.
 
The DoD has defined the effort
 
allowed during a limited check in table <br />
1 to 170.19(c)(1). A limited check may <br />
require submission of evidence.
 
The DoD cannot anticipate how an
 
OSC will scope its CMMC Level 3 <br />
assessment with respect to its CMMC <br />
Level 2 environment. As specified in <br />
table 5 to § 170.19(d)(1), Level 2 <br />
Contractor Risk Managed Assets are <br />
categorized as CUI Assets at Level 3.
 
The rule has been updated to clarify
 
that ESPs do not require a Level 3 <br />
certification unless they process, store, <br />
or transmit CUI in the performance of a <br />
contract with a CMMC Level 3 <br />
requirement.
 
3 As stated in table 1 to § 170.19(c)(1),
 
CRMA assets must be prepared to be <br />
assessed against CMMC requirements. <br />
The SSP must provide sufficient <br />
documentation describing how security <br />
requirements are met to allow the <br />
assessor to follow the instruction in <br />
table 1 to not assess against other <br />
requirements. The assessor will then <br />
decide if a limited spot check is <br />
warranted. The results of the limited <br />
spot check can result in a requirement <br />
being scored as NOT MET.
 
The rule does not create two classes
 
of Contractor Risk Managed Assets as <br />
one commenter asserts. Contractor Risk <br />
Managed Assets are only those assets <br />
that are owned by the OSC and within <br />
the assessment scope. ESP assets are <br />
subject to the ESP requirements of the <br />
rule.
 
All assets within the OSA defined
 
assessment boundary have access to CUI <br />
and can process, store, or transmit CUI, <br />
and are therefore subject to DFARS <br />
clause 252.204–7012 and required to <br />
meet NIST SP 800–171 requirements. <br />
This is the authority for including <br />
CRMAs within CMMC assessments. For <br />
Level 2, DoD has decided to assume <br />
some risk and lessen the assurance <br />
burden for a class of these assets called <br />
Contractor Risk Managed Assets, as <br />
specified in table 3 to § 170.19(c)(1). <br />
DoD does not assume this risk at Level <br />
3. Contractor Risk Managed Assets are <br />
subject to assessment against all CMMC <br />
requirements as specified in table 5 to <br />
§ 170.19(d)(1).
 
At CMMC Level 2, Contractor Risk
 
Managed Assets and Specialized Assets <br />
are assessed differently. Both types of <br />
assets must be documented in the SSPs; <br />
Specialized Assets will not, however, be <br />
assessed by the C3PAO while limited <br />
checks may be performed on Contractor <br />
Risk Managed Assets. OSCs should be <br />
prepared for assessment of Contractor <br />
Risk Managed Assets because a deeper <br />
assessment will be done if the assessor’s <br />
evaluation of the OSC’s policies and <br />
procedures raise questions. However, at
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00050
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83141 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
Level 3, Contractor Risk Managed Assets <br />
and Specialized Assets are assessed, like <br />
CUI assets, against all CMMC security <br />
requirements, so no additional <br />
explanation is required.
 
d. Specialized Assets
 
''Comment: ''There were numerous
 
comments regarding Specialized Assets. <br />
Several comments discuss the use of <br />
enduring exceptions for Specialized <br />
Assets and the use of the term in NIST <br />
SP 800–171 R2. Two comments confuse <br />
the current rule with responses to a <br />
previous version of the rule. A comment <br />
requests clarification why specialized <br />
assets are not CUI assets. Another <br />
comment asks about the difference in <br />
assessment requirements between <br />
CRMAs and Specialized assets. One <br />
comment requested processes and best <br />
practices for evaluation of specialized <br />
assets.
 
Two comments recommend that the
 
Specialized asset requirements for Level <br />
3 remain the same as Level 2 due to the <br />
difficulty of meeting the Level 3 <br />
requirements in a manufacturing <br />
environment. Two comments request <br />
additional clarification on the Level 2 <br />
assessment of Specialized assets when <br />
the assessment is a precursor to a Level <br />
3 assessment.
 
''Response: ''Definitions for enduring
 
exceptions and temporary deficiencies <br />
have been added to the rule. Specialized <br />
Assets are a type of enduring exception <br />
and cover a broad range of <br />
circumstances and system types that <br />
may not be able to be fully secured as <br />
described in NIST SP 800–171 R2. It <br />
does not give an OSA the flexibility to <br />
broadly categorize assets as Specialized <br />
Assets.
 
The OSA would be expected to
 
address asset categorization with a <br />
C3PAO during the initial scoping <br />
discussion to avoid disagreements <br />
during the assessment process.
 
In one example provided, a single
 
asset which is unable to meet a single <br />
security requirement would be a <br />
temporary deficiency and be addressed <br />
using an operational plan of action, <br />
describing the cause with appropriate <br />
mitigation and remediation identified.
 
The sentence ‘‘NIST SP 800–171 Rev
 
2 uses the term ‘‘enduring exceptions’’ <br />
to describe how to handle exceptions for <br />
Specialized Assets’’ appears in answers <br />
to public comments on a previous <br />
version of the rule, which responded to <br />
the initial CMMC Program <br />
requirements, therefore the inclusion of <br />
the sentence is not relevant to the rule.
 
One commenter has misinterpreted
 
the answer to a public comment on a <br />
previous version of the rule, which <br />
responded to the initial CMMC Program
 
requirements. Specialized Assets are not <br />
evaluated at Level 1. Specialized Assets <br />
at Level 2 need to be documented in the <br />
SSP and included in the asset inventory <br />
and network diagrams. They also are to <br />
be managed using the contractor’s risk- <br />
based security policies, procedures, and <br />
practices.
 
At Level 2, Specialized Assets do not
 
need to be assessed against other CMMC <br />
security requirements. At Level 3, <br />
Specialized Assets should be prepared <br />
to be assessed against CMMC security <br />
requirements. CMMC also provides for <br />
the use of intermediary devices to <br />
safeguard OT and IOT devices that <br />
otherwise would be difficult or <br />
expensive to protect. The phrase ‘‘or <br />
information systems not logically or <br />
physically isolated from all such <br />
systems’’ only appears in answers to <br />
public comments on the original 48 CFR <br />
CMMC interim final rule publication, <br />
therefore the inclusion of the phrase is <br />
not relevant to the rule.
 
Specialized Assets span a broad
 
spectrum of components and have <br />
different limitations on the application <br />
of security controls. Processes and <br />
practices to implement and assess <br />
security requirements on these devices <br />
are outside the scope of the CMMC rule.
 
The Level 3 assessment is designed to
 
provide additional safeguards to protect <br />
the most sensitive CUI against advanced <br />
persistent threats (APTs). DoD estimates <br />
that only one percent of defense <br />
contractors will require a CMMC Level <br />
3 assessment. DoD has judged that the <br />
risks associated with the exposure of <br />
this CUI are sufficient to justify the <br />
increased cost of a Level 3 assessment <br />
on the small percentage of the DIB that <br />
is processing, storing, or transmitting <br />
this type of data.
 
CMMC also provides for the use of
 
intermediary devices to safeguard OT <br />
and IOT devices that otherwise would <br />
be difficult or expensive to protect. This <br />
difference between how a Specialized <br />
Asset is assessed at Level 2 and Level <br />
3 is risk-based and affords a reduction <br />
in cost for a Level 2 certification. The <br />
CMMC Assessment Scope for a CMMC <br />
Level 2 certification assessment is <br />
discussed between the OSC and the <br />
C3PAO. If the OSC has a goal to undergo <br />
a CMMC Level 3 certification <br />
assessment for the same assessment <br />
scope, it may be good business practice <br />
for the OSC to disclose this information <br />
to the C3PAO and be assessed based on <br />
the Level 3 scoping, however this is not <br />
required.
 
e. Intermediary Devices
 
''Comment: ''One comment asks for
 
additional information on intermediary <br />
devices as referenced in table 5 to
 
§ 170.19(d)(1). Another comment asks <br />
for direction in situations where the <br />
comment asserts intermediary devices <br />
are not practical.
 
''Response: ''An intermediary device is
 
used in conjunction with a specialized <br />
asset to provide the capability to meet <br />
one or more of the CMMC security <br />
requirements. For example, such a <br />
device could be a boundary device or a <br />
proxy, depending on which <br />
requirements are being met. The rule is <br />
agnostic as to how many requirements <br />
are met and what technology is used to <br />
meet them. Implementation guidance <br />
for OT/IOT/IIOT is outside the scope of <br />
the CMMC rule.
 
''21. CMMC Assessment Scope for <br />
Enterprise Versus Segmented <br />
Environments ''
 
''Comment: ''Two commenters sought
 
guidance for segmented networks that <br />
inherit some controls from an enterprise <br />
network that has a valid CMMC <br />
certification, and asked whether <br />
certification assessments may be shared <br />
between the networks.
 
''Response: ''§ 170.19 states that prior to
 
a CMMC assessment, the OSA must <br />
define the CMMC Assessment Scope for <br />
the assessment, representing the <br />
boundary with which the CMMC <br />
assessment will be associated. Any <br />
CMMC certification granted applies <br />
only to the assessed CMMC Assessment <br />
Scope. An enclave may be able to <br />
leverage some elements of the enterprise <br />
assessment by inheriting some <br />
requirements from the enterprise <br />
network, but it cannot inherit the <br />
enterprise certification. Enclaves <br />
beyond the certified CMMC Assessment <br />
Scope must be assessed separately based <br />
on their own CMMC Assessment Scope.
 
There is no established metric for
 
inherited implementations from an <br />
enterprise to any defined enclaves. The <br />
OSA determines the architecture that <br />
best meets its business needs and <br />
complies with CMMC requirements. <br />
Within the enclave, the OSA determines <br />
which requirements are implemented <br />
and which requirements are inherited; <br />
all requirements must be MET. If a <br />
process, policy, tool, or technology <br />
within the enclave would invalidate an <br />
implementation at the Enterprise level, <br />
that requirement cannot be inherited <br />
and the OSA must demonstrate that it <br />
is MET by implementation in some <br />
other way. Additional guidance related <br />
to assessments and enclaves has been <br />
added to the CMMC Scoping Guide <br />
Level 2 and Level 3.
 
''22. Revocations and Appeals Process ''
 
''Comment: ''One comment asked for
 
more clarification regarding the granting
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00051
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83142 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
and revoking of interim validity status <br />
for a CMMC assessment. Several <br />
comments requested an appeal and <br />
remediation process if a CMMC <br />
assessment status is revoked by the <br />
DoD. One comment requested that the <br />
revocation process not be arbitrary or <br />
capricious and provide for due process. <br />
And one comment recommended <br />
removing the word ‘‘maintained’’ from <br />
the criteria for revocation of the validity <br />
status because maintenance is part of <br />
ongoing operations as specified in the <br />
security requirement for Risk <br />
Assessments and Continuous <br />
Monitoring (CA.L2–3.12.2). One <br />
commenter asked whether SPRS <br />
reporting is the only mechanism in <br />
place to ensure that OSAs maintain the <br />
SSP and conduct self-assessments <br />
correctly.
 
Three comments recommended that
 
the DoD or CMMC PMO have a role in <br />
the assessment appeals process. Of <br />
these, one cited the DFARS clause <br />
252.204–7012 clause as precedent for <br />
DoD CIO to render final decisions. Some <br />
commenters suggested the CMMC AB <br />
relationship to C3PAOs would bias any <br />
decisions they may make, and that final <br />
appeal authority is an inherently <br />
governmental risk acceptance decision. <br />
One comment suggested that the <br />
DIBCAC or other DoD entity render final <br />
appeals decisions or take responsibility <br />
for certifying OSCs. They also asked for <br />
the C3PAOs to be released from liability <br />
for reasonable assessment judgments. <br />
Two comments asked whether the only <br />
means to appeal a CMMC AB final <br />
decision is through litigation. Another <br />
comment asked who could escalate an <br />
appeal to the CMMC AB. One comment <br />
requested the rule include more <br />
requirements for the C3PAO appeals <br />
process, including that the process be <br />
time bound and address disputes related <br />
to perceived assessor errors, <br />
malfeasance, and unethical conduct, <br />
while another comment requested a <br />
simpler appeals process. One comment <br />
requested clarification as to how the <br />
OSC interfaces with the C3PAO for <br />
appeals purposes. One comment asked <br />
if there was a process to challenge <br />
C3PAOs’ findings of non-compliance if <br />
additional requirements are applied <br />
from an assessment guide that are not <br />
included in the source standard. One <br />
comment asked how to dispute the <br />
specific CMMC level included in a <br />
solicitation.
 
''Response: ''Requirements for CMMC
 
Conditional certification assessments for <br />
each level are defined in §§ 170.16 <br />
through 170.18. Section 170.6(e) <br />
describes indications that may trigger <br />
investigative evaluations of an OSA’s <br />
CMMC Status. The DoD has revised the
 
rule throughout to delete the term <br />
‘‘revocation’’ and to clarify that the DoD <br />
reserves its right to conduct a DCMA <br />
DIBCAC assessment of the OSA, as <br />
permitted under DFARS clause <br />
252.204–7012 and DFARS clause <br />
252.204–7020. If the results of a <br />
subsequent DIBCAC assessment show <br />
that adherence to provisions of this rule <br />
have not been achieved or maintained, <br />
the DIBCAC results take precedence <br />
over any pre-existing CMMC self- <br />
assessment(s) or Final certification <br />
assessment(s) and will result in SPRS <br />
reflecting that the OSA is not in <br />
compliance (''i.e., ''lacks a current <br />
Certificate of CMMC Status). There are <br />
no additional requirements or checks on <br />
self-assessments to ensure that OSAs <br />
maintain the SSP and conduct self- <br />
assessments correctly, beyond those <br />
identified in the rule.
 
One commenter misunderstood the
 
meaning of ’maintained’ with respect to <br />
the Level 1, 2, and 3 provisions. An <br />
operational plan of action can be created <br />
without risk to the certification validity <br />
period. If a security event generates risk <br />
for the protection of FCI or CUI, the <br />
associated security requirements should <br />
be readdressed expeditiously. If one or <br />
more of the requirements can’t be <br />
remediated, the OSA should create an <br />
operational plan of action and resolve it <br />
in a time frame that continues to <br />
provide protection to FCI or CUI.
 
The Accreditation Body must have its
 
own appeals process, as required under <br />
ISO/IEC 17011:2017(E). Each C3PAO is <br />
required to have an appeals process <br />
which involves elevation to the CMMC <br />
Accreditation Body for resolution. The <br />
appeals process is derived from and <br />
consistent with ISO/IEC 17020:2012(E) <br />
and ISO/IEC 17011:2017(E). The appeals <br />
process is addressed in §§ 170.7(b), <br />
170.8(b)(16), and 170.9(b)(13), (19), and <br />
(20). An OSC, the CMMC AB, or a <br />
C3PAO may appeal the outcome of its <br />
DCMA DIBCAC conducted assessment <br />
within 21 days of the assessment by <br />
submitting a written basis for appeal <br />
that include the requirements in <br />
question for DCMA DIBCAC <br />
consideration. An OSC, the CMMC AB, <br />
[http://www.dcma.mil/DIBCAC or a C3PAO should visit ''www.dcma.mil/ <br />
DIBCAC '']to obtain the latest for contact <br />
information for submitting appeals. A <br />
DCMA DIBCAC Quality Assurance <br />
Review Team will respond to <br />
acknowledge receipt of the appeal and <br />
may request additional supporting <br />
documentation.
 
By defining the requirements in this
 
rule to become a C3PAO, and defining <br />
a scoring methodology, the DoD is <br />
providing the authority and guidance <br />
necessary for C3PAOs to conduct <br />
assessments. The CMMC Accreditation
 
Body will administer the CMMC <br />
Ecosystem. The DoD will not assume <br />
the workload of directly managing the <br />
CMMC ecosystem or the other <br />
alternatives suggested. DoD declines to <br />
give the PMO responsibility to render <br />
the final decision on all CMMC Level 2 <br />
assessment appeals as this role is <br />
properly aligned to the CMMC <br />
Accreditation Body. The CMMC AB is <br />
under contract with the Department of <br />
Defense to execute defined roles and <br />
responsibilities for the DoD CMMC <br />
Program as outlined in § 170.8. The <br />
specified CMMC AB requirements were <br />
selected and approved by the DoD. They <br />
include Conflict of Interest, Code of <br />
Professional Conduct, and Ethics <br />
policies as set forth in the DoD contract.
 
For ISO/IEC 17020:2012(E) and ISO/
 
IEC 17011:2017(E) compliance, an <br />
appeals process is required. CMMC- <br />
specific requirements for appeals are <br />
addressed in §§ 170.8(b)(16) and <br />
170.9(b)(13), (19), and (20). The DoD <br />
expects the process to be managed <br />
efficiently, however setting a specific <br />
timeline is not appropriate as the time <br />
may vary based on the complexity of the <br />
issue.
 
Responsibility for final appeals
 
determination rests with the CMMC AB. <br />
The DoD declines to mandate that the <br />
CMMC AB consult with the CMMC <br />
PMO or DIBCAC prior to rendering a <br />
decision. The CMMC PMO will serve in <br />
the oversight role for the entire CMMC <br />
program.
 
OSCs may submit any appeal arising
 
from CMMC Level 2 assessment <br />
activities to C3PAOs as addressed in <br />
§ 170.9(b)(19). OSCs may request a copy <br />
of the process from their C3PAO. The <br />
rule has been revised to reflect that any <br />
dispute over assessment findings which <br />
cannot be resolved by the C3PAO may <br />
be escalated to the CMMC AB by either <br />
the C3PAO or the OSC. The decision <br />
rendered by the CMMC AB will be final <br />
as stated in § 170.8(b)(16). Appeals <br />
pertaining to an assessor’s professional <br />
conduct that is not resolved with the <br />
C3PAO will also be escalated and <br />
resolved by the CMMC AB.
 
As addressed in § 170.9(b)(13), the
 
C3PAO will have a quality assurance <br />
individual responsible for managing the <br />
appeals process in accordance with ISO/ <br />
IEC 17020:2012(E) and ISO/IEC <br />
17011:2017(E). Identification of the <br />
C3PAO staff that an OSC should <br />
interface with is beyond the scope of <br />
this rule. It is a business decision that <br />
may vary by C3PAO and should be <br />
addressed between the OSC and C3PAO <br />
prior to conduct of an assessment.
 
The supplemental documents listed
 
in Appendix A provide additional <br />
guidance to aid in CMMC
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00052
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83143 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
implementation and are not <br />
authoritative. In the event of conflicts <br />
with the security requirements <br />
incorporated by reference, this rule and <br />
NIST SP 800–171A Jun2018 or NIST SP <br />
800–172A Mar2022 guidance will <br />
always take precedence. Disputes <br />
regarding the CMMC level specified in <br />
a contract solicitation should be <br />
addressed with the contracting officer <br />
using normal pre-award or post-award <br />
communications processes. No revision <br />
to the rule is required. Selection of the <br />
CMMC level is a DoD risk-based <br />
decision made by the Program Manager <br />
or Requiring Activity.
 
''23. CMMC Cybersecurity Requirements ''
 
a. NIST SP 800–171 R2 Requirements
 
''Comment: ''Several comments were
 
received regarding FIPS-validated <br />
cryptography. Some recommended <br />
mitigating delays with FIPS validation <br />
testing and reducing the risk of CMMC <br />
assessment failures by allowing FIPS <br />
POA&amp;Ms or POA&amp;M extensions, <br />
waivers, or making encryption an <br />
organizationally defined parameter <br />
(ODP). Similarly, some recommended <br />
the DoD accept alternate FIPS solutions <br />
such as commercially viable modules <br />
with FIPS-approved protocols or FIPS- <br />
compliant—as opposed to FIPS- <br />
validated—protocols. One comment <br />
recommended that DoD collaborate with <br />
NIST to either improve the processing of <br />
FIPS validation testing and/or to define <br />
the encryption ODP for NIST SP 800– <br />
171 Revision 3. One comment <br />
recommended DoD work with NIST to <br />
align NIST ODPs in NIST SP 800–171 <br />
Revision 3 to DoD ODPs defined in the <br />
CMMC Rule for CMMC Level 3 to <br />
ensure consistency. Another commenter <br />
asked if FIPS 140–3 was an acceptable <br />
FIPS implementation.
 
Multiple comments addressed NIST
 
requirements. One comment stated the <br />
NIST cybersecurity standards and <br />
guidelines are not legal requirements. <br />
The commenter recommended edits to <br />
the CMMC rule to require contractors <br />
implement requirements ‘‘derived’’ from <br />
NIST SP 800–171 R2 with measurable <br />
specifications to protect CUI. Two <br />
commentors felt the body of the <br />
proposed rule should have included a <br />
list of the NIST requirements to be <br />
assessed at each CMMC level. One <br />
comment suggested clarifying when a <br />
Systems Security Plan is required for <br />
each level. And, one asked if the CMMC <br />
Assessment Scope and attestation <br />
requirements included Non-Federal <br />
Organization (NFO) controls or the flow- <br />
down and reporting requirements from <br />
DFARS clause 252.204–7012.
 
Some comments were speculative in
 
nature and outside the scope of the rule. <br />
One commenter was concerned that a <br />
CMMC assessment would not address <br />
the risk of insider threats and national <br />
security problems driven by political <br />
divisions within Congress.
 
''Response: ''DoD is aware of industry
 
concerns regarding FIPS validation <br />
required in NIST SP 800–171 R2 <br />
requirement 3.13.11. Because this is a <br />
NIST requirement, changing it is beyond <br />
the scope of the CMMC rule. As stated <br />
in § 170.5(3), the CMMC Program does <br />
not alter any separately applicable <br />
requirements to protect FCI or CUI, <br />
including the requirement to use FIPS- <br />
validated cryptography which comes <br />
from NIST SP 800–171 as required by <br />
DFARS clause 252.204–7012. <br />
Limitations of the FIPS-validated <br />
module process do not impact the <br />
implementation status of FIPS <br />
cryptography. However, the rule has <br />
been updated to allow for Enduring <br />
Exceptions and temporary deficiencies, <br />
which may apply to the implementation <br />
of FIPS.
 
DoD declined to update the rule to
 
include ‘‘FIPS-compliant’’ encryption as <br />
opposed to ‘‘FIPS-validated’’ <br />
encryption. NIST SP 800–171 R2 <br />
requires the use of validated modules in <br />
specific conditions. Comments on the <br />
specific security requirements contained <br />
in NIST documentation are beyond the <br />
scope of this rule and should be <br />
directed to NIST. Collaboration between <br />
DoD and NIST about the NIST <br />
cryptographic module validation <br />
program, or to define cryptography <br />
related ODPs in NIST SP 800–171 <br />
Revision 3, is also beyond the scope of <br />
the rule. Recommendations for desired <br />
changes in NIST documentation should <br />
be directed to NIST.
 
The NIST Cryptographic Module
 
Validation Program website provides a <br />
list of approved solutions and their <br />
timelines: [https://csrc.nist.gov/projects/cryptographic-module-validation-program ''https://csrc.nist.gov/projects/ <br />
cryptographic-module-validation- <br />
program''. ]
 
NIST SP 800–171 information
 
security requirements were codified in <br />
32 CFR part 2002 in response to <br />
guidance (in E.O. 13556) to standardize <br />
Federal agency policies for safeguarding <br />
CUI. The DoD has elected to use FAR <br />
clause 52.204–21, NIST SP 800–171 R2, <br />
and a subset of NIST SP 800–172 <br />
Feb2021 as the basis for the security <br />
requirements in this rule.
 
As stated in § 170.14(c), CMMC Level
 
1 requirements are found in FAR clause <br />
52.204–21, CMMC Level 2 requirements <br />
are found in NIST SP 800–171 R2, and <br />
CMMC Level 3 requirements are a <br />
selected subset of NIST SP 800–172 <br />
Feb2021 requirements as specified in
 
the 32 CFR part 170 CMMC Program <br />
rule in table 1 of § 170.14.
 
NIST SP 800–171A Jun2018 provides
 
authoritative procedures for assessing <br />
NIST SP 800–171 R2 security <br />
requirements and the CMMC Level 2 <br />
Assessment Guide provides additional <br />
guidance for assessing CMMC Level 2 <br />
security requirements. Both documents <br />
are referenced in the 32 CFR part 170 <br />
CMMC Program rule, at §§ 170.16(c) and <br />
170.17(c).
 
It is recommended that an OSA
 
develop a SSP as a best practice at Level <br />
1, however, it is not required for a <br />
CMMC Level 1 self-assessment. A <br />
CMMC assessment does not include <br />
Non-Federal Organization (NFO) <br />
controls from table E in NIST SP 800– <br />
171 R2 nor the DFARS clause 252.204– <br />
7021 flow down and reporting <br />
requirements.
 
DoD concurs that CMMC provides no
 
mechanism for addressing insider <br />
threats posed by political divisions in <br />
Congress. However, insider threat in <br />
general is addressed in the following <br />
CMMC security requirements: AT.L2– <br />
3.2.3—Insider Threat Awareness; <br />
AC.L2–3.1.7—Privileged Functions; <br />
PS.L3–3.9.2e–Adverse Information.
 
b. Transition to Future NIST <br />
Requirements
 
''Comment: ''Many commenters raised
 
concerns about the CMMC Proposed <br />
Rule’s citation of a specific version of a <br />
relevant baseline document, ''i.e., ''NIST <br />
SP 800–171 R2. The expressed concerns <br />
focused mainly on a perceived potential <br />
for a timing conflict between the NIST <br />
revision requirements based on DFARS <br />
clause 252.204–7012 (revision in effect <br />
at time of solicitation) and this CMMC <br />
Program rule which specifies NIST SP <br />
800–171 R2. Commentors provided a <br />
variety of differing suggestions to <br />
address these concerns. Some <br />
commenters recommended that no <br />
revision number be included, while <br />
others recommended citing Revision 3 <br />
rather than Revision 2. Others <br />
recommended delaying the CMMC <br />
Program. Some recommended changing <br />
DFARS clause 252.204–7012 or issuing <br />
a class deviation to address differences <br />
between the NIST revisions cited. Those <br />
that recommended citing to Revision 3 <br />
noted that to do otherwise could delay <br />
compliance with Revision 3 beyond <br />
NIST’s anticipated finalization of that <br />
publication. Commenters noted that the <br />
criteria defined in guidance explaining <br />
how to assess against NIST <br />
requirements (''i.e., ''NIST SP 800–171A <br />
Jun2018) does not identify a revision <br />
number for the NIST SP 800–171 <br />
requirements to which they apply. In <br />
addition to the comments about NIST
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00053
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83144 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
SP 800–171 R2 and NIST SP 800–171 <br />
Revision 3, some commenters <br />
questioned how DoD would implement <br />
or how long the DoD would allow for <br />
transitioning to each future version of <br />
NIST standards once approved.
 
One commenter recommended
 
defining a waiver process to manage the <br />
transition for each new NIST revision. <br />
Another commenter asked whether <br />
contract work stoppages are expected <br />
during such transitions and if industry <br />
would be afforded time to understand <br />
the impacts of new requirements to <br />
existing systems. One commenter <br />
suggested that CMMC affirmations <br />
should indicate continued compliance <br />
to the NIST SP 800–171 version that <br />
applied to the corresponding self- <br />
assessment or certification assessment.
 
Two commenters recommended
 
changing the incorporation by reference <br />
version of NIST 800–53 that is cited in <br />
this rule be changed from Revision 5 to <br />
Revision 4, to better align with the <br />
incorporation of NIST SP 800–171 R2. <br />
Another commenter noted that both <br />
NIST SP 800–171 R2 and NIST SP 800– <br />
172 Feb2021 include Organizationally <br />
Defined Parameters (ODP), the latter of <br />
which are defined in this rule. The <br />
commenter advised against defining <br />
ODP for either reference, and <br />
recommended deletion of specific rule <br />
text that does so.
 
''Response: ''DoD is aware of the
 
differences between the language of <br />
DFARS clause 252.204–7012 and the <br />
proposed rule. 1 CFR part 51, which <br />
governs drafting of this rule, requires <br />
the specification of a revision to a <br />
standard. Specifying a revision benefits <br />
the CMMC Ecosystem by ensuring it <br />
moves forward from one NIST standard <br />
to the next in an organized manner. The <br />
DoD cites NIST SP 800–171 R2 in this <br />
final rule for a variety of reasons, <br />
including the time needed for industry <br />
preparation to implement the <br />
requirements and the time needed to <br />
prepare the CMMC Ecosystem to <br />
perform assessments against subsequent <br />
revisions. DoD is unable to incorporate <br />
suggestions that CMMC assessments be <br />
aligned to whichever NIST revision is <br />
current at the time of solicitation and <br />
declines to respond to speculation about <br />
the release timing of other publications. <br />
In May 2024, NIST published SP 800– <br />
171 Revision 3, ''Protecting Controlled <br />
Unclassified Information in Nonfederal <br />
Systems and Organizations, ''after these <br />
comments were received. DoD will issue <br />
future amendments to this rule to <br />
incorporate the current version at that <br />
time. Comments on the content of the <br />
NIST SP 800–171 Revision 3 <br />
publication or future NIST SP 800–171 <br />
revisions should be directed to NIST.
 
The final rule has been updated to
 
specify the use of NIST SP 800–171A <br />
Jun2018, ''Assessing Security <br />
Requirements for Controlled <br />
Unclassified Information, ''and NIST SP <br />
800–172A Mar2022, ''Assessing <br />
Enhanced Security Requirements for <br />
Controlled Unclassified Information. ''
 
The DoD has included the numbering
 
scheme in the rule because the <br />
numbering scheme is a key element of <br />
the model. The CMMC numbering <br />
scheme for security requirements must <br />
pull together the independent <br />
numbering schemes of FAR clause <br />
52.204–21 (for Level 1), NIST SP 800– <br />
171 R2 (for Level 2), and NIST SP 800– <br />
172 Feb2021 (for Level 3); it must also <br />
identify the domain and CMMC level of <br />
the security requirement. DoD <br />
developed the least complicated scheme <br />
that met all these criteria.
 
The CMMC Program Office is unable
 
to respond to comments proposing <br />
changes to the DFARS, which is subject <br />
to separate rulemaking procedures. One <br />
commenter described a hypothetical <br />
scenario wherein a solicitation is issued <br />
such that DFARS clause 252.204–7012 <br />
would require compliance with NIST SP <br />
800–171 Revision 3, but the CMMC <br />
requirement identified is for assessment <br />
against NIST SP 800–171 R2. In this <br />
hypothetical scenario, it is possible that <br />
the bidder may meet the CMMC <br />
requirement by citing a valid CMMC <br />
assessment against NIST SP 800–171 <br />
R2, while also availing themselves of <br />
the flexibilities provided in DFARS <br />
clause 252.204–7012 (2)(ii)(B) to submit <br />
a written request to the Contracting <br />
Officer to vary from the current version <br />
of NIST SP 800–171.
 
Recommendations for modification to
 
or deviation from DFARS clause <br />
252.204–7012 are beyond the scope of <br />
this rule. The DoD has evaluated the <br />
potential interaction between the <br />
CMMC program requirements and the <br />
existing requirements in DFARS clause <br />
252.204–7012 and believes that <br />
potential conflicts have been resolved.
 
NIST SP 800–53 R5 is incorporated by
 
reference only for applicable definitions <br />
because DoD chose to use the latest <br />
definitions available. While it is also <br />
true that NIST SP 800–171 R2 was based <br />
on NIST SP 800–53 Revision 4, the <br />
origination of NIST SP 800–171 R2 is <br />
beyond the scope of this rule.
 
Contractors and subcontractors will
 
not be expected to stop work while they <br />
implement changing standards. <br />
Implementation of this rule will be <br />
introduced as a pre-award requirement <br />
in new DoD solicitations, as described <br />
in the timeline at § 170.3(e).
 
Any substantive change to CMMC
 
security requirements must go through
 
rulemaking, and its associated timeline, <br />
which may include public comment. <br />
The new rule may include a transition <br />
period for implementation of the new <br />
security requirements.
 
The commenter correctly identifies
 
that the programmatic intent of this rule <br />
is for affirmations to signify systems in <br />
question remain compliant as indicated <br />
by the assessment that was conducted. <br />
Assessments are conducted against the <br />
specified NIST publication versions or <br />
the requirements in FAR clause 52.204– <br />
21. The 48 CFR part 204 CMMC <br />
Acquisition rule also reinforces this <br />
thought by providing specific wording <br />
of the affirmation.
 
c. NIST SP 800–172 Feb2021 <br />
Requirements
 
''Comment: ''Multiple comments
 
recommended adding all the omitted <br />
requirements from NIST SP 800–172 <br />
Feb2021 or a subset including Network <br />
Intrusion Detection System, Deception <br />
and Unpredictability, arguing that they <br />
are necessary for protecting CUI and to <br />
defend against advanced persistent <br />
threats.
 
Two comments inferred that the
 
requirement to restrict access to systems <br />
owned, provisioned or issued by the <br />
OSC means that the OSC must provide <br />
all equipment used to access the system, <br />
which they asserted is impossible <br />
because outside entities using GFE, to <br />
include DoD, may need access. One <br />
commenter also asked if DIB Furnished <br />
Equipment would be required, and one <br />
commenter argued for an exception for <br />
GFE, even though it is not owned, <br />
provisioned, or issued by the OSC.
 
Three comments stated that
 
Organizationally Defined Parameters <br />
(ODP) values need to be set by OSAs, <br />
not DoD. One commenter argued this <br />
will be necessary because of the <br />
emerging ODPs at Level 2 associated <br />
with NIST SP 800–171 Revision 3. One <br />
commenter argued this is critical for <br />
uniformity across the Federal enterprise <br />
as many contractors support multiple <br />
Federal agencies. The commenter <br />
further offered that allowing ODP values <br />
to be set by OSAs could be limited to <br />
contractor systems not operated on <br />
behalf of the DoD. One commenter <br />
suggested that ODP values set by OSAs <br />
may require approval by the contracting <br />
officer. One comment stated that the <br />
ODPs are too detailed for the 32 CFR <br />
part 170 CMMC Program rule, and table <br />
1 to § 170.14 should be moved to the <br />
Level 3 Assessment Guide.
 
One comment argued that removal or
 
quarantine of components to facilitate <br />
patching or re-configuration, as <br />
specified in table 1 to § 170.14(c)(4) <br />
CM.L3–3.4.2e, is a disruptive and
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00054
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83145 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
possibly a destructive operational <br />
constraint affecting business operations. <br />
They asserted that patching and <br />
reconfiguration are standard day-to-day <br />
IT administrative activity, and <br />
components do not need to be removed <br />
or quarantined.
 
One comment asserted that CMMC
 
should be based on NIST SP 800–53 R5 <br />
requirements (linked to the associated <br />
NIST SP 800–172 Feb2021 <br />
requirements) due to additional labor <br />
required to create NIST SP 800–53 R5 <br />
solutions and benefits to be gained from <br />
NIST SP 800–53 R5 overlays.
 
Two comments argued that IA:L3–
 
3.5.3e regarding ’the prohibition of <br />
system components from connecting to <br />
organizational systems unless certain <br />
conditions are met’ is essentially the <br />
same requirement as CM:L2–3.4.7 <br />
’restricting, disabling, or preventing the <br />
use of nonessential programs, functions, <br />
ports, protocols, and services’.
 
''Response: ''DoD considered many
 
alternatives before deciding which NIST <br />
SP 800–172 Feb2021 requirements to <br />
include as part of CMMC Level 3. NIST <br />
SP 800–172 Feb2021 notes that ‘‘There <br />
is no expectation that all of the <br />
enhanced security requirements will be <br />
selected by Federal agencies <br />
implementing this guidance.’’ For a <br />
variety of reasons, including DoD’s <br />
estimation of cybersecurity maturity and <br />
complexity across the DIB, and potential <br />
cost of certain Level 3 requirements <br />
compared with the benefit, the DoD has <br />
included a limited set of NIST SP 800– <br />
172 Feb2021 requirements. On a <br />
contract-by-contract basis, additional <br />
requirements may be added. OSAs are at <br />
liberty to implement additional <br />
requirements.
 
The intent of AC.L3–3.1.2e, which
 
requires restricted access to systems and <br />
system components, is not that DIB <br />
companies issue laptops to external <br />
users wishing to access Level 3 <br />
enclaves. While laptop issuance is one <br />
solution, other options are available. <br />
The important concept in this <br />
requirement is ‘‘comply to connect’’, <br />
and it applies to all users, both within <br />
the OSA and externally, equally. In <br />
complying with this requirement, GFE <br />
may be considered provisioned by the <br />
OSC and therefore is not restricted <br />
under that requirement.
 
DoD defines the ODPs for NIST SP
 
800–172 Feb2021 included in CMMC <br />
Level 3. This eliminates the risk of <br />
different parameters being set for <br />
different DoD programs. Rulemaking <br />
requirements dictate that table 1 to <br />
170.14(c)(4) be codified in the rule. The <br />
Assessment Guide is an optional <br />
document.
 
DoD declines to accept the risk of
 
removing security requirement CM.L3– <br />
3.4.2e. The Assessment Guide has been <br />
updated to include additional <br />
discussion on this security requirement. <br />
Feedback on individual security <br />
requirements should be direct to NIST.
 
Any relationship to the NIST SP 800–
 
53 R5 controls is for information only. <br />
The requirements that must be <br />
implemented for CMMC Level 3 are <br />
defined in the rule table 1 to <br />
§ 170.14(c)(4).
 
IA:L3–3.5.3e and CM:L2–3.4.7 are
 
different requirements. The L2 <br />
requirement is about functionality, and <br />
the L3 requirement is about trust. <br />
Feedback on individual security <br />
requirements should be direct to NIST.
 
''24. CMMC Annual Affirmation <br />
Requirements ''
 
''Comment: ''One commenter
 
recommended the affirmation statement <br />
include a statement confirming the <br />
scope has not changed and requested <br />
the rule be modified to identify types of <br />
changes that would constitute a change <br />
of system scope. Another commenter <br />
recommended removing any <br />
requirement for affirmation after <br />
assessment certificate issuance or else <br />
revising the rule to identify any benefits <br />
the affirmation provides that conducting <br />
an independent assessment does not <br />
already provide. Another commenter <br />
recommended the DoD clarify that out- <br />
of-cycle affirmations are not needed.
 
Three comments said the affirmation
 
language needs revision because <br />
maintaining perfect scores is not <br />
possible and asking individuals to <br />
affirm continuous compliance is <br />
unreasonable. One commenter voiced <br />
apprehension that signing the <br />
affirmation statement would make a <br />
person criminally liable under the False <br />
Claims Act, due to the need for system <br />
maintenance to fix things that break. <br />
One commenter expressed concern that <br />
continuous monitoring by contractors <br />
increases cost and burden to stay in <br />
compliance and opens companies up to <br />
False Claims Act liabilities. One of these <br />
commenters recommended DoD rely on <br />
representation and self-assessment in <br />
lieu of affirmations to indicate that the <br />
offeror meets the requirements of the <br />
CMMC level required by the <br />
solicitation. Two commenters requested <br />
clarification on what affirmation entails. <br />
Another commenter requested <br />
modification to clarify that the <br />
Affirming Official will attest only that <br />
the requirements are implemented as of <br />
the certification date, or proposal <br />
submission date, and requested removal <br />
of affirmation references to continuous <br />
compliance.
 
Two commenters urged the
 
Department to align the annual <br />
affirmation timeline with the 3-year <br />
assessment timeline to ensure <br />
consistency and reduce potential False <br />
Claims Act liability. One commenter <br />
also incorrectly believed a prime <br />
contractor affirmation would be made <br />
on behalf of its entire supply chain.
 
Another commenter asked DoD to
 
clarify that an organization may obtain <br />
from C3PAOs a limited review of <br />
changes made since the last assessment <br />
in support of required affirmations and <br />
noted that the DoD or CMMC AB may <br />
wish to clarify what supporting <br />
evidence is required for annual <br />
affirmations. Additionally, the <br />
commenter recommended that DoD <br />
reconsider the requirements for CMMC <br />
Level 1 since these are covered by <br />
System for Award Management (SAM).
 
One commenter asked, in reference to
 
POA&amp;M closeout affirmations, if there <br />
was no longer an expectation that a <br />
C3PAO will confirm the close out of a <br />
POA&amp;M. One commenter provided a <br />
recommendation to include an <br />
executive summary in the affirmation <br />
that includes POA&amp;M related metrics as <br />
an indicator of an OSA’s effective O&amp;M, <br />
security, and continuous monitoring <br />
activities.
 
''Response: ''As described in
 
§ 170.22(a)(2)(ii), the CMMC affirmation <br />
shall include a statement to the effect <br />
that the OSA has implemented and will <br />
maintain implementation ‘‘within the <br />
relevant assessment scope’’, which <br />
adequately addresses the commenters <br />
suggestion. No change to the rule text <br />
was therefore required. Annual <br />
affirmations ensure OSAs conduct <br />
periodic checks and verify to the <br />
Department that changes to their <br />
networks have not taken them out of <br />
compliance during the certification <br />
period. The annual affirmation <br />
requirement enables DoD to permit 3 <br />
years between CMMC Level 2 or 3 <br />
assessments, rather than requiring <br />
annual assessments. The DoD does not <br />
agree with the comment that following <br />
the procedures in § 170.22 creates an <br />
additional burden. The DoD does not <br />
concur with removing the terms <br />
‘‘continuing’’ or ‘‘continuous ‘‘as it <br />
relates to an OSA’s affirmation. <br />
Continuing compliance means that the <br />
contractor system in question remains <br />
in compliance and that the OSA intends <br />
to maintain compliance over time, not <br />
that the OSA cannot have an operational <br />
plan of action. Any changes to the <br />
information system beyond use of <br />
operational plans of action require a <br />
new assessment and a new affirmation. <br />
Operational plans of action as described <br />
in CA.L2–3.12.2 are part of normal
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00055
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83146 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
maintenance of a system and do not <br />
require a separate out-of-cycle <br />
affirmation. The DoD declines to <br />
address specific cases when affirmations <br />
are not required. DoD’s use of the term <br />
OSA within the affirmations section is <br />
deliberate and conveys that each <br />
organization is responsible for <br />
affirmations pertaining to their own <br />
assessments. An Affirming Official <br />
definition was added to the rule and <br />
provides that clarification.
 
The rule delineates which
 
requirements may be addressed with a <br />
POA&amp;M for up to 180 days to achieve <br />
Final CMMC Status. As stated in <br />
§ 170.22, an Affirming Official attests <br />
the organization is satisfying and will <br />
maintain its specified cybersecurity <br />
requirements. An OSA may complete a <br />
self-assessment and submit a new <br />
affirmation at any time. POA&amp;Ms <br />
associated with conditional assessments <br />
are closed-out by C3PAOs for Level 2 <br />
final certification assessments and by <br />
DCMA DIBCAC for Level 3 final <br />
certification assessments. OSAs must <br />
affirm results in SPRS for all <br />
assessments.
 
If an OSA makes significant changes
 
within the CMMC Assessment Scope, a <br />
new assessment and affirmation are <br />
required. The rule does not preclude <br />
OSAs from contacting a C3PAO for a <br />
review prior to an annual affirmation, <br />
however this is not required. No <br />
supporting evidence is required for an <br />
annual affirmation. Annual <br />
representations and certifications <br />
submitted in the System for Award <br />
Management (SAM) serve a different <br />
purpose from the CMMC affirmation <br />
requirement completed in SPRS. <br />
Furthermore, given the sensitivity of an <br />
OSA’s cyber security status, the DoD has <br />
elected not to use SAM, a public <br />
website.
 
Details for completion of the annual
 
affirmation, including wording of the <br />
affirmation statement, are addressed in <br />
the 48 CFR part 204 CMMC Acquisition <br />
rule. The affirmation signifies the <br />
requirements were implemented as of <br />
the date of the self-assessment or <br />
certification, and that the OSA has and <br />
intends to maintain the system as <br />
assessed. The DoD declines to require <br />
the use of an executive summary or the <br />
publication of metrics in the affirmation <br />
statement as part of the affirmation <br />
because that is not consistent with the <br />
purpose of the affirmation requirement.
 
Regarding the alignment of
 
assessments and affirmation timelines, <br />
the DoD declines to adopt <br />
recommended changes which would <br />
allow up to 3 years to elapse before DIB <br />
companies would be required to assess
 
the status of their cybersecurity <br />
compliance.
 
''25. CMMC Acceptance of Alternate <br />
Standards ''
 
a. CMMC and Other Agency Standards <br />
or Acceptance of CMMC Assessments
 
''Comment: ''Several commenters asked
 
for additional detail about § 170.20 <br />
Standards Acceptance. One commenter <br />
described discussions from various DoD <br />
industry engagements and suggested the <br />
rule is inconsistent with information <br />
provided at those information exchange <br />
events.
 
Some commenters observed the rule
 
does not describe DoD efforts to <br />
coordinate with other agencies <br />
regarding any additional cybersecurity <br />
requirements they choose to implement, <br />
which could conflict or add burden for <br />
companies that must also comply <br />
CMMC requirements. One comment <br />
suggested implementing the CMMC <br />
program government wide. An industry <br />
association submitted several comments <br />
regarding perceived duplication <br />
between this rule and cybersecurity <br />
requirements of other Federal agencies <br />
and foreign governments. They also <br />
recommended the DoD modify the rule <br />
to reflect other agency standards, such <br />
as TSA and CISA security directives <br />
requiring cyber incident reporting for <br />
natural gas utilities.
 
Several commenters thought the rule
 
did not adequately explain potential <br />
portability of CMMC assessments, <br />
referring to whether other agencies <br />
might recognize CMMC compliance as <br />
meeting or partially meeting their <br />
requirements. One specifically <br />
suggested CMMC affirmations could be <br />
accepted as evidence of compliance <br />
with any similar cybersecurity <br />
requirements other agencies may <br />
implement. One comment suggested <br />
that by assessing compliance of all <br />
applicable security requirements, the <br />
CMMC program will impede efforts to <br />
establish DoD information sharing <br />
agreements with other non-DoD <br />
organizations, including other agencies <br />
and foreign governments.
 
''Response: ''Some comments received
 
lacked relevance to the rule’s content, <br />
which is limited to specific CMMC <br />
Program requirements. The DoD <br />
declines to respond to speculative or <br />
editorial comments about private <br />
citizens or entities, all of which are not <br />
within the scope of this rule.
 
Similar data security requirements are
 
already applied to contractors across all <br />
Federal agencies, due to the <br />
applicability of FAR clause 52.204–21, <br />
and 32 CFR part 2002. All executive <br />
agencies are required to comply with
 
the same standards for protection of FCI <br />
and CUI in those regulations. Once <br />
attained, a current CMMC certification <br />
may be presented for consideration by <br />
any entity (including other government <br />
agencies) as an indicator that the <br />
security requirements associated with <br />
the certificate level (''e.g., ''CMMC Level 2) <br />
have in fact been implemented.
 
CMMC Program requirements are
 
designed to ensure compliance with <br />
existing standards for protection of FCI <br />
and CUI and align directly to NIST <br />
guidelines (''e.g., ''NIST SP 800–171 R2) <br />
and the basic safeguarding requirements <br />
of FAR clause 52.204–21 that apply to <br />
all executive agencies. Regulations <br />
issued by any executive agency must be <br />
aligned to these overarching <br />
requirements, therefore CMMC Program <br />
requirements will not conflict with any <br />
FCI or CUI safeguarding regulations that <br />
may be issued by other agencies as cited <br />
by the commenter. All executive <br />
agencies are permitted to submit and <br />
review comments as part of the formal <br />
rulemaking process, and additional <br />
coordination is not required. This rule <br />
provides a consistent way of verifying <br />
contractors’ compliance with the <br />
referenced FAR and NIST requirements, <br />
in addition to those from NIST SP 800– <br />
172 Feb2021 where applicable.
 
b. Requests To Recognize Alternate <br />
Standards
 
''Comment: ''Several commenters
 
requested the rule be modified to accept <br />
or recognize alternate standards for the <br />
purpose of meeting CMMC assessment <br />
requirements. Some small to medium <br />
businesses recommended acceptance of <br />
healthcare relevant standards or other <br />
recognized certification frameworks as a <br />
substitute for CMMC and FedRAMP <br />
Equivalency.
 
Another comment cited verbiage in
 
the DFARS clause 252.204–7012 clause <br />
that references DoD CIO approval to <br />
‘‘vary’’ from NIST SP 800–171 <br />
requirements as rationale for revising <br />
the CMMC rule to permit acceptance of <br />
other standards such as the NERC <br />
Critical Infrastructure Protection <br />
standards which apply to North <br />
America’s Bulk Electric System (BES).
 
Some comments expressed concern
 
that absent greater acceptance of the <br />
standards required by other agencies, <br />
companies complying with CMMC <br />
would be at a competitive disadvantage <br />
due to the perceived costs of complying <br />
with CMMC standards. Another <br />
comment expressed a similar concern <br />
but cited the need for acceptance of <br />
foreign C3PAOs to effectively scale <br />
CMMC to include assessment of foreign <br />
OSCs.
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00056
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83147 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
''Response: ''CMMC Program
 
requirements apply to those contractors <br />
that seek to bid for DoD work which <br />
requires processing, storing, or <br />
transmitting FCI or CUI in a contractor <br />
owned information system. Section <br />
170.20 addresses Standards Acceptance <br />
and delineates the only existing bases <br />
for accepting alternate standards in this <br />
rule. The DoD does not currently have <br />
standards acceptance with other Federal <br />
entities in lieu of the CMMC <br />
requirement.
 
DoD’s harmonization of requirements
 
with other agencies is achieved through <br />
compliance with NIST standards. DoD’s <br />
recognition of the standards of other <br />
nations occurs through negotiation of <br />
international arrangements and <br />
agreements, which is beyond the scope <br />
of this rule. The CMMC Program has <br />
aligned requirements with NIST <br />
standards, and many foreign nations are <br />
adopting NIST standards as well. In <br />
developing this rule, the DoD worked <br />
with standards bodies, removed unique <br />
requirements, and aligned new <br />
requirements directly with NIST SP <br />
800–171 R2 and select NIST SP 800–172 <br />
Feb2021 requirements to reduce and <br />
streamline cybersecurity burden across <br />
the industry. CMMC Program <br />
requirements make no change to <br />
existing policies for limits on <br />
dissemination of CUI. Comments on <br />
information sharing between other <br />
agencies or foreign entities are beyond <br />
the scope of this rule. The requirement <br />
to comply with NIST SP 800–171 was <br />
mandated in DFARS clause 252.204– <br />
7012. Granting alternatives to that <br />
standard is beyond the scope of this <br />
rule.
 
Several foreign or international
 
companies submitted comments <br />
expressing interest in the rule section <br />
pertaining to C3PAO requirements <br />
(§ 170.9(b)) and correctly noted that this <br />
section does not preclude otherwise <br />
qualified foreign companies from <br />
achieving C3PAO accreditation. Note <br />
that the DoD does permit C3PAO <br />
personnel who are not eligible to obtain <br />
a Tier 3 background investigation to <br />
meet the equivalent of a favorably <br />
adjudicated Tier 3 background <br />
investigation. DoD will determine the <br />
Tier 3 background investigation <br />
equivalence for use with the CMMC <br />
Program only.
 
c. CMMC Acceptance of Other DIBCAC <br />
Assessments
 
''Comment: ''Some commenters either
 
did not understand or objected to the <br />
fact that standards acceptance <br />
requirements for DIBCAC High <br />
Assessments require a score of 110 <br />
without POA&amp;Ms. Other comments
 
requested clarity regarding standards <br />
acceptance of DIBCAC High <br />
Assessments at CMMC Levels 2 and 3. <br />
One comment inquired about the <br />
programmatic details of DCMA’s Joint <br />
Surveillance Program.
 
Another comment expressed concerns
 
over disparities between how CMMC <br />
C3PAOs and DIBCAC assess, given the <br />
fact that DIBCAC assessors are <br />
empowered to make risk acceptance <br />
decisions on behalf of the Government, <br />
whereas C3PAO assessors are not. One <br />
commenter questioned the use of the <br />
NIST SP 800–171 R2 Cybersecurity <br />
FAQs as published in the DoD <br />
Procurement Toolbox. Another <br />
commenter asked whether C3PAOs <br />
assess for compliance with DFARS <br />
clause 252.204–7012, paragraphs c–g, as <br />
DCMA DIBCAC does in their <br />
assessments of OSAs. One commenter <br />
suggested that the DIBCAC is not <br />
certified to conduct Level 3 assessments <br />
and that training requirements for <br />
CMMC Level 2 C3PAO assessors should <br />
also apply to DIBCAC assessors, or else <br />
Level 3 assessments should be <br />
conducted by C3PAOs.
 
''Response: ''There is qualified
 
standards acceptance between DCMA <br />
DIBCAC High Assessment and CMMC <br />
Level 2 Certification Assessment as <br />
described in § 170.20(a). There is no <br />
standards acceptance between DCMA <br />
DIBCAC High Assessment and CMMC <br />
Level 3. To be eligible for standards <br />
acceptance resulting in a CMMC <br />
certification, an OSC must achieve a <br />
perfect 110 score on the Joint <br />
Surveillance assessment without any <br />
open POA&amp;Ms at the time of <br />
assessment. If the Joint Surveillance <br />
assessment results in POA&amp;M actions, <br />
any POA&amp;M must be closed prior to <br />
standards acceptance.
 
Completion of a prior DCMA DIBCAC
 
High Assessment does not necessarily <br />
indicate the likelihood of a future <br />
CMMC Level 3 requirement. DIBCAC <br />
High assessments are currently <br />
conducted against the NIST SP 800–171 <br />
R2 requirements, whereas the DoD will <br />
identify the need for a CMMC Level 3 <br />
assessment when its internal policies <br />
indicate the added protections of NIST <br />
SP 800–172 Feb2021 are necessary to <br />
adequately safeguard DoD information.
 
Acceptance of a small number of
 
DIBCAC High or Joint Surveillance <br />
Program assessments to meet future <br />
CMMC Level 2 assessment requirements <br />
will reduce the initial demand for <br />
C3PAO assessment. Only those DIBCAC <br />
High Assessments completed prior to <br />
the effective date of the rule are eligible <br />
for standards acceptance to meet CMMC <br />
Level 2 Certification requirements. The <br />
DoD will enter CMMC Level 2
 
Certifications into eMASS for suitable <br />
DIBCAC High Assessments, with a <br />
validity period of 3 years from the date <br />
of the original High Assessment. A <br />
CMMC Final Level 2 certification <br />
assessment is entered into eMASS by <br />
the C3PAO following a successful (''i.e., <br />
''perfect score with no POA&amp;Ms) joint <br />
surveillance assessment against NIST SP <br />
800–171 R2. It is not the result of a <br />
CMMC Level 3 assessment but can be <br />
provided as evidence that an OSC is <br />
ready to initiate a CMMC Level 3 <br />
assessment.
 
Although Joint Surveillance is listed
 
as standards acceptance in 170.20(a)(1), <br />
the details of this DCMA program and <br />
any changes to it are beyond the scope <br />
of this rule. A Joint surveillance is a <br />
DCMA DIBCAC assessment and falls <br />
under their purview. The CMMC office <br />
understands that there is disparity <br />
between what is assessed by a C3PAO <br />
and the DIBCAC and that the guidance <br />
information in the DoD Procurement <br />
Toolbox is the driving factor. Since the <br />
Procurement Toolbox is outside of the <br />
scope of the 32 CFR part 170 CMMC <br />
Program rule, it cannot be properly <br />
addressed here or in the rule. With <br />
CMMC the DoD utilizes a risk-based <br />
approach in its allowance for POA&amp;Ms, <br />
gradient scoring for certain controls <br />
(''e.g., ''FIPS and MFA), temporary <br />
deficiencies, and enduring exceptions.
 
DCMA DIBCAC assessors are trained
 
and qualified to conduct assessment <br />
against NIST SP 800–171 R2 for the <br />
DoD. DoD determined that C3PAOs <br />
conducting assessments on other <br />
C3PAOs introduced a significant <br />
conflict of interest. Given the sensitivity <br />
of the programs requiring Level 3 <br />
assessments, the DoD determined that <br />
those assessments must be completed by <br />
a DoD entity. The DoD declines to <br />
respond to speculative or editorial <br />
comments regarding DCMA DIBCAC <br />
assessments.
 
The CMMC model (§ 170.14) only
 
incorporates requirements from FAR <br />
clause 52.204–21, NIST SP 800–171 R2, <br />
and NIST SP 800–172 Feb2021. C3PAOs <br />
are only responsible for assessing the <br />
requirements of § 170.17. DCMA <br />
DIBCAC operates under different <br />
authorities and can address all the <br />
requirements of DFARS clause 252.204– <br />
7012.
 
d. Validity Period for Standards <br />
Acceptance
 
''Comment: ''Two comments asked how
 
SPRS would be updated to reflect <br />
CMMC Level 2 certification when based <br />
on standards acceptance. One asked <br />
whether that update would be <br />
automatic. One comment asked whether <br />
CMMC standards acceptance for
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00057
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83148 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
DIBCAC joint surveillance assessments <br />
would result in certifications being <br />
issued to the OSA by the C3PAO or by <br />
DIBCAC.
 
Some comments, including those
 
from three industry associations, <br />
objected to the start date for the 3-year <br />
validity of CMMC certification based on <br />
standards acceptance of prior DIBCAC <br />
assessments. Those comments requested <br />
the validity period begin with the <br />
effective date of the 32 CFR part 170 <br />
CMMC Program rule. Along these lines, <br />
another commenter asked whether <br />
C3PAOs may certify an OSA based on <br />
evidence of a perfect 110-scored <br />
DIBCAC High Assessment. One <br />
comment requested a 1-year extension <br />
of the validity period to 4 years.
 
''Response: ''The DoD has considered
 
the recommendation to modify the <br />
validity period for certifications <br />
resulting from standards acceptance and <br />
declines to revise the rule text. It is <br />
important that contractors maintain <br />
security compliance for systems that <br />
process, store, or transmit DoD CUI. <br />
Given the evolving cybersecurity threat, <br />
DoD’s best interests are served by <br />
ensuring that CMMC Level 2 <br />
assessments remain valid for no longer <br />
than a 3-year period, regardless of who <br />
performs the assessment.
 
A C3PAO may not simply read the
 
DIBCAC assessment score in SPRS and <br />
grant a completed CMMC Level 2 <br />
certification assessment. C3PAOs may <br />
only submit certification assessment <br />
results based on having conducted a <br />
certification assessment. An OSA is free <br />
to seek a C3PAO certification <br />
assessment, but this would be <br />
unnecessary, because a valid DIBCAC <br />
High assessment with a 110 score will <br />
automatically be converted in SPRS to <br />
reflect a CMMC Final Level 2 <br />
certification assessment provided all <br />
requirements of § 170.20(a)(1) are met. A <br />
DIBCAC High assessment conducted <br />
after the rule is effective is not eligible <br />
for standards acceptance.
 
''26. CMMC Requirements and <br />
International Entities ''
 
a. Applicability to International Entities
 
''Comment: ''Several public commenters
 
asked whether and how the CMMC rule <br />
content would apply to foreign based or <br />
international companies, either as <br />
companies seeking to comply with <br />
assessment requirements or as <br />
companies seeking to participate in the <br />
CMMC Ecosystem.
 
Some questions asked for
 
interpretation of requirements for <br />
specific scenarios, such as how CMMC <br />
requirements might affect Status of <br />
Forces Agreements for DoD installations
 
overseas. Others asked about <br />
application of flow-down requirements <br />
to foreign subcontractors, including in <br />
circumstances when DFARS clauses do <br />
not apply or when international <br />
agreements supersede application of <br />
DFARS clause 252.204–7012. A few <br />
comments asked how foreign or <br />
multinational corporations with <br />
facilities abroad can attain CAGE codes, <br />
access SPRS, or meet other aspects of <br />
CMMC requirements. Some asserted <br />
that specific systems contractors need to <br />
access, such as SPRS and PIEE, are not <br />
designed to accommodate foreign <br />
address formats and requested <br />
modifications or alternative options to <br />
facilitate submission of CMMC <br />
affirmations. One commenter suggested <br />
that assessment of foreign contractor <br />
information systems should only be <br />
conducted by the host country, and <br />
asked whether foreign contractors <br />
should be partially exempted from <br />
CMMC requirements.
 
''Response: ''CMMC Program
 
requirements are applicable when DoD <br />
requires processing, storing, or <br />
transmitting of either FCI or CUI during <br />
performance of a DoD contract. CMMC <br />
Program requirements would not apply <br />
to a DoD Installation’s communication <br />
with a Host Nation government on <br />
matters related to the Installation. <br />
CMMC program requirements apply to <br />
all DoD contractors alike when contract <br />
performance will require processing, <br />
storing, or transmitting of FCI or CUI on <br />
contractor-owned information systems. <br />
This 32 CFR part 170 CMMC Program <br />
rule does not permit partial exemption <br />
of assessment requirements for foreign <br />
contractors. Any discussion of <br />
exemptions or deviations for foreign <br />
businesses are outside the scope of the <br />
32 CFR part 170 CMMC Program rule <br />
and must be addressed through <br />
government-to-government international <br />
arrangements or agreements. Pathways <br />
and timelines for achieving these <br />
agreements are outside the scope of this <br />
rule.
 
CMMC requirements apply to both
 
domestic and international primes and <br />
flow down to subcontractors throughout <br />
the supply chain if their information <br />
systems process, store, or transmit FCI <br />
or CUI. CMMC requirements are based <br />
upon the type of information processed <br />
and shared, regardless of where the <br />
company is headquartered or operates. <br />
Certification requirements for <br />
subcontractors are addressed in <br />
§ 170.23(a)(1) through (4). For additional <br />
information about flow-down of <br />
contractual requirements, see the 48 <br />
CFR part 204 CMMC Acquisition rule. <br />
The CMMC process is the same for <br />
international and domestic contractors
 
and subcontractors. International sub- <br />
contractors must undergo a CMMC <br />
assessment at the appropriate level to <br />
demonstrate compliance with NIST SP <br />
800–171 R2 requirements. All OSAs <br />
must register in [https://sam.gov ''https://sam.gov'', which <br />
]has instructions for obtaining applicable <br />
CAGE or NATO CAGE codes (NCAGE <br />
codes).
 
Address data is not a required SPRS
 
data input for CMMC purposes. <br />
Contractor address information is <br />
required to obtain a CAGE code that, <br />
along with a Unique Entity ID, is <br />
required to register in SAM. SPRS <br />
currently receives assessment <br />
information from domestic and <br />
international entities. International <br />
organizations get CAGE codes in the <br />
same manner that US organizations do, <br />
including in some instances NCAGE <br />
codes. CAGE codes are required for a <br />
contractor to register for a user account <br />
in Procurement Integrated Enterprise <br />
Environment (PIEE) that provides <br />
contractors access to SPRS and other <br />
applications as necessary for DoD <br />
contracts.
 
b. International Agreements
 
''Comment: ''Several commenters asked
 
about procedures for establishing <br />
recognition of other nations’ <br />
cybersecurity standards or assessment <br />
programs as acceptable alternatives to <br />
CMMC program requirements. Another <br />
commenter noted the rule provides no <br />
explicit recognition of existing <br />
agreements between the DoD and other <br />
nations related to information sharing <br />
and defense procurement. They and <br />
other commenters asked that the rule <br />
identify a specific process for reaching <br />
agreements related to CMMC program <br />
requirements. Some of these <br />
commenters identified specific foreign <br />
cybersecurity programs and requested <br />
that the DoD work toward reciprocal <br />
recognition of their underlying <br />
standards. One of these commenters <br />
requested that DoD identify timelines <br />
for establishing bilateral agreements.
 
In particular, the Canadian
 
counterpart for the CMMC program <br />
expressed concern that Canadian <br />
companies could be disadvantaged in <br />
seeking CMMC certification and <br />
requested the DoD consider establishing <br />
a unified accreditation body for <br />
Canadian and US C3PAOs.
 
''Response: ''While the rule does address
 
application to foreign contractors and <br />
ecosystem participants throughout, <br />
these requirements may be superseded <br />
by the terms and conditions of <br />
applicable international arrangements or <br />
agreements.
 
CMMC validates cybersecurity
 
requirements, as defined in FAR clause
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00058
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83149 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
52.204–21, NIST SP 800–171 R2, and a <br />
selected subset of NIST SP 800–172 <br />
Feb2021, where applicable. These <br />
cybersecurity requirements apply to <br />
international and domestic companies <br />
when included in a DoD contract. The <br />
Department cannot speculate about the <br />
arrangements of any international <br />
agreement and how it may or may not <br />
impact international partners, as these <br />
arrangements are beyond the scope of <br />
this 32 CFR part 170 CMMC Program <br />
rule.
 
The DoD has designed CMMC
 
Program requirements to apply to those <br />
contractors that bid for DoD work which <br />
will require access to process, store, or <br />
transmit FCI or CUI in a contractor <br />
owned information system. A CMMC <br />
certification assessment is portable in <br />
the sense that it provides confidence <br />
that the holder has been assessed by an <br />
authorized third party for compliance <br />
with the applicable security standards <br />
(''e.g., ''NIST SP 800–171 R2 or NIST SP <br />
800–172 Feb2021). Once attained, <br />
CMMC certification assessment status <br />
may be presented for consideration by <br />
any entity as an indicator that they have <br />
implemented security requirements <br />
associated with the certificate level (''e.g., <br />
''NIST SP 800–171 R2 or NIST SP 800– <br />
172 Feb2021). Section 170.20 delineates <br />
the only existing bases for accepting <br />
alternate standards in this rule.- It is <br />
beyond the scope of this rule to provide <br />
a specific set of directions or guidance <br />
on recognition for alternate <br />
cybersecurity standards. Deviations <br />
from DFARS clauses are also beyond the <br />
scope of this rule.
 
Section 170.20 has been modified to
 
state that an OSC with a perfect score <br />
from a prior DCMA DIBCAC High <br />
Assessment aligned with the same <br />
CMMC Level 2 Scoping may meet <br />
CMMC Final Level 2 certification <br />
assessment requirements via acceptance <br />
of the prior DIBCAC assessment in lieu <br />
of a C3PAO assessment. Standards <br />
Acceptance does not refer to <br />
international standards acceptance, <br />
which is not described within the rule.
 
c. C3PAO, CCP, and CCA Requirements
 
''Comment: ''In addition to the interest
 
in international agreements, some <br />
commenters expressed concern about <br />
CMMC ecosystem capacity to meet <br />
demand for Level 2 certification. They <br />
advocated support for accreditation of <br />
non-U.S. based C3PAOs. One <br />
commenter suggested that FOCI <br />
requirements be deleted from the rule <br />
and managed via DoD’s oversight of the <br />
CMMC AB. One commenter speculated <br />
the phased CMMC implementation plan <br />
would require all non-U.S. firms to <br />
comply simultaneously and
 
recommended that foreign contractors <br />
be allowed additional time to comply. <br />
Another recommended that foreign <br />
companies be permitted to simply self- <br />
assess in lieu of obtaining a CMMC <br />
Level 2 certification assessment.
 
Several commenters asked about
 
foreign nationals participating in the <br />
CMMC ecosystem and noted <br />
discrepancies between qualifications <br />
identified in the rule and content on the <br />
CMMC AB’s website at the time of rule <br />
publication. These commenters <br />
expressed interest in the ability for <br />
foreign citizens to become CCAs, CCPs, <br />
and LTPs (a term no longer used in the <br />
rule).
 
One commenter presumed that only
 
U.S.-based Cloud Service Providers <br />
(CSPs) may become FedRAMP <br />
authorized, and asserted a need to <br />
authorize or accredit foreign-based CSPs <br />
that foreign DIB contractors might use <br />
while still achieving CMMC <br />
compliance. Another asked how foreign <br />
small businesses can comply with <br />
CMMC without access to U.S. approved <br />
CSPs. One commenter asked for <br />
guidance on how to get foreign products <br />
and services, such as encryption and <br />
decryption mechanisms, approved for <br />
use in information systems that require <br />
CMMC assessment. One commenter <br />
suggested that the CMMC program <br />
permit assessment by C3PAOs and <br />
assessors accredited in accordance with <br />
other ISO/IEC standards than those <br />
identified in this rule. They cited ISO/ <br />
IEC 27001 or 9901 as suitable alternate <br />
ISO/IEC standards.
 
''Response: ''The DoD declines to delay
 
CMMC Program implementation for <br />
non-U.S. organizations. International <br />
businesses will not receive special <br />
accommodations because the CMMC <br />
Program’s phased implementation will <br />
impact both U.S. and non-U.S. defense <br />
contractors equally. The <br />
implementation plan described in the <br />
rule does not promote or prioritize <br />
certification assessments of any <br />
contractor over any other contractor. All <br />
companies, regardless of location or <br />
nationality, will have access to any <br />
authorized C3PAO. The rule does not <br />
preclude non-U.S. citizens or foreign- <br />
owned C3PAOs from operating in the <br />
U.S. Additionally, U.S. owned C3PAOs <br />
may operate in a foreign nation.
 
As stated in the rule, C3PAOs must
 
meet the criteria in § 170.9. Non-U.S. <br />
organizations and employees that meet <br />
all the requirements in §§ 170.9 and <br />
170.11 will not be prohibited from <br />
operating as a C3PAO within the U.S. or <br />
abroad. A list of authorized C3PAOs is <br />
available on the current CMMC AB <br />
marketplace. DoD does not concur with <br />
the recommendation to delete
 
§ 170.9(b)(5) content identifying FOCI <br />
requirements. Those details for <br />
complying with FOCI are necessary for <br />
understanding the requirement.
 
Some commenters noted differences
 
between the rule content and <br />
information on the CMMC AB website. <br />
The CMMC AB is part of the public and <br />
had no access to advance information <br />
prior to publication of the proposed <br />
rule. The rule takes precedence in the <br />
event of any discrepancy with CMMC <br />
AB materials.
 
The document ‘Career Pathway
 
Certified Assessor 612’, dated 2020, has <br />
been replaced by a regularly updated <br />
DoD Cyberspace Workforce Framework <br />
[https://public.cyber.mil/dcwf-work-role/security-control-assessor/ which may be found at ''https://<br />
public.cyber.mil/dcwf-work-role/ <br />
security-control-assessor/''. Intermediate <br />
]and Advanced Foundational <br />
Qualification Options in the DoD <br />
Cyberspace Workforce Framework’s <br />
Security Control Assessor (612) Work <br />
Role are available to foreign nationals. <br />
The rule has been updated to reflect this <br />
reference update.
 
A domestic or international business
 
seeking a contract that contains DFARS <br />
clause 252.204–7012, and using a cloud <br />
service provider to process, store, or <br />
transmit covered defense information in <br />
performance of that DoD contract, must <br />
ensure that the CSP meets FedRAMP <br />
authorization or equivalency <br />
requirements. As the FedRAMP program <br />
and FedRAMP equivalency are available <br />
to international organizations, foreign <br />
entities do not need to develop their <br />
own FedRAMP program. FedRAMP <br />
authorization or equivalency is also <br />
available to small businesses. The DoD <br />
leverages the FedRAMP program to <br />
implement requirements for the <br />
adoption of secure cloud services across <br />
the Federal Government and provide a <br />
standardized approach to security and <br />
risk assessment for cloud technologies. <br />
Export controlled goods and ITAR are <br />
outside the scope of the 32 CFR part 170 <br />
CMMC Program rule.
 
The process for identifying specific
 
products or services that may meet NIST <br />
security requirements is beyond the <br />
scope of this rule. CMMC program <br />
requirements are unrelated to evaluation <br />
or approval of encryption or decryption <br />
products manufactured by foreign <br />
information security companies.
 
DoD considered many alternatives
 
before deciding upon the current CMMC <br />
structure. Alternative methods of <br />
assessment have proven inadequate and <br />
necessitated the establishment of <br />
CMMC. DoD declines to accept the <br />
recommendation of an alternate path to <br />
C3PAO accreditation.
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00059
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83150 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
''27. Impact to Small Businesses ''
 
a. Funding the CMMC Program
 
''Comment: ''One comment asserted that
 
the rule does not address CMMC <br />
program funding, affordability, and <br />
sustainability. They recommended the <br />
DoD conduct and publish a <br />
comprehensive cost assessment for each <br />
level of CMMC certification and explore <br />
ways to reduce the financial burden on <br />
contractors.
 
''Response: ''DoD included an analysis
 
of costs to meet CMMC requirements in <br />
the regulatory impact analysis for this <br />
rule.
 
As described in the estimate included
 
with the rule, the major cost categories <br />
for compliance with CMMC <br />
requirements are anticipated to include <br />
costs for completing a self-assessment <br />
(''e.g., ''Level 1 or 2); costs to prepare for <br />
and undergo C3PAO assessment (Level <br />
2); costs required to implement the <br />
Level 3 security requirements and for <br />
preparing to undergo DCMA DIBCAC <br />
assessment (Level 3). All of these except <br />
the market costs of a C3PAO are <br />
controlled by the organization seeking <br />
assessment. Market forces of supply and <br />
demand will determine C3PAO pricing <br />
for CMMC Level 2 certification <br />
assessments.
 
Analysis of costs to meet CMMC
 
requirements is provided in the <br />
regulatory impact analysis for this rule. <br />
The CMMC rule does not make any <br />
change to cost allowability as defined in <br />
the FAR 31.201–2 Determining <br />
Allowability. Verifying compliance with <br />
applicable security requirements may <br />
increase cost and is necessary for the <br />
protection of DoD CUI. With the revised <br />
CMMC, the DoD has streamlined <br />
requirements to align directly to NIST <br />
guidelines and has eliminated unique <br />
security practices to ease the burden on <br />
smaller companies. DoD must enforce <br />
CMMC requirements uniformly across <br />
the Defense Industrial Base for all <br />
contractors and subcontractors who <br />
process, store, or transmit CUI. The <br />
value of information (and impact of its <br />
loss) does not diminish when the <br />
information moves to contractors and <br />
subcontractors. The DoD declines to <br />
speculate about how OSCs and C3PAOs <br />
negotiate mutually acceptable terms and <br />
conditions for assessment agreements. <br />
The DoD declined to modify the <br />
estimates, which are intended to be <br />
representative and to inform <br />
rulemaking.
 
b. Disproportionate Cost Burden
 
''Comment: ''Many comments
 
emphasized the importance of small <br />
business to the DoD contracting <br />
environment and expressed the concern
 
that increased cost burden on small <br />
companies will result in an anti- <br />
competitive barrier to entry. <br />
Specifically, commenters state the lack <br />
of in-house security resources, inability <br />
to amortize costs, upfront costs to <br />
comply with CMMC Level 1 and 2 <br />
without guaranteed contracts, keeping <br />
pace with requirements changes, paying <br />
market rates for C3PAO assessments, <br />
and obtaining ‘‘perfect’’ compliance <br />
with requirement or assessment <br />
objectives may not be affordable or may <br />
cause unacceptable enterprise <br />
disruption. One comment asserted that <br />
the DoD is not considering additional <br />
costs to small- and medium-sized <br />
businesses (SMBs) for ongoing <br />
compliance. One comment stated the <br />
cost of entry for a new SMB may be <br />
insurmountable even with cost <br />
recovery. One comment suggested <br />
‘‘right-sizing’’ CMMC by tailoring <br />
security requirements based on business <br />
size and number of employees. <br />
Additionally, one comment asserted <br />
that small businesses would be unfairly <br />
punished while large, legacy primes <br />
would lobby and get waivers.
 
Two comments noted that CMMC will
 
increase costs, perhaps doubling annual <br />
IT and security spending, ultimately <br />
passing the cost to customers, the <br />
government and the taxpayer and asked <br />
how the DoD plans to deal with price <br />
increases from subcontractors and <br />
primes. One comment suggested the <br />
DoD pay contractor employees to learn <br />
to cyber defend rather than pay auditor <br />
assessment costs.
 
''Response: ''The DoD concurs with
 
commenters’ assessment of the <br />
importance of small businesses to the <br />
DoD. The DoD has streamlined CMMC <br />
requirements to align directly to NIST <br />
guidelines and has eliminated unique <br />
security practices to ease the burden on <br />
smaller companies. In recognition of the <br />
cyber threat both to DoD and to the DIB, <br />
CMMC Program requirements are <br />
designed to ensure compliance with <br />
existing standards for protection of FCI <br />
and CUI. These cybersecurity <br />
requirements align directly to NIST <br />
guidelines (''i.e., ''NIST SP 800–171 R2 <br />
and NIST SP 800–172 Feb2021) and the <br />
basic safeguarding requirements (FAR <br />
clause 52.204–21) that apply to all <br />
executive agencies.
 
The analysis of costs to meet CMMC
 
Level 1 and 2 requirements are provided <br />
in the Regulatory Impact Analysis <br />
published with this rule. Note that <br />
certification is never required for CMMC <br />
Level 1, which is a self-assessment <br />
requirement. CMMC Level 2 may either <br />
be met via self-assessment, or via <br />
certification following a C3PAO <br />
assessment, depending on the specific
 
requirement cited in the solicitation. <br />
Some comments appeared to reference <br />
costs to meet the requirements of <br />
existing DFARS clause 252.204–7012. <br />
Please refer to 81 FR 72990, October 21, <br />
2016, for DoD’s final rule implementing <br />
the DoD’s requirement that ‘‘contractors <br />
shall implement NIST SP 800–171 as <br />
soon as practical, but not later than <br />
December 31, 2017.’’
 
The cost estimates for SMBs represent
 
average derived estimates based on <br />
internal expertise and public feedback <br />
in accordance with OMB Circular A–4. <br />
The size and complexity of the network <br />
within scope of the assessment impacts <br />
the estimates as well.
 
The DoD has streamlined CMMC
 
requirements to align directly to NIST <br />
guidelines and has eliminated unique <br />
security practices to ease the burden on <br />
smaller companies. In addition, CMMC <br />
Level 1 and select CMMC Level 2 <br />
requirements are now met via self- <br />
assessment, which reduces burden to <br />
small businesses.
 
The CMMC program incorporates
 
flexibility with the use of self- <br />
assessment, POA&amp;Ms, and waivers. <br />
Since December 2017, DFARS clause <br />
252.204–7012 has required contractors <br />
to implement the NIST SP 800–171 <br />
security requirements to provide <br />
adequate security applicable for <br />
processing, storing, or transmitting CUI <br />
in support of the performance of a DoD <br />
contract. OSAs that are currently <br />
attesting that they meet DFARS clause <br />
252.204–7012 should not have difficulty <br />
successfully achieving a Level 2 self- <br />
assessment.
 
Some comments received lacked
 
relevance to the rule’s content, which is <br />
limited to specific CMMC Program <br />
requirements. The DoD declines to <br />
address speculation about lobbying <br />
activities. Verifying compliance with <br />
applicable security requirements may <br />
increase financial cost to the DoD due <br />
to increased contract costs but it is <br />
necessary for the protection of DoD CUI. <br />
The cost of lost technological advantage <br />
over potential adversaries is greater than <br />
the costs of such enforcement. The <br />
value of information (and impact of its <br />
loss) does not diminish when the <br />
information moves to contractors.
 
The trade-off is between protecting
 
sensitive information from our nation’s <br />
adversaries and accepting the fact that <br />
security costs increase for numerous <br />
reasons. Many of those cost-drivers are <br />
completely independent of CMMC. <br />
While CMMC compliance adds to an <br />
organization’s cost, no member of the <br />
DIB can assume the status-quo in <br />
today’s ever-changing cyber security <br />
environment. Increasing costs to protect <br />
the nation’s data and industries from
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00060
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83151 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
emerging threats is simply a component <br />
of doing business anywhere in the <br />
world. Processing, storing, or <br />
transmitting sensitive Government <br />
information comes with a handling cost <br />
that needs to be built into each <br />
organization’s business model.
 
Some comments included suggestions
 
about how workflow should occur <br />
between prime and subcontractors to <br />
decrease or eliminate the transfer of CUI <br />
to subcontractors. The DoD cannot <br />
dictate these business practices but <br />
encourages prime contractors to work <br />
with its subcontractors to flow down <br />
CUI with the required security and the <br />
least burden. Questions regarding what <br />
to mark as CUI are out of scope of this <br />
rule. At the time of award, the DoD may <br />
have no visibility into whether the <br />
awardee will choose to further <br />
disseminate DoD’s CUI, but DFARS <br />
clause 252.204–7012 and DFARS clause <br />
252.204–7021 require that the prime <br />
contractor to flow down the information <br />
security requirement to any <br />
subcontractor with which the CUI will <br />
be shared. Decisions regarding which <br />
DoD information must be shared to <br />
support completion of which <br />
subcontractor tasks takes place between <br />
the prime contractor and the <br />
subcontractors chosen to complete the <br />
specific tasks.
 
c. Phasing the Cost To Comply
 
''Comment: ''Two comments suggested a
 
phased compliance would help offset <br />
financial burden while working toward <br />
full compliance. One comment <br />
expressed concern that Managed Service <br />
Providers (MSPs), many of which are <br />
small businesses, will not have time to <br />
achieve Level 2 certification before their <br />
OSA and OSC customers need them to <br />
be certified and recommended <br />
extending the phased timeline.
 
Several comments stated that
 
recouping compliance costs could take <br />
years, forcing SMBs into financial debt, <br />
contract termination, and exclusion <br />
from the market for DoD contracts. One <br />
commenter expressed concern about <br />
implementation of CMMC as a <br />
condition of contract award and the <br />
implication that compliance costs are <br />
incurred prior to receiving a DoD <br />
contract.
 
''Response: ''DoD declined to implement
 
a small entity specific ‘‘phased <br />
compliance’’. Since December 2017, <br />
DFARS clause 252.204–7012 has <br />
required contractors to implement the <br />
NIST SP 800–171 security requirements <br />
to provide adequate security applicable <br />
for processing, storing, or transmitting <br />
CUI in support of the performance of a <br />
DoD contract.
 
DoD received numerous comments
 
about the use of ESPs, including MSPs, <br />
which do not process, store, or transmit <br />
CUI. In response to comments, the DoD <br />
has reduced the assessment burden on <br />
External Service Providers (ESPs). ESP <br />
assessment, certification, and <br />
authorization requirements in <br />
§§ 170.19(c)(2) and (d)(2) have been <br />
updated. ESPs that are not CSPs and do <br />
NOT process, store, or transmit CUI, do <br />
not require CMMC assessment or <br />
certification. Services provided by an <br />
ESP are in the OSA’s assessment scope.
 
CMMC has taken several steps to keep
 
the cost of compliance with the rule <br />
commensurate with the risk to the <br />
DoD’s information. Level 1 only requires <br />
self-assessment, and many contracts <br />
with CUI will only require a Level 2 <br />
self-assessment. Companies that <br />
currently attest that they meet DFARS <br />
clause 252.204–7012 should not have <br />
difficulty completing a Level 2 self- <br />
assessment. In accordance with the <br />
rulemaking process, this rule was <br />
reviewed by both DoD cost analysts and <br />
OMB economists for realism and <br />
completeness.
 
This is a 32 CFR part 170 CMMC
 
Program rule, not an acquisition rule. <br />
The 48 CFR part 204 CMMC Acquisition <br />
rule will address implementation of <br />
CMMC as it pertains to DoD contracts.
 
d. Detailed Cost Analysis
 
''Comment: ''A few comments suggested
 
a detailed cost analysis should consider <br />
SMBs of various sizes, types, and <br />
challenges to ensure compliance is <br />
sustainable. One comment asked <br />
whether a profit margin analysis was <br />
performed, while another asserted that <br />
other third-party assessments are less <br />
expensive than the estimates for CMMC <br />
assessment. Another stated CMMC <br />
Level 3 cost estimates are too low and <br />
suggested using costs associated with <br />
SECRET-level networks for calculation.
 
''Response: ''The DoD provided an
 
analysis of costs to meet CMMC Level <br />
1 and 2 requirements in the regulatory <br />
impact analysis for this rule. The cost <br />
estimates provided for this rule <br />
represent average costs for companies to <br />
comply with CMMC requirements, <br />
including the need for self-assessment <br />
or independent assessment against the <br />
specified standards. Comparing costs <br />
with other third-party security audits <br />
presumes that the security and <br />
assessment requirements are identical, <br />
and DoD disagrees with that <br />
assumption.
 
The DoD declined to produce another
 
cost estimate for CMMC assessment and <br />
certification. As required by the <br />
Rulemaking Guidance, the DoD <br />
provided cost estimates and impact
 
analyses in the proposed rule. The <br />
analysis included estimated costs for <br />
each level and type of assessment or <br />
certification for different sized <br />
contractor businesses. The cost <br />
estimates did not include an analysis of <br />
profit margins, which is not required. <br />
This rule also does not provide the cost <br />
analysis for all actions, personnel, and <br />
security measures required to protect <br />
CUI information, data, systems, and <br />
technical products through the life cycle <br />
of the work and data generated. The cost <br />
estimates represent derived estimates <br />
based on internal expertise and public <br />
feedback in accordance with OMB <br />
Circular A–4.
 
Market forces of supply and demand
 
will determine C3PAO pricing for <br />
CMMC Level 2 certification <br />
assessments. The size and complexity of <br />
the network within scope of the <br />
assessment impacts the costs as well. <br />
CMMC Level 3 assessments against the <br />
NIST SP 800–172 Feb2021 baseline are <br />
performed free of cost by DoD assessors, <br />
which reduces the cost of CMMC Level <br />
3.
 
The costs associated with a
 
government-owned SECRET-level <br />
network are not relevant to the CMMC <br />
Program which ensures protection of <br />
FCI and CUI.
 
e. Assistance Programs or Other Relief
 
''Comment: ''Several commenters
 
proposed that financial assistance, <br />
contract incentives, direct <br />
reimbursement of assessment costs (in <br />
whole or in part), and market rate price <br />
caps be considered to lessen financial <br />
burden and decrease the entry barrier <br />
for SMBs. Several comments also <br />
inquired about DoD SMB grant <br />
programs to help SMBs cover the cost of <br />
CMMC Level 2 certification <br />
assessments.
 
Multiple comments suggested DOD
 
provide actionable guidance through <br />
outreach support and assistance along <br />
with free or reduced cost cybersecurity <br />
services to SMBs, with two referencing <br />
the DoD Office of Small Business <br />
Programs and one the DoD Procurement <br />
Toolbox. One comment, from a large <br />
business with SMB suppliers, requested <br />
clearer guidance and support for flow <br />
down to sub-tier suppliers and SMB <br />
supply chains.
 
One comment stated firms who
 
receive a low number of CUI documents <br />
(30 docs in 3-years on 10 computers) do <br />
not justify the cost of becoming CMMC <br />
compliant, and added the cost is nearly <br />
as much as protection for classified <br />
documents. One commenter suggested <br />
NIST SP 800–171 R2 security <br />
requirements would not apply to their <br />
specific characteristics, ''i.e., ''a very small
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00061
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83152 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
business with minimal internet <br />
connectivity, no remote access, no <br />
public access, no mobile devices, no <br />
remote work, and no known <br />
cybersecurity issues. The comment <br />
asserted that the company posed <br />
minimal risk to CUI and should be <br />
excused from adhering to CMMC <br />
program requirements based on cost <br />
burden.
 
One comment proposed eliminating
 
third party assessment costs and relying <br />
only on self-certification to address the <br />
cost burdens. One comment noted that <br />
free market pricing and a short supply <br />
of C3PAOs combined with excessive <br />
waiting times may result in SMB <br />
attrition.
 
''Response: ''It is not within in scope of
 
this rule to address how companies <br />
recover assessment costs. The CMMC <br />
rule makes no change to the cost <br />
allowability parameters described in <br />
FAR 31.201–2 Determining <br />
Allowability.
 
Contractors are required to comply
 
with all terms and conditions of DoD <br />
contracts, to include terms and <br />
conditions relating to cybersecurity <br />
protections and assessment <br />
requirements, as implemented by this <br />
rule. This holds true when a contract <br />
clause is flowed down to <br />
subcontractors.
 
Several of the commenters’
 
recommendations have potential benefit <br />
for the contractor and sub-contractor <br />
communities; however, they are beyond <br />
the scope of the rule. These <br />
recommendations included creation or <br />
expansion of:
 
grants and assistance programs,
 
financial support for small business, the <br />
DoD [Procurement] Toolbox, the DoD <br />
Office of Small Business Programs, <br />
contract incentives and free or reduced <br />
cost DoD cybersecurity services.
 
DoD understands the burden on small
 
business. Nonetheless, DoD must <br />
enforce CMMC requirements uniformly <br />
across the Defense Industrial Base for all <br />
contractors who process, store, or <br />
transmit CUI. The requirements <br />
necessary to protect a single document <br />
are the same as to protect many <br />
documents, therefore scaling by amount <br />
of CUI expected is not a viable <br />
approach.
 
Solicitations for DoD contracts that
 
will involve the processing, storing, or <br />
transmitting of FCI or CUI on any <br />
nonfederal system, regardless of the size <br />
or configuration of the nonfederal <br />
system, will specify the required CMMC <br />
Level (1, 2 or 3) and assessment type <br />
(self-assessment or independent third- <br />
party assessment). That requirement <br />
applies, regardless of the number of
 
computers or components in a <br />
nonfederal information system.
 
DoD’s original implementation of
 
security requirements for adequate <br />
safeguarding of CUI relied upon self- <br />
attestation by contractors. Since that <br />
time, the DoD Inspector General and <br />
DCMA found that contractors did not <br />
consistently implement mandated <br />
system security requirements for <br />
safeguarding CUI and recommended <br />
that DoD take steps to assess a <br />
contractor’s ability to protect this <br />
information.
 
All contactors or sub-contractors with
 
access to CUI need to be capable of <br />
protecting that information to the <br />
standard specified in 32 CFR part 2002. <br />
If a small business cannot comply with <br />
DFARS clause 252.204–7012 and NIST <br />
SP 800–171 R2, then that business <br />
should not be processing, storing, or <br />
transmitting CUI. DoD’s programs, <br />
technological superiority, and best <br />
interests are not served if CUI is not <br />
consistently safeguarded by all who <br />
process, store, or transmit it.
 
''28. Perceived Cost of CMMC Program ''
 
''Comment: ''Several comments
 
expressed disagreement with <br />
assumptions supporting the cost <br />
estimate, namely that implementation <br />
costs to comply with the requirements <br />
of FAR clause 52.204–21 and DFARS <br />
clause 252.204–7012 predate and are <br />
not included as CMMC costs. These <br />
comments assert that the cost of CMMC <br />
compliance should include those costs, <br />
and therefore dwarfs the cost of CMMC <br />
certification. They further assert that <br />
DoD’s position does not account for <br />
those contractors who have only <br />
recently joined the DIB marketplace or <br />
those that aspire to do so. The concern <br />
expressed in the comments is that the <br />
cost of standing up an infrastructure to <br />
achieve and maintain DoD cybersecurity <br />
requirements regarding the protection of <br />
FCI and CUI, combined with CMMC <br />
assessment costs, is prohibitive and will <br />
create a lack of diverse suppliers.
 
Two commenters asserted the CMMC
 
Program expanded application of <br />
DFARS clause 252.204–7012 <br />
requirements due to a perceived <br />
extension of those requirements to <br />
additional organizations, such as <br />
External Service Providers (ESPs). One <br />
of the commenters further speculated <br />
that CMMC requirements may decrease <br />
the availability of ESPs that are <br />
available and suitable to support DIB <br />
members as needed to comply with <br />
CMMC requirements. Another <br />
commenter stated that this scope <br />
expansion increases direct <br />
implementation and compliance costs <br />
above and beyond the CMMC Program’s
 
estimated assessment costs. The <br />
comment cites the introduction of the <br />
terms ‘‘Security Protection Assets’’ and <br />
‘‘Security Protection Data’’ as extending <br />
applicability of those requirements and <br />
incurring the additional direct <br />
implementation and compliance costs. <br />
Lastly, the comment notes these changes <br />
will drive costs to ‘‘rip and replace’’ <br />
existing tools and likely purchase more <br />
expensive FedRAMP or CMMC-certified <br />
tools.
 
One comment indicated that, while
 
compliance with NIST SP 800–171 was <br />
required by December 31, 2017, <br />
compliance with NIST SP 800–171A <br />
Jun2018 increases requirements and <br />
cost because NIST SP 800–171A <br />
Jun2018 emphasizes process and <br />
documentation in addition to the intent <br />
of the security requirement.
 
Two comments pointed out that some
 
contractors may need to accelerate <br />
remediation efforts and close out <br />
POA&amp;Ms under existing DoD contracts <br />
that are subject to DFARS clause <br />
252.204–7012 to meet CMMC <br />
requirements. These comments <br />
requested that since these contractors <br />
will now be faced with accelerating <br />
close-out of their POA&amp;Ms, which will <br />
incur additional costs, that DoD account <br />
for those costs in the estimate and <br />
potentially allow for recovery of those <br />
costs.
 
One comment asserts that CMMC
 
assessment failures, remediation <br />
implementation, and subsequent <br />
reassessments will be very costly in <br />
both time and money.
 
''Response: ''81 FR 72990, October 21,
 
2016 implemented the DoD’s <br />
requirement that ‘‘contractors shall <br />
implement NIST SP 800–171 as soon as <br />
practical, but not later than December <br />
31, 2017.’’ Public comments related to <br />
costs for implementation were <br />
published with that final rule, along <br />
with DoD’s responses. CMMC cost <br />
estimates are derived estimates based on <br />
internal expertise and public feedback <br />
in accordance with OMB Circular A–4 <br />
and are representative of average <br />
assessment efforts not actual prices of <br />
C3PAO services available in the <br />
marketplace. Market forces of supply <br />
and demand will determine C3PAO <br />
pricing for CMMC Level 2 certification <br />
assessments and how C3PAOs choose to <br />
distinguish their service offerings from <br />
other C3PAOs, including the timely <br />
availability of an assessment team, or re- <br />
assessments after an assessment failure. <br />
The size and complexity of the network <br />
within the scope of the assessment <br />
impacts the costs as well. The DoD <br />
declines to speculate about how OSCs <br />
and C3PAOs negotiate mutually
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00062
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83153 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
acceptable terms and conditions for <br />
assessment agreements.
 
OSA implementation of the
 
requirements of FAR clause 52.204–21 <br />
and DFARS clause 252.204–7012 long <br />
predate CMMC and are not included in <br />
CMMC cost estimates, since those <br />
requirements are not driven by or <br />
attributable to CMMC, even for new or <br />
aspiring defense contractors, and have <br />
been in force since 2017 on DoD <br />
contracts that include the processing, <br />
storing, or transmitting of FCI or CUI in <br />
the performance of a DoD contract. The <br />
DoD has taken measures to make a self- <br />
assessment as straight forward as <br />
possible and provided guidance to <br />
mitigate any variance in assessment <br />
scores. Additionally, the DoD has <br />
streamlined CMMC requirements to <br />
align directly to NIST guidelines and <br />
has eliminated unique security practices <br />
to ease the burden on smaller <br />
companies. DoD must enforce CMMC <br />
requirements uniformly across the <br />
Defense Industrial Base for all <br />
contractors and subcontractors who <br />
process, store, or transmit CUI. Creation <br />
of a grants and assistance programs are <br />
beyond the scope of this rule. DFARS <br />
clause 252.204–7012 requires protection <br />
of security protection assets and <br />
security protection data. Section 1.1 of <br />
NIST SP 800–171 R2 states: ‘‘The <br />
requirements apply only to components <br />
of nonfederal systems that process, <br />
store, or transmit CUI, or that provide <br />
security protection for such <br />
components.’’ There is therefore no <br />
increase in the scope as described in the <br />
rule.
 
Security protection data requires
 
protection commensurate with the CUI <br />
it protects and is based on how and <br />
where the security protection data is <br />
stored. The FedRAMP requirements for <br />
handling security protection data is <br />
therefore the same as that for handling <br />
CUI. Any impact to the cost of serving <br />
Government customers across the DoD <br />
is beyond the scope of this rule.
 
As NIST states in NIST SP 800–171A
 
Jun2018, ‘‘The assessment procedures <br />
are flexible and can be customized to <br />
the needs of the organizations and the <br />
assessors conducting the assessments. <br />
Security assessments can be conducted <br />
as self-assessments; independent, third- <br />
party assessments; or government- <br />
sponsored assessments and can be <br />
applied with various degrees of rigor, <br />
based on customer-defined depth and <br />
coverage attributes.’’ CMMC Program <br />
requirements are designed to ensure <br />
compliance with existing standards for <br />
protection of FCI and CUI and align <br />
directly to NIST guidelines (''i.e., ''NIST <br />
SP 800–171 R2 and NIST SP 800–172 <br />
Feb2021) and the basic safeguarding
 
requirements (of FAR clause 52.204–21) <br />
that apply to all executive agencies. The <br />
rule accounts for costs associated with <br />
assessment via NIST SP 800–171A <br />
Jun2018.
 
Within the limitations of section
 
§ 170.21 Plan of Action and Milestones <br />
Requirements, offerors may bid on a <br />
contract while continuing to work <br />
towards full CMMC compliance. DoD <br />
rejects the notion that organizations <br />
must ‘‘accelerate’’ to meet a requirement <br />
in place since 2017. DoD did not intend <br />
nor expect that POA&amp;Ms would remain <br />
open-ended and unimplemented for <br />
years.
 
The DoD provided an analysis of costs
 
to meet CMMC Level 1 and 2 <br />
requirements in the regulatory impact <br />
analysis for this rule. Certification is <br />
never required for CMMC Level 1, <br />
which is a self-assessment requirement. <br />
CMMC Level 2 may either be met via <br />
self-assessment, or via a C3PAO <br />
assessment, depending on the specific <br />
requirement cited in the solicitation. It <br />
is not within in scope of this rule to <br />
address the way companies recover <br />
assessment costs.
 
Verifying compliance with applicable
 
security requirements may increase cost <br />
and is necessary for the protection of <br />
DoD FCI and CUI. The cost of lost <br />
technological advantage over potential <br />
adversaries is greater than the costs of <br />
such enforcement.
 
''29. CMMC Benefits and Cost Estimates ''
 
a. Cost Estimate Assumptions
 
''Comment: ''Some comments proposed
 
the DoD directly assume the costs for <br />
industrial base compliance, increase <br />
contract award prices, offer grants and <br />
loans, or provide tax credits to offset the <br />
costs associated with compliance. One <br />
asked for clarification regarding <br />
allowable versus unallowable costs. One <br />
comment stated the cost estimate was a <br />
good guesstimate of the total cost to the <br />
USG, but the flow down costs and the <br />
price of doing business will be at the <br />
Program Office level. The commenter <br />
requested the DoD provide a table of <br />
Program Office funding requirements to <br />
aid Program Managers in reflecting <br />
CMMC costs in an Acquisition Strategy <br />
and Cost Analysis Requirements <br />
Document (CARD).
 
A few comments asked about the
 
assumptions used to estimate numbers <br />
of assessments by category and stated <br />
the labor rates for ESPs and C3PAOs <br />
were too low, and costs associated with <br />
small entities were incorrect. Two <br />
comments also suggested the number of <br />
hours estimated for self-assessment are <br />
too low, and three questioned the <br />
accuracy of small and medium sized
 
business labor rates and asserted that <br />
the assessment costs for small <br />
businesses were not sustainable. One <br />
comment suggested that cost data in <br />
existing/past contracts should be used <br />
as a part of CMMC cost analysis and <br />
Section H costs should apply to the <br />
current CMMC cost estimate.
 
One comment claimed it is cost
 
prohibitive for individuals to obtain a <br />
CCP or CCA certification, which will <br />
hamper the CMMC Program’s <br />
scalability.
 
One comment requested the
 
government elaborate on how the <br />
estimated 417.83 hours per response <br />
was derived for table 39, C3PAOs Level <br />
1 Certification and Assessment, in <br />
section § 170.17(a). Another comment <br />
asserted that assessments conducted by <br />
Defense Technical Risk Assessment <br />
Methodology (DTRAM) assessment <br />
teams require more manhours than are <br />
anticipated for CMMC certification <br />
assessments.
 
One comment stated that while DoD
 
included an estimate for annual senior <br />
official affirmations in the Regulatory <br />
Impact Analysis, it assumed a minimal <br />
number of hours will be required to <br />
complete this task which may not be <br />
adequate to complete a full compliance <br />
review.
 
One comment stated the DoD self-
 
assessment resource allocations for an <br />
ESP for both CMMC Level 1 and Level <br />
2 are estimated 125% to 175% too low <br />
based on the belief that a self- <br />
assessment should have more rigor than <br />
a gap analysis. Specifically, the <br />
commenter posed questions on what <br />
inputs from potential OSAs were used <br />
and identifying the rigor a Certifying <br />
Official would require for attestation. <br />
Recommendations include that the DoD <br />
clearly state its assumptions regarding <br />
self-assessment rigor, have OSA legal <br />
counsel review assumptions and cost <br />
factors, and identify a representative <br />
cross-section of stakeholders to <br />
determine appropriate rigor <br />
assumptions for company’s ESPs and <br />
new to CMMC self-assessments.
 
One comment stated that the DoD’s
 
assumptions for the level of effort <br />
expressed as Director and staff IT <br />
specialist hours are too low. Although <br />
there are continuous monitoring <br />
requirements of NIST 800–171 R2, those <br />
requirements do not invoke the level of <br />
effort necessary for an executive to make <br />
an attestation corresponding to the level <br />
of personal risk and corporate liability <br />
incurred under the False Claims Act. <br />
The comment asserted that DoD’s <br />
assumptions failed to account for an <br />
SMB to acquire and manage technical <br />
tools or manage the reaffirmation or an <br />
enterprise change management effort.
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00063
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83154 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
The comment included several <br />
questions regarding the inputs used to <br />
determine lack of ongoing management <br />
resource requirements for reaffirmation, <br />
a risk management application, and <br />
inputs across the DIB regarding the level <br />
of assurance needed for affirmations to <br />
address liability concerns with the False <br />
Claims Act. Another recommendation <br />
suggested the DoD clearly state the <br />
degree of rigor an OSA should assume <br />
and revisit the cost assumptions <br />
involved to provide the Entity official <br />
with assurance for reaffirmation.
 
One commenter reviewed the CMMC
 
AB’s draft CMMC Assessment Process <br />
(CAP) document and agreed that 120 <br />
hours for a C3PAO’s three-person team <br />
inclusive of Phases 1, 2 and 3 is <br />
appropriate for smaller companies and <br />
should be considered a lower bound for <br />
C3PAOs deployed resources but <br />
suggested the 156 ESP assessment hours <br />
should be decreased.
 
One comment highlighted the
 
following rule text, ‘‘The total estimated <br />
Public (large and small entities) and <br />
Government costs associated with this <br />
rule, calculated in over a 20-year <br />
horizon in 2023 dollars at a 7 percent <br />
discount rate and a 3 percent discount <br />
rate are provided as follows,’’ and asked <br />
how an organization could become <br />
eligible for the 7% discount.
 
One comment proposed DOD remove
 
CMMC Level 1, or defer CMMC Level 1 <br />
implementation for several years, since <br />
it does not involve CUI. The comment <br />
stated CMMC Level 1 cost estimations <br />
and burden of compliance in the rule <br />
were greatly understated, that few <br />
companies subject to this CMMC level <br />
have any idea what is expected of them, <br />
and most will struggle with financial, <br />
technical, and human resources. <br />
Though FAR clause 52.204–21 is widely <br />
used in Federal contracts, it has not <br />
been successfully communicated that <br />
NIST SP 800–171A Jun2018 will be <br />
used. The comment concludes stating <br />
CMMC Level 1 does not include CUI, <br />
therefore making cost and compliance <br />
an excessive demand.
 
''Response: ''Subsidizing costs for the
 
defense industrial base compliance is <br />
not within the scope of this rule. The <br />
rule has taken several steps to keep the <br />
cost of compliance with the rule <br />
commensurate with the risk to the <br />
DoD’s information. In addition, Level 1 <br />
only requires self-assessment, and many <br />
contracts with CUI will only require a <br />
Level 2 self-assessment. Companies that <br />
are currently and validly attesting that <br />
they meet DFARS clause 252.204–7012 <br />
should not have difficulty passing a <br />
Level 2 self-assessment.
 
Cost estimates provided in this rule
 
were based on internal expertise,
 
compliant with OMB Circular A–4, and <br />
informed by public feedback. Certain <br />
elements of the estimated costs will be <br />
influenced by market forces of supply <br />
and demand, which will determine <br />
C3PAO pricing for CMMC Level 2 <br />
certification assessments.
 
The number of assessments over the
 
phase-in period were estimated using <br />
data from the Electronic Data Access <br />
system for the contracts containing <br />
DFARS clause 252.204–7012 in fiscal <br />
years 2019, 2020, and 2021, as well as <br />
data calculated for the initial CMMC <br />
Program. This data was used in <br />
combination with an expected growth <br />
factor to estimate DoD contracts and <br />
orders in the future. Data also showed <br />
the number of awards that were made to <br />
small entities and other than small <br />
entities. The resulting estimate was <br />
phased in over 7 years to allow the <br />
ecosystem to grow and accommodate an <br />
increasing number of assessments.
 
The assumptions and analysis of costs
 
are provided in the regulatory impact <br />
analysis for this rule and are explained <br />
in depth. One of the assumptions is that <br />
Non-Small Entities have a team of full- <br />
time cybersecurity professionals on staff <br />
while Small Entities do not. The <br />
assumptions reflect Small Entities will <br />
likely obtain support from External <br />
Service Providers and have a staff <br />
member submit affirmations and SPRS <br />
scores for self-assessments (when <br />
applicable).
 
DoD included an analysis of costs to
 
meet CMMC requirements in the <br />
regulatory impact analysis for this rule. <br />
As described in the estimate included <br />
with the rule, the major cost categories <br />
for compliance with CMMC <br />
requirements are anticipated to include <br />
costs for completing a self-assessment <br />
(''e.g., ''Level 1 or 2); costs to prepare for <br />
and undergo C3PAO assessment (Level <br />
2); costs required to implement the <br />
Level 3 security requirements and for <br />
preparing to undergo DCMA DIBCAC <br />
assessment (Level 3). Market forces of <br />
supply and demand will determine <br />
C3PAO pricing for CMMC Level 2 <br />
certification assessments. The CMMC <br />
rule does not make any change to cost <br />
allowability as defined in the FAR <br />
31.201–2, Determining Allowability.
 
As addressed in the Assumptions
 
section of the Regulatory Impact <br />
Analysis (RIA), the cost estimates for <br />
CMMC Levels 1 and 2 are based only on <br />
the assessment, certification, and <br />
affirmation activities that a defense <br />
contractor, subcontractor, or ecosystem <br />
member must take to allow DoD to <br />
verify implementation of the relevant <br />
underlying security requirements. For <br />
CMMC Level 3, cost estimates to <br />
implement applicable security
 
requirements are included as they are a <br />
new addition to current security <br />
protection requirements. Section H costs <br />
of existing/past contracts do not apply.
 
CCP and CCA certification costs are
 
set by the CAICO and are market driven. <br />
The hours used in the cost estimations <br />
are based on estimates by subject matter <br />
experts. The 417.83 hours per response <br />
questioned by the commentor ties to <br />
C3PAO reporting and recordkeeping <br />
requirements for Level 2 certification <br />
assessment on small entities as <br />
identified in table 36, not Level 1 or <br />
table 39 as stated in the comment.
 
In response to public comments
 
received in the initial 48 CFR CMMC <br />
interim final rule public comment <br />
period, DoD streamlined the CMMC <br />
model to ease the assessment burden. At <br />
the same time, estimates were increased <br />
for the time and cost of self-assessment <br />
based on industry and DIBCAC input. <br />
DoD estimates are based on defendable <br />
assumptions and documented labor <br />
rates. Therefore, DoD declines to modify <br />
the self-assessment estimates.
 
The DoD has streamlined CMMC
 
requirements to align directly to NIST <br />
guidelines and eliminated unique <br />
security practices to ease the burden on <br />
smaller companies, included an analysis <br />
of costs to meet CMMC requirements in <br />
the regulatory impact analysis for this <br />
rule. The DoD declined to modify the <br />
estimates, which are intended to be <br />
representative and to inform <br />
rulemaking.
 
Verifying compliance with applicable
 
security requirements may increase cost <br />
and is necessary for the protection of <br />
DoD CUI. The cost of lost technological <br />
advantage over potential adversaries is <br />
greater than the costs of such <br />
enforcement. The value of information <br />
(and impact of its loss) does not <br />
diminish when the information moves <br />
to contractors.
 
DoD rejected the recommendation to
 
adjust the annual requirement for senior <br />
affirmations to a triennial requirement <br />
to decrease senior affirmation costs. The <br />
requirement for annual affirmations is to <br />
ensure the Affirming Official <br />
responsible for CMMC requirements are <br />
monitoring compliance with the <br />
requirements. If compliance is being <br />
maintained as required, this should not <br />
require more time or cost than provided <br />
in the estimates. Further, DFARS clause <br />
252.204–7012 already requires NIST SP <br />
800–171 continuous monitoring via <br />
requirement 3.12.3. DoD also declined <br />
to make the recommended edits to <br />
further delineate a company’s internal <br />
review of self-assessments and <br />
reaffirmations in the cost assumptions.
 
The cost estimates provided for this
 
rule represent average costs for
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00064
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83155 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
companies to comply with the CMMC <br />
requirement, including the need for self- <br />
assessment or independent assessment <br />
against the specified standards. Whether <br />
the OSA elects to satisfy those <br />
requirements themselves, or by using <br />
one ESP for many requirements, or by <br />
using several ESPs for individual <br />
requirements, is a decision to be made <br />
by the OSA. That decision does not <br />
change DoDs estimate of average costs to <br />
meet CMMC requirements. The DoD <br />
declined to recalculate cost estimates <br />
using lower costs for ESP assessments.
 
The 7% discount rate is not a
 
discount for organizations. The discount <br />
rate is a part of a formula used in a <br />
business impact analysis calculation. <br />
When calculating 20 years in the future, <br />
a discount rate is used to determine the <br />
net present value of money. Discount <br />
rates are explained in step seven of <br />
OMB Circular A–4: Regulatory Impact <br />
Analysis: A Primer. The DoD does not <br />
agree with the commenter’s assertion <br />
that the cost estimates greatly understate <br />
the costs and burden to Level 1 <br />
compliance. The 15 FAR security <br />
requirements that comprise CMMC <br />
Level 1 should already have the <br />
requirements implemented if an OSA <br />
network processes, stores, or transmits <br />
FCI. In addition to NIST SP 800–171A <br />
Jun2018, the CMMC Level 1 Assessment <br />
Guide provides supplemental <br />
information to help facilitate <br />
implementation and assessment of the <br />
Level 1 security requirements.
 
b. Economic Impact
 
''Comment: ''One comment suggested
 
the government evaluate the economic <br />
impact of implementing the rule’s <br />
reporting requirements at scale. Another <br />
comment expressed the notion that the <br />
cost impact analysis does not account <br />
for the free market response, referring to <br />
the associated cost increases and <br />
schedule delays that directly impact the <br />
warfighter and taxpayer. The <br />
commentor suggested the cost could <br />
dwarf both the cost of implementing <br />
compliance and achieving certification.
 
One comment stated the CMMC Level
 
2 and Level 3 cost burdens for <br />
companies that were historically never <br />
subjected to such requirements may be <br />
disproportionate to the risk their <br />
operations pose to the inadvertent <br />
disclosure of CUI or FCI. It suggested <br />
ensuring requirements be proportional <br />
to the subcontractor’s activity and risk <br />
levels. The comment further mentioned <br />
that costs may be passed on to the prime <br />
contractor, and DoD should consider <br />
providing recovery costs in the price of <br />
implementation.
 
One comment stated the 100%
 
compliance to CMMC Level 2
 
certification may be financially <br />
unachievable and suggests if a risk <br />
assessment shows the likelihood of <br />
harm is comparatively low, the DoD <br />
should direct CMMC Program assessors <br />
to use their professional judgments and <br />
not require seeking maximum evidence <br />
of compliance where there is evidence <br />
of sufficiency.
 
''Response: ''The DoD has already
 
evaluated the reporting requirements <br />
and the analysis of the costs is provided <br />
in the Regulatory Impact Analysis <br />
published with this rule. The DoD <br />
declined to respond to speculative or <br />
editorial comments about downstream <br />
impacts of the market’s reaction to <br />
CMMC, all of which are beyond the <br />
scope of this rule.
 
The DoD declined the
 
recommendation to restructure CMMC <br />
to be proportional to the subcontractor’s <br />
activity and risk levels. DoD must <br />
enforce CMMC requirements uniformly <br />
across the Defense Industrial Base for all <br />
contractors and subcontractors who <br />
process, store, or transmit CUI. The <br />
value of information (and impact of its <br />
loss) does not diminish when the <br />
information moves to contractors and <br />
subcontractors.
 
Assessors exercise judgment in
 
determining when sufficient and <br />
adequate evidence has been presented <br />
to make an assessment finding. This is <br />
consistent with current DIBCAC High <br />
Assessments and assessments <br />
conducted under the Joint Surveillance <br />
Voluntary Assessment (JSVA) program. <br />
Furthermore, to reduce burden to small <br />
businesses, the CMMC program has <br />
implemented flexibility with self- <br />
assessment, POA&amp;Ms, and waivers.
 
c. Cross-Functional Requirements and <br />
Artifacts
 
''Comment: ''Multiple comments
 
maintained that DoD underestimated <br />
the cross-functional (Human Resources, <br />
Physical Security, Training, etc.) <br />
manhours and associated cost to collect <br />
artifacts and evidence in preparation for <br />
a C3PAO assessment. One comment <br />
stated the DoD’s overestimation of <br />
CMMC Level 1 requirements would <br />
correspond to an underestimation of <br />
compliance costs. The comment referred <br />
to current NIST requirements and <br />
asserted that potential revisions would <br />
force changes to POA&amp;Ms causing <br />
additional costs beyond those included <br />
in the estimates. The comment <br />
suggested the DoD should determine the <br />
range of potential compliance timelines, <br />
the use and value of existing and <br />
planned POA&amp;Ms, and true certification <br />
costs, both for initial compliance as well <br />
as ongoing maintenance and oversight.
 
One commentor claimed too much
 
funding was expended over the past 5 <br />
years for the CMMC database system.
 
''Response: ''OSCs prepare for C3PAO
 
assessments based upon NIST <br />
guidelines as addressed in § 170.17. The <br />
cost and time estimates represent the <br />
time to gather the evidence to address <br />
all assessment objectives are derived <br />
averages based on internal expertise and <br />
public feedback in accordance with <br />
OMB Circular A–4 Regulatory Impact <br />
Analysis: A Primer. The size and <br />
complexity of the network within scope <br />
of the assessment impacts the costs as <br />
well.
 
The time estimates represent average
 
derived estimates based on internal <br />
expertise and public feedback in <br />
accordance with OMB Circular A–4. <br />
The size and complexity of the network <br />
within scope of the assessment impacts <br />
the time estimates as well. The DoD <br />
does not concur with the commenter’s <br />
claim that too much funding has been <br />
spent to develop the DoD’s database for <br />
the CMMC Program.
 
d. Duplication or Overlap
 
''Comment: ''One comment asserted
 
CMMC requirements may be duplicative <br />
or conflict with existing utility industry <br />
compliance requirements that address <br />
CUI, since utility companies will not <br />
require CMMC Level 3 certification. <br />
They proposed the utilities and the DoD <br />
collaborate to harmonize requirements <br />
to limit the financial burden.
 
One comment highlighted a concern
 
that cost for companies that have <br />
multiple contracts, each requiring <br />
different CMMC Program requirements. <br />
Concerns were specifically based on the <br />
increased costs from CMMC Level 2 to <br />
CMMC Level 3 compliancy and <br />
assuming costs would be borne by <br />
contractors. They expressed similar <br />
concerns about costs for FedRAMP <br />
certification, given a purported backlog <br />
in FedRAMP authorizations.
 
''Response: ''Addressing the
 
harmonization between the DoD, <br />
contractors, and subcontractors is <br />
beyond the scope of this rule. These are <br />
functions of the DIB Sector Coordinating <br />
Council and the DIB Government <br />
Coordinating Council. Additionally, <br />
non-DoD programs are outside the <br />
control and scope of the 32 CFR part <br />
170 CMMC Program rule. The DoD <br />
encourages prime contractors to work <br />
with its subcontractors to flow down <br />
CUI with the required security and the <br />
least burden.
 
DoD is aware organizations may
 
receive multiple contracts that may <br />
require different CMMC levels based <br />
upon programmatic data security needs. <br />
It is beyond the scope of this rule to
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00065
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83156 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
dictate how OSAs manage varying <br />
contract requirements. Contractors that <br />
have achieved a CMMC Level 2 or Level <br />
3 certification automatically meet a <br />
stated requirement of a lower CMMC <br />
level if the same system/assessment <br />
scope will be used in performance of the <br />
contract.
 
''30. Alternatives ''
 
a. Alternate Programs
 
''Comment: ''Many comment
 
submissions included lengthy proposals <br />
for alternatives to the CMMC program <br />
purported to alleviate specific concerns <br />
with aspects of CMMC program <br />
requirements. In some cases, the <br />
concerns were based on a misreading of <br />
the rule’s content. The DoD has <br />
addressed some valid concerns through <br />
rule revisions that differ from the <br />
recommendations.
 
One commenter suggested eliminating
 
compliance assessments in favor of <br />
establishing a DoD office to conduct <br />
penetration testing of each DIB <br />
company’s network every two years. <br />
Other commenters also recommended <br />
the DoD establish a secure portal and <br />
share CUI with contractors only through <br />
that portal, as a way for the DIB to avoid <br />
the cost of securing their information <br />
systems. One commenter suggested the <br />
DoD monitor use of waivers and utilize <br />
this secure portal approach when <br />
CMMC waivers apply. Similar <br />
recommendations included sharing CUI <br />
only through password encrypted files <br />
or requiring contractors to store CUI in <br />
restricted access folders. In similar <br />
suggestions, several commenters <br />
thought the DoD should provide its <br />
contractors with training, GFE and other <br />
tools necessary to secure the contractor <br />
owned information systems being used <br />
to process or store CUI. One such <br />
commenter stated that the Government <br />
should appropriate funding for secure <br />
solutions rather than phasing in <br />
compliance assessments. One <br />
commenter suggested the DoD consider <br />
industry’s application of alternate <br />
security mechanisms in lieu of CMMC <br />
Levels 2 and 3. Another recommended <br />
the DoD stand up a voluntary DIB Cyber <br />
Protection Program to improve real-time <br />
monitoring of the DIB, improve <br />
cybersecurity for firms that cannot <br />
afford the needed professional staff, and <br />
offer data and legal protections to DIB <br />
firms. Another such commenter <br />
suggested that DoD fund securing the <br />
DIB through contract incentives.
 
One commenter recommended
 
mandating DIB use of the DoD CIO’s DIB <br />
CS Program or other DoD cybersecurity <br />
related services as alternatives to the <br />
CMMC program. That comment
 
suggested reassigning Government <br />
personnel to provide training for all <br />
assessors, to reduce training cost and <br />
ensure enough assessors to meet <br />
demand. Another commenter made <br />
similar recommendations about CISA <br />
cybersecurity service offerings.
 
''Response: ''Many comments included
 
lengthy proposals for alternate <br />
approaches to the CMMC program <br />
which would alleviate specific concerns <br />
with aspects of CMMC program <br />
requirements. In some cases, the <br />
suggestions were based on a misreading <br />
of the rule’s content. The DoD has <br />
addressed some valid concerns via rule <br />
revisions that differ from commenter <br />
recommendations.
 
The DoD notes with interest one
 
commenter’s reference to initiatives <br />
described in a report to Congress about <br />
the breadth of cybersecurity related <br />
initiatives within the Department. While <br />
the CMMC is an important initiative, it <br />
is by no means the Department’s only <br />
effort to improve DIB cybersecurity. The <br />
CMMC Program addresses adequate <br />
safeguarding of contractor owned <br />
information systems which process, <br />
store, or transmit FCI or CUI. Other DoD <br />
initiatives related to secure cloud or <br />
software development environments are <br />
beyond the scope of the CMMC <br />
Program.
 
The DoD did not adopt suggested
 
alternatives, such as policy-based <br />
solutions that lack a rigorous assessment <br />
component. The DoD determined that <br />
sharing CUI only through DoD-hosted <br />
secure platforms, in lieu of <br />
implementing the CMMC Program, was <br />
not a scalable or cost-effective solution. <br />
Although the DoD expanded the <br />
availability of resources through the DIB <br />
Collaborative Information Sharing <br />
Environment (DCISE) program, the DoD <br />
also declines to rely only on training in <br />
lieu of assessment.
 
The purpose of CMMC is to require
 
defense contractors and subcontractors <br />
to undergo an assessment to verify the <br />
implementation of prescribed <br />
cybersecurity standards. The security <br />
requirements are already specified in <br />
existing regulations (32 CFR part 2002, <br />
DFARS clause 252.204–7012, and FAR <br />
clause 52.204–21).
 
Comments which suggest that
 
enrollment in the DoD’s DIB CS Program <br />
can be an alternative means of meeting <br />
the objectives of CMMC misinterpret the <br />
services that the DIB CS Program <br />
provides. The DIB CS Program does not <br />
provide any mechanism for verifying <br />
whether those participants have secured <br />
their contractor owned information <br />
systems to the standards required by <br />
DFARS clause 252.204–7012. Likewise, <br />
the recommended NSA cybersecurity
 
offerings also do not provide the same <br />
verification mechanism that CMMC will <br />
provide. CMMC Program requirements <br />
apply to contractor-owned information <br />
systems that process, store, or transmit <br />
FCI and CUI. Hardware and software <br />
approving authorities for GFE are not <br />
relevant to this CMMC rule. The DoD <br />
declined to adopt the recommendation <br />
to provide GFE to DIB contractors to <br />
maintain security, ownership of data <br />
and support Clinger-Cohen Act <br />
compliance.
 
Some comments received reflect a
 
misinterpretation of the cost estimates <br />
that accompany this rule, which are <br />
intended to inform the rulemaking <br />
process. The cost estimates are not <br />
indicative of a funded budget line <br />
which could be reprogrammed to fund <br />
a new agency to meet the objectives of <br />
the CMMC Program. Comments <br />
recommending that funding be <br />
appropriated (by Congress) to provide <br />
the DIB with security solutions are <br />
beyond the scope of this rule.
 
b. Alternate Standards
 
''Comment: ''One commenter
 
recommended aligning requirements to <br />
DoD policies rather than to NIST <br />
standards and relying on FISMA <br />
compliance assessments in lieu of the <br />
CMMC model. Another commenter <br />
recommended the DoD and NIST work <br />
with other international standards <br />
organizations to incorporate CMMC <br />
requirements (really NIST standards) <br />
into existing ISO/IEC and CMMI <br />
standards. In general, these commenters <br />
recommended DoD accept alternate <br />
assessments conducted against alternate <br />
standards by assessors with alternate <br />
training and qualifications. They further <br />
recommended that DoD issue an RFI <br />
seeking recommendation of alternate <br />
third-party assessment schemes. One <br />
commenter recommended the rule be <br />
modified to require that contracts with <br />
a CMMC level 3 requirement also <br />
require use of a FedRAMP moderate or <br />
higher CSP, and that contracts with a <br />
CMMC level 2 requirement permit use <br />
of CSPs with either FedRAMP Moderate <br />
authorization (or higher) or CMMC level <br />
2 or 3 certification assessment.
 
''Response: ''CMMC is based on the
 
executive branch’s CUI Program as the <br />
authoritative source, as codified in 32 <br />
CFR part 2002. The definition of CUI <br />
and general requirements for its <br />
safeguarding are included in 32 CFR <br />
2002.4 and 2002.14, respectively. 32 <br />
CFR 2002.14(h)(2) specifically requires <br />
that ‘‘Agencies must use NIST SP 800– <br />
171 when establishing security <br />
requirements to protect CUI’s <br />
confidentiality on non-Federal <br />
information systems . . .’’ The CMMC
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00066
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83157 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
Program makes no change to the CUI <br />
program or its implementing policies. <br />
Contractually, DFARS clause 252.204– <br />
7012, effective since December 2017, <br />
requires contractors to implement the <br />
NIST SP 800–171 security requirements <br />
to provide adequate security applicable <br />
for processing, storing, or transmitting <br />
CUI in support of the performance of a <br />
DoD contract. That requirement applies, <br />
regardless of the number of computers <br />
or components in a non-Federal <br />
information system.
 
The CMMC Program provides an
 
assessment mechanism to verify that <br />
prospective offerors comply with the <br />
applicable information security <br />
requirements. All executive agencies are <br />
required to follow the policies described <br />
in 32 CFR 2002.14. DoD aligned CMMC <br />
requirements with NIST SP 800–171 R2 <br />
because it is enterprise focused and is <br />
already required in DoD contracts when <br />
DFARS clause 252.204–7012 is <br />
applicable. DFARS clause 252.204–7012 <br />
and NIST SP 800–171 R2 provide the <br />
cybersecurity requirements, whereas <br />
CMMC validates implementation of <br />
those requirements. CMMC does not <br />
duplicate these documents.
 
The DoD publishes Security
 
Technical Implementation Guides <br />
(STIGs) for specific products, primarily <br />
to guide secure implementation in DoD <br />
systems. The OSA is responsible for <br />
creating the implementation guidance <br />
they will use to meet the CMMC <br />
security requirements. OSAs are free to <br />
use the DoD STIGS if they feel they are <br />
appropriate. The DoD does not want to <br />
limit the choices available to the OSA <br />
for implementation guidance. In <br />
addition, the DoD declines to create <br />
STIGs for all products that might be <br />
used in the OSA’s environment. Some <br />
comments lacked relevance to the rule’s <br />
content, which is limited to specific <br />
CMMC program requirements.
 
Changes to DFARS clause 252.204–
 
7012 are outside the scope of this rule. <br />
DoD declines to modify CMMC Level 2 <br />
or Level 3 requirements related to use of <br />
Cloud Service Providers (CSP). A CSP is <br />
assessed against the FedRAMP <br />
Moderate baseline. This is required <br />
when a CSP, regardless of the <br />
component or type of CSP, processes, <br />
stores, or transmits CUI.
 
The DoD declines to align CMMC
 
requirements to alternate standards or <br />
accept compliance with alternate <br />
standards in lieu of the NIST SP 800– <br />
171 standard mandated by 32 CFR part <br />
2002 for the protection of CUI. CMMI is <br />
focused on improving the software <br />
development process, while CMMC is <br />
focused on verifying the proper <br />
implementation of DIB cybersecurity <br />
requirements. Incorporating
 
requirements into new or other existing <br />
standards would unacceptably delay <br />
action to improve DIB cybersecurity. <br />
The DoD must take action to improve <br />
DIB cybersecurity, regardless of the <br />
global state of cybersecurity. DoD’s <br />
publication of this rule follows <br />
completion of OMB’s formal rulemaking <br />
process, which includes both DoD <br />
internal coordination and Interagency <br />
coordination. The recommendation for <br />
the DoD to establish a voluntary DIB <br />
Cyber Protection Program is beyond the <br />
scope of this rule.
 
One commenter recommended
 
administrative edits to identify CMMC <br />
levels at a particular place in the pre- <br />
amble description of the program. The <br />
preamble is not part of the official <br />
regulation. In addition to background <br />
and overview information about the <br />
proposed or final rule, the preamble <br />
includes responses to all comments <br />
received during the public comment <br />
period on the proposed rule. The <br />
certification requirements are in subpart <br />
D, §§ 170.15 through 170.18.
 
c. Alternate Implementation Timelines
 
''Comment: ''Several commenters
 
suggested that DoD abandon CMMC <br />
requirements in favor of simply <br />
continuing to rely upon self- <br />
assessments, or else allowing <br />
contractors to comply with DFARS <br />
clause 252.204–7012 requirements <br />
absent any assessment (self-conducted <br />
or third-party). Of those recommending <br />
self-assessment, two commenters <br />
limited the suggestion only to <br />
companies that self-certified as small <br />
businesses and one further <br />
recommended that DoD pay for <br />
certification assessment of all small <br />
businesses. One such commenter based <br />
their opinion on an interpretation that <br />
text in NIST SP 800–171 R2 identifies <br />
the requirements as a model for self- <br />
assessment. Another commenter made <br />
no suggestion to change assessment <br />
requirements, other than to implement <br />
them post-award, rather than pre-award.
 
One comment expressed doubt in the
 
ability of the ecosystem to scale <br />
sufficiently to meet the demand for <br />
C3PAO assessments and assessor <br />
training.
 
One commenter suggested the rule be
 
revised to eliminate POA&amp;Ms but <br />
expand the period during which <br />
deficiencies can be reassessed from <br />
within 10 days of initial assessment to <br />
60 days for those prospective <br />
contractors. Another commenter <br />
suggested varying timelines for <br />
POA&amp;Ms based on a variety of criteria, <br />
including how many DoD contracts are <br />
held.
 
''Response: ''The DoD declined to accept
 
the risk associated with implementing <br />
CMMC solely as a post-award <br />
requirement. When contracts require <br />
contractors to process, store, or transmit <br />
CUI, DoD requires that they be <br />
compliant with DFARS clause 252.204– <br />
7012 and competent to adequately <br />
safeguard CUI from the beginning of the <br />
period of performance. DoD declines the <br />
recommendation to require primes to <br />
assume the cost of CMMC for their <br />
subcontractors. Arrangements between <br />
contractors and subcontractors are <br />
negotiated directly between those <br />
parties. The DoD does not accept the <br />
recommendation to eliminate or change <br />
the criteria for POA&amp;Ms or the timeline <br />
allowed to remediate open POA&amp;M <br />
items. The 180-day period allowed for <br />
POA&amp;Ms and the determination of <br />
which weighted practices can be placed <br />
on a POA&amp;M was a risk-based decision. <br />
The determination considers the relative <br />
risk DoD is willing to accept when a <br />
particular practice is not met and the <br />
amount of risk the DoD is willing to <br />
accept for those security practices that <br />
go ‘‘NOT MET’’ for an extended period.
 
The Department declines to adopt the
 
recommendation to allow DIB members <br />
to assist in designing the DoD’s <br />
mechanism for assessing DIB <br />
compliance with DoD’s contractual <br />
requirements. In developing the CMMC <br />
program, the DoD sought and <br />
considered DIB input. DoD disagrees <br />
with the comment that there is a lack of <br />
scalability in the CMMC program. The <br />
phased implementation plan described <br />
in § 170.3(e) is intended to address any <br />
CMMC Ecosystem ramp-up issues, <br />
provide time to train the necessary <br />
number of assessors, and allow <br />
companies the time needed to <br />
understand and implement CMMC <br />
requirements. The rule has been <br />
updated to add an additional six months <br />
to the Phase 1 timeline. As with all its <br />
programs, the Department intends to <br />
effectively oversee the CMMC Program <br />
and act as needed to manage its effective <br />
implementation. Although the full <br />
extent of DoD’s oversight process is <br />
beyond the scope of this rule, the rule <br />
text addresses DoD’s authority to waive <br />
the application of CMMC requirements <br />
when warranted in accordance with all <br />
applicable policies, procedures, and <br />
approval requirements.
 
DoD has utilized a phased approach
 
to the rollout to reduce implementation <br />
risk. CMMC Program requirements make <br />
no changes to existing policies for <br />
information security requirements <br />
implemented by the DoD. It is beyond <br />
the scope of this rule for DoD to <br />
determine the order in which <br />
organizations are assessed.
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00067
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83158 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
d. Alternate Assessors or Assessments <br />
(Including Self-Assessment Only)
 
''Comment: ''One commenter submitted
 
numerous recommendations based on <br />
an opinion that skills required for <br />
conducting CMMC compliance <br />
assessments are like those required for <br />
conducting Independent Technical Risk <br />
Assessments (ITRAs) on Major Defense <br />
Acquisition Programs (MDAPs). Such <br />
assessments are conducted by the Office <br />
of the Undersecretary of Defense for <br />
Research &amp; Engineering (OUSD(R&amp;E)) in <br />
accordance with Defense Technical Risk <br />
Assessment Methodology (DTRAM) <br />
criteria. These criteria extend beyond <br />
compliance with cybersecurity <br />
requirements and include <br />
characteristics such as modular open <br />
systems architecture, software, <br />
manufacturing, reliability, availability, <br />
maintainability, and others. This <br />
commenter noted the DoD’s Adaptive <br />
Acquisition Framework applies to both <br />
Information Systems and National <br />
Security Systems and suggested that <br />
existing acquisition requirements <br />
pertaining to ITRA and DTRAM should <br />
suffice in lieu of CMMC assessments. <br />
The commenter recommended that DoD <br />
use existing ITRA teams to perform <br />
compliance assessments of contractor- <br />
owned information systems. In addition, <br />
they recommended aligning <br />
requirements to DoD policies rather <br />
than to NIST standards. Other <br />
comments made similar suggestions to <br />
synchronize cybersecurity requirements <br />
with DoD policies rather than NIST <br />
standards but cited FISMA compliance <br />
assessments as the appropriate model <br />
rather than the DTRAM.
 
One comment suggested that C3PAOs
 
be permitted to conduct partial <br />
assessments of ESPs, MSPs, and MSSPs. <br />
Multiple comments expressed concern <br />
with CMMC assessment requirements <br />
for OSAs that use ESPs, stating that <br />
OSAs would be unlikely to know which <br />
components of the services they <br />
purchased were covered by a required <br />
CMMC Level 2 assessment. This <br />
commenter recommended the creation <br />
of a separate type of CMMC assessment <br />
specifically for ESPs, which they further <br />
recommended should be highlighted on <br />
the CMMC AB marketplace to assist <br />
OSAs in selecting an appropriately <br />
vetted ESP. These comments provided <br />
an extended description of the specific <br />
scoping guidance that should be adding <br />
to existing CMMC supplemental <br />
documentation, as well as several <br />
sample scenarios explaining how <br />
requirements for this new type of <br />
assessment should be applied. Two <br />
comments highlighted that the rule’s <br />
preamble does not include details of
 
assessment and implementation <br />
requirements.
 
Several commenters recommended
 
the DoD abandon the CMMC ecosystem <br />
model and conduct all cybersecurity <br />
compliance assessments using DIBCAC <br />
assessors, which would reduce cost to <br />
the DIB. One such commenter suggested <br />
that DIBCAC assessment of C3PAOs, as <br />
part of the accreditation process, <br />
detracts from DIBCAC’s capacity to <br />
perform CMMC level 2 assessments for <br />
the DIB. Another noted that as <br />
Government employees, DIBCAC <br />
assessors could exercise judgement to <br />
make risk-tolerance decisions that non- <br />
Government C3PAOs cannot, including <br />
possible acceptance of partial non- <br />
compliance.
 
''Response: ''DoD must enforce CMMC
 
requirements uniformly across the <br />
Defense Industrial Base for all <br />
contractors and subcontractors who <br />
process, store, or transmit CUI. The <br />
value of information and impact of its <br />
loss does not diminish when the <br />
information moves to contractors and <br />
subcontractors. The DoD has considered <br />
the recommendation and declines to <br />
revise the rule text to rely solely on self- <br />
assessment or eliminate the 3-year <br />
validity period to rely on a one-time <br />
certification. It is important that <br />
contractors maintain security <br />
compliance for systems that process, <br />
store, or transmit DoD CUI. Given the <br />
evolving cybersecurity threat, DoD’s <br />
best interests are served by ensuring that <br />
CMMC Level 2 assessments remain <br />
valid for no longer than a 3-year period, <br />
regardless of who performs the <br />
assessment.
 
CMMC Program requirements in this
 
rule are designed to improve <br />
compliance with requirements for <br />
safeguarding of FCI and CUI. DoD has <br />
privity of contract to enforce these <br />
requirements and CISA does not. OSAs <br />
are free to choose CISA services as part <br />
of their implementation of DoD <br />
requirements. FISMA is for Federal <br />
systems that are used by Government <br />
personnel or the public and is therefore <br />
an unsuitable surrogate for CMMC <br />
requirements. If a contractor provides <br />
outsourced IT services to a Federal <br />
agency, the system is considered a <br />
Federal system and FISMA applies. In <br />
contrast, CMMC requirements apply to <br />
nonfederal systems that are used <br />
internally by contractor personnel.
 
The DoD disagreed with the
 
commenter’s assertions about NIST SP <br />
800–171 R2 and the available <br />
assessment methods. DoD’s DIBCAC <br />
currently performs assessments using <br />
the procedures in NIST SP 800–171A <br />
Jun2018, and these documents <br />
explicitly identify the target audience to
 
include individuals with security <br />
assessment responsibilities, such as <br />
auditors, assessors, and ‘‘independent <br />
verifiers’’. The aggregated SPRS <br />
reporting and scoring is CUI. The DoD <br />
does not wish to make this information <br />
public, which might aid adversaries in <br />
coordinating their attacks.
 
The CMMC Program does not
 
alleviate or supersede any existing <br />
requirements of the Adaptive <br />
Acquisition Framework, nor does <br />
CMMC alter any statutory or regulatory <br />
requirement for acquisition program <br />
documentation or deliverables.
 
One commenter referenced
 
assessments required during the <br />
acquisition process for DoD systems. <br />
DoD’s policies governing acquisition <br />
programs require that Independent <br />
Technical Risk Assessments be <br />
conducted on Major Defense <br />
Acquisition Programs. These <br />
assessments provide a view of program <br />
technical risk and are not well-suited to <br />
the assessment of contractor owned <br />
information systems against standards <br />
for safeguarding CUI. CMMC <br />
assessments are conducted on <br />
contractor owned information systems <br />
to gauge compliance with FAR and <br />
DFARS requirements for safeguarding <br />
FCI and CUI that is processed, stored, or <br />
transmitted within those contractor- <br />
owned information systems. One <br />
commenter incorrectly asserts that the <br />
CMMC Scoring Methodology does not <br />
parallel existing scoring methods, <br />
however the CMMC methodology is <br />
based on the DoDAM.
 
The DoD declined to accept the
 
recommended alternative of self- <br />
assessment with the potential to require <br />
DIBCAC assessment for a sampling of <br />
DoD contractors, which is essentially <br />
the status quo. Both GAO reporting and <br />
other DoD analysis have shown that the <br />
DIB has not consistently implemented <br />
the NIST SP 800–171 requirements <br />
needed to comply with DFARS clause <br />
252.204–7012, even though DoD’s <br />
objective was for the contactor to <br />
implement NIST SP 800–171 as soon as <br />
practical, but not later than December <br />
31, 2017.
 
The DoD reserves the right to decide
 
when reliance on self-assessment will <br />
suffice, and when compliance should be <br />
assessed through CMMC certification. <br />
Based on DoD decision criteria that <br />
includes a risk assessment of the type <br />
and sensitivity of program information <br />
to be shared, Program Managers will <br />
identify the appropriate CMMC <br />
requirement (''e.g., ''CMMC Level 2 self- <br />
assessment or Level 2 certification) in <br />
the solicitation.
 
The government does not have the
 
capacity in house to adequately assess
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00068
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83159 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
the 220,00+ companies in the DIB. The <br />
DoD cannot assume the workload of <br />
directly assessing every DIB contractor. <br />
With this final rule, DoD established a <br />
scalable way to verify, through <br />
assessment, that contractors have <br />
implemented required security <br />
measures necessary to safeguard DoD <br />
information. The DIBCAC’s mission is <br />
derived from DoD priorities and the <br />
Department is actively working to <br />
ensure that the DIBCAC is adequately <br />
resourced to effectively execute its <br />
mission areas. Planned changes to <br />
DCMA staffing levels have been <br />
considered and are necessary to <br />
implement the elements of the CMMC <br />
program described in this rule (''i.e., <br />
''Level 3 and C3PAO assessments).
 
By design, the CMMC Program
 
depends on the supply and demand <br />
dynamics of the free market, enabling it <br />
to naturally scale and adapt to capacity <br />
requirements. The DoD established <br />
requirements for each part of the CMMC <br />
ecosystem to support a robust <br />
compliance assessment mechanism for <br />
DoD’s contractual requirements to <br />
safeguard CUI that is processed, stored, <br />
or transmitted in contractor owned <br />
information systems. The DoD cannot <br />
assume the workload of directly <br />
assessing every DIB contractor.
 
One commenter provided numerous
 
comments expressing concern that <br />
OSAs that use ESPs will be unlikely to <br />
know which ESP services require <br />
CMMC assessment within the OSAs <br />
boundary or scope. This commenter <br />
recommended an alternate type of <br />
CMMC assessment specifically for ESPs. <br />
In lieu of adopting that <br />
recommendation, the DoD has updated <br />
the rule in §§ 170.19(c)(2) and (d)(2) to <br />
reduce the assessment burden on ESPs. <br />
DoD declined to allow partial CMMC <br />
Assessments. ESPs may request <br />
voluntary CMMC assessments of their <br />
environment and use that as a business <br />
discriminator. The marketplace for ESP <br />
services will adjust to find the efficient <br />
manner for ESPs to support OSA <br />
assessments.
 
e. Alternate Governance
 
''Comment: ''Rather than abandon the
 
CMMC ecosystem model entirely, some <br />
commenters recommended only that <br />
DoD revise the CMMC Accreditation <br />
Body’s roles and responsibilities. Three <br />
recommended the DoD eliminate the <br />
CMMC AB and take on its <br />
responsibilities; of these, one further <br />
suggested the DoD publish detailed <br />
Security Technical Implementation <br />
Guides describing how to implement <br />
the applicable NIST requirements. One <br />
commenter questioned the reasons for <br />
creating a CMMC AB rather than
 
accepting another existing accreditation <br />
body or multiple accreditation bodies. <br />
One comment expressed doubt in the <br />
ability of the ecosystem to scale <br />
sufficiently to meet the demand for <br />
C3PAO assessments and assessor <br />
training.
 
Multiple comments called for
 
organizations other than the current <br />
CMMC AB to run the CMMC ecosystem <br />
such as a CMMC Advisory Council or a <br />
Civilian Cybersecurity Corps comprised <br />
of government and private sector staff. <br />
One such comment requested that, <br />
unlike the current CMMC AB, the <br />
proposed body would be funded and <br />
managed by the government. Two <br />
commenters recommended the DoD <br />
consider accepting other types of <br />
conformance assessment such as ISO/ <br />
IEC 27001:2022(E) and Health <br />
Information Trust Alliance (HITRUST) <br />
certification. One noted this would <br />
require guidance to describe how to <br />
address the gaps between standards <br />
those assessments are aligned to and <br />
those that CMMC are aligned to (''e.g., <br />
''NIST SP 800–171 R2 for CMMC Level <br />
2). This commenter further suggested <br />
that DoD accept alternate industry <br />
certifications in lieu of the training <br />
requirements identified for CMMC <br />
Assessors. One commenter suggested <br />
the DoD accept FedRAMP authorization <br />
to meet CMMC assessment <br />
requirements.
 
''Response: ''DoD considered many
 
alternatives before deciding upon the <br />
current CMMC structure. The DoD <br />
established requirements for a CMMC <br />
Accreditation Body, and this <br />
accreditation body will administer the <br />
CMMC Ecosystem. The DoD reviewed <br />
and assessed the whitepapers that were <br />
submitted by RFI respondents and <br />
determined that no single respondents <br />
could meet all the broad facets required <br />
to serve as the CMMC Accreditation <br />
Body. Based on this assessment, the <br />
DoD published notice of a planned <br />
meeting in November 2019 to allow the <br />
respondents and other members of the <br />
public to hear the senior DoD leadership <br />
address DoD perspectives regarding the <br />
notional CMMC implementation flow; <br />
the notional program structure; the <br />
notional CMMC Accreditation Body <br />
activities, structure, and relationship <br />
with the DoD; and the notional CMMC <br />
implementation schedule. The DoD also <br />
provided information regarding the <br />
Department’s planned way forward. The <br />
result of the November 2019 meeting <br />
was the establishment of the current <br />
CMMC Accreditation Body. The <br />
relationship between the current CMMC <br />
Accreditation Body and the DoD was <br />
formalized through a Memorandum of <br />
Understanding and then a No-Cost
 
Contract. The DoD cannot assume the <br />
risk or the workload of directly <br />
managing the CMMC Ecosystem or the <br />
other alternatives suggested. The current <br />
CMMC Accreditation Body is aligned to <br />
the DoD through contractual <br />
arrangements.
 
''31. Rulemaking Process ''
 
''Comment: ''Some comments were
 
submitted to identify problems with <br />
using the Federal eRulemaking Portal (at <br />
[http://www.regulations.gov ''www.regulations.gov'') or the ]'''Federal <br />
Register '''website and did not address <br />
content of the proposed rule. One <br />
commenter was confused by the <br />
identification of the rule as ‘‘Proposed’’ <br />
rather than final. Another asked <br />
whether the rule could be republished <br />
with page numbers.
 
Many comments critiqued the format,
 
heading and section numbering, use of <br />
incorporation by reference, or sections <br />
contained within the rule, rather than <br />
the substance of the content. For <br />
example, some comments described the <br />
CMMC rule as overly repetitive or <br />
containing duplicative sections. Some <br />
comments recommended deleting <br />
specific sections to shorten or simplify <br />
the rule, including ‘‘History of the <br />
Program’’. Some commenters perceived <br />
the preamble to the rule as unnecessary <br />
and recommended deleting or <br />
shortening that section. In addition, one <br />
commenter noted that responses to <br />
public comments received against an <br />
earlier CMMC rule publication ought to <br />
be published with the 48 CFR part 204 <br />
CMMC Acquisition rule rather than this <br />
32 CFR part 170 CMMC Program rule. <br />
Several commenters simply thought the <br />
rule text too verbose and recommended <br />
rewriting the content with fewer words <br />
and simpler language or using tables to <br />
shorten the content. One comment <br />
criticized the organization of the <br />
documents.
 
Several comments addressed
 
references to documents outside the <br />
rule, or those that are incorporated by <br />
reference. One commenter asked how <br />
the DoD will recognize when revisions <br />
to documents incorporated by reference <br />
cause them to be misaligned <br />
requirements identified in this rule. <br />
Other comments requested that <br />
additional documents be incorporated <br />
by reference, such as DoD Instructions <br />
on CUI and the DISA Cloud Security <br />
Technical Reference Architecture. Some <br />
commenters complained that the page <br />
count of the rule and documents <br />
incorporated by reference was too high <br />
and asked whether contractors are <br />
expected to read them all. Two <br />
commenters objected to certain terms in <br />
the definitions section pointing to other <br />
documents as the source of the
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00069
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83160 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
definition. One further suggested that <br />
such definitions be revised to simply <br />
point to the URL of the source <br />
definition.
 
Some comments recommended
 
moving content from the new 32 CFR <br />
part 170 CMMC Program rule to the <br />
CMMC supplemental documents or <br />
changing citations to reference them <br />
rather than the NIST documents that are <br />
incorporated by reference. Another <br />
asked why the scoring methodology was <br />
incorporated into the rule, rather than <br />
incorporated by reference. One <br />
comment questioned whether the <br />
supplemental documents are truly <br />
optional, rather than required for <br />
compliance with CMMC program <br />
requirements. One comment stated a <br />
public comment period should be <br />
required for all supplemental guidance <br />
prior to final publication.
 
One commenter asked what
 
precipitated implementation of the CFR, <br />
which the DoD interpreted as a question <br />
about codification of the CMMC <br />
program in the CFR. One commenter <br />
asked whether the rulemaking process <br />
had afforded a certain group the <br />
opportunity to coordinate or comment <br />
on the rule. Another referenced the <br />
separate 48 CFR part 204 CMMC <br />
Acquisition rulemaking effort needed to <br />
implement the content of this rule and <br />
urged the DoD to consider public <br />
comments of both rules prior to their <br />
publication as final.
 
One comment specifically suggested
 
the CMMC program be implemented <br />
Government-wide. One commenter <br />
simply submitted a copy of a CMMC- <br />
related article from the February 2024 <br />
issue of National Defense Magazine and <br />
quoted or extracted from it rather than <br />
providing any specific comment or <br />
question.
 
''Response: ''The process for creating
 
Federal regulations generally has three <br />
main phases: initiating rulemaking <br />
actions, developing proposed rules, and <br />
developing final rules. A proposed rule <br />
is published for public comment prior <br />
to developing the final rule. A final rule <br />
must identify its effective date and be <br />
published 60 days prior to that date. <br />
The structure and formatting <br />
requirements for proposed and final <br />
rules and the process for submitting <br />
public comments are prescribed by the <br />
Office of the Federal Register and OMB, <br />
respectively, and are outside of DoD’s <br />
control.
 
OMB approved publishing the CMMC
 
rule as a Proposed Rule. It has <br />
undergone a required notice-and- <br />
comment process to give the public an <br />
opportunity to submit comments. The <br />
Proposed Rule and the comments <br />
received informed the final rule. Issues
 
with the '''Federal Register '''or <br />
[http://www.regulations.gov ''www.regulations.gov '']functionality for <br />
submitting comments via attachment of <br />
pdf or other file type were raised with <br />
the appropriate help desk and resolved <br />
before conclusion of the public <br />
comment period. The public comment <br />
period for this rule permitted review <br />
and feedback from any member of the <br />
public.
 
This rule follows the format and
 
includes all sections required in OMB <br />
guidelines for formal rulemaking. The <br />
length of this rule is necessary to ensure <br />
all affected parties have sufficient <br />
information to understand and comply <br />
with the rule. '''Federal Register '''page <br />
numbers are visible when viewing the <br />
PDF version of the rule published <br />
Tuesday, December 26, 2023 (88 FR <br />
[http://www.govinfo.gov/content/pkg/FR-2023-12-26/pdf/2023-27280.pdf 89058; ''www.govinfo.gov/content/pkg/ <br />
FR-2023-12-26/pdf/2023-27280.pdf''). ]
 
Material published in the '''Federal '''
 
'''Register '''contains numerous sections, <br />
including portions that do not amend <br />
the CFR. Specifically, the preamble for <br />
this rule, is written in a summary format <br />
and is not intended to provide the <br />
detailed information that is in the <br />
regulatory text.
 
DoD declines to delete reserved
 
sections because the editorial standard <br />
for orderly codification is that for every <br />
(a) there must be at least a (b), and for <br />
every (1) there must be at least a (2), etc. <br />
‘‘Reserved’’ meets this standard when <br />
there is no additional text required. The <br />
DoD declined to make other <br />
administrative changes, because the <br />
recommendations did not result in a <br />
substantive change.
 
One commenter correctly identified
 
that the initial 32 CFR part 170 CMMC <br />
Program proposed rule included <br />
discussion and analysis of comments <br />
made against prior publication of a 48 <br />
CFR CMMC interim final rule. The <br />
decision to include that material was <br />
made for the public’s convenience and <br />
to facilitate greater understanding of the <br />
32 CFR part 170 CMMC Program <br />
proposed rule and the CMMC Program. <br />
Codification of the CMMC Program <br />
requires publication of both the 32 CFR <br />
part 170 CMMC Program final rule and <br />
the 48 CFR part 204 CMMC Acquisition <br />
final rule. Each of those final rules will <br />
include a discussion and analysis of <br />
public comments received during their <br />
respective comment periods. The DoD <br />
CIO worked in conjunction with <br />
OUSD(A&amp;S) to ensure that the 32 CFR <br />
part 170 CMMC Program rule and the 48 <br />
CFR part 204 CMMC Acquisition rule <br />
are in sync.
 
The preamble is not regulatory text.
 
The preamble includes a response to the <br />
significant, relevant issues raised in <br />
previous public comments on the
 
original CMMC program. DoD declines <br />
to adopt recommendations to move <br />
content from the 32 CFR part 170 <br />
CMMC Program rule to the <br />
supplemental documents, which are not <br />
codified. As such, the supplemental <br />
documents are provided for optional <br />
use, and the regulatory text takes <br />
precedence. The CMMC Assessment <br />
Process (CAP) guidance is a product of <br />
the Accreditation Body and is not <br />
codified in the CFR as part of the CMMC <br />
rule, and the regulatory text in part 170 <br />
takes precedence.
 
Comments on the CMMC
 
Supplemental Guidance were received <br />
as part of the public comment period <br />
review. Final versions of these <br />
documents were published with this <br />
rule. Other supplemental materials <br />
published by the Accreditation Body do <br />
not convey government direction and <br />
are therefore do not require rulemaking. <br />
Supplemental documents (''e.g., ''CMMC <br />
assessment and scoping guides) are not <br />
codified in the CFR as part of the <br />
regulatory text. To codify CMMC <br />
program requirements, content must be <br />
included in the 32 CFR part 170 CMMC <br />
Program rule text. DoD developed the <br />
CMMC Assessment Guides to provide <br />
supplemental information to the public <br />
offering added clarity on the intent of <br />
the NIST SP 800–171A Jun2018 and <br />
NIST SP 800–172A Mar2022 guides. <br />
The CMMC Assessment Guides are <br />
particularly important for security <br />
requirements with organization-defined <br />
parameters (ODPs) (''e.g., ''CMMC Level <br />
3). There is no requirement to use the <br />
supplemental guidance documents.
 
Office of the Federal Register (OFR)
 
regulations, at 1 CFR part 51, govern the <br />
IBR process. IBR is only available if the <br />
applicable regulations are published in <br />
the '''Federal Register '''and codified in the <br />
CFR. When incorporated by reference, <br />
this material has the force and effect of <br />
law, as do all regulations published in <br />
the '''Federal Register '''and codified in the <br />
CFR. 1 CFR part 51 requires the <br />
specification of a revision to a standard, <br />
for example NIST SP 800–171, <br />
''Protecting Controlled Unclassified <br />
Information in Nonfederal Systems and <br />
Organizations, ''Revision 2, February <br />
2020 (includes updates as of January 28, <br />
2021), which is incorporated by <br />
reference in this rule. The DoD will <br />
determine when to update this rule after <br />
documents incorporated by reference <br />
have been revised. Per OFR guidance, <br />
§ 170.4 points to other sections of part <br />
170 where applicable and repeats <br />
definitions for terms incorporated by <br />
reference.
 
Contractors complying with CMMC
 
requirements need to be familiar with <br />
those documents that are incorporated
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00070
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83161 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
by reference. The definition of <br />
subcontractor is not incorporated by <br />
reference, but rather points to a <br />
definition codified in 48 CFR 3.502–1, <br />
as recommended in OMB guidelines for <br />
formal rulemaking. DoD has determined <br />
that the Defense Information Systems <br />
Agency’s Cloud Security Technical <br />
Reference Architecture does not meet <br />
the criteria for approved IBR material. <br />
However, the rule has been updated to <br />
use a different definition for Cloud <br />
Service Provider. The requirements of <br />
NARA’s CUI program (32 CFR part <br />
2002) and DoD’s implementing policies <br />
for identifying and managing CUI are <br />
beyond the scope of the CMMC rule.
 
The CFR is the codification of the
 
Federal Government’s rules and <br />
regulations published in the '''Federal <br />
Register'''. The CFR was created with the <br />
passage of the Federal Register Act and <br />
amended in 1937 to provide a <br />
‘‘codification’’ of all regulations at least <br />
once a year. The CFR reflects the tenet <br />
that the Federal Government must <br />
follow an open public process when <br />
rulemaking.
 
Due to the broad application of
 
CMMC requirements for DoD <br />
acquisition support by the defense <br />
industrial base, the Department <br />
determined that codifying the CMMC <br />
Program and its associated requirements <br />
in 32 CFR part 170 CMMC Program rule <br />
(for national defense and security) was <br />
needed in conjunction with the <br />
corresponding DFARS contractual <br />
requirements codified in 48 CFR part <br />
204 CMMC Acquisition rule.
 
The DoD has no authority to make
 
CMMC a Federal-wide program. The <br />
notice of the required CMMC level is <br />
provided at time of solicitation. This <br />
does not prohibit contractors from <br />
pursuing CMMC assessments prior to <br />
receipt of a solicitation.
 
DoD declines to comment on the
 
reposting of information being reported <br />
in the media.
 
''32. Administrative Changes to Terms, <br />
References and Notations ''
 
''Comment: ''Over 160 comments asked
 
for clarification of terminology or the <br />
addition, removal, or modification of a <br />
definition. Most requests focused on <br />
Security Protection Data and Assets, <br />
Senior Officials, Information System, <br />
External Service Providers, Cloud <br />
Service Providers, Managed Support <br />
Providers, Internet of Things, CMMC <br />
Security Requirements, Organization <br />
Seeking Assessment, and Organization <br />
Seeking Certification. Numerous <br />
comments recommended the following <br />
terms could be clarified, expanded, or <br />
defined: ‘‘Defense Industrial Base’’, <br />
‘‘personal information’’, ‘‘contractor’’,
 
‘‘sub-contractor’’, ‘‘Prime Contractor’’, <br />
‘‘equipment’’, ‘‘contractor information <br />
system’’, ‘‘Information System’’, <br />
‘‘system’’ ‘‘Information Resource’’, <br />
‘‘CMMC Approved Training Materials <br />
(CATM)’’, ‘‘CMMC Certified Instructor <br />
(CCI)’’, ‘‘Provisional Instructor (PI)’’, <br />
‘‘cyber incident’’, ‘‘Accreditation Body’’, <br />
‘‘Assessment Findings Report’’, <br />
‘‘Organizationally-Defined’’, <br />
‘‘Organizationally-Defined Parameter <br />
(ODP)’’, ‘‘Periodically’’, ‘‘Risk <br />
Assessment’’, ‘‘Risk Analysis’’, <br />
Supervisory Control’’, Data <br />
Acquisition’’, ‘‘Operationally Critical <br />
Support’’, ‘‘System Security Plan <br />
(SSP)’’, ‘‘TTP’’, ‘‘CMMC’’, ‘‘COTS’’, <br />
‘‘NARA’’,’’C3PAO’’ ‘‘IS’’, NSS’’, <br />
‘‘Technology Asset’’, ‘‘Personnel <br />
Assets’’, ‘‘Asset Categories’’, ‘‘DIBCAC <br />
High’’, and ‘‘Enterprise’’.
 
''Response: ''All requests for changes to
 
terminology definitions, references, and <br />
usage have been reviewed. In response, <br />
many terms were updated in § 170.4 <br />
Acronyms and definitions. The DoD <br />
determined those terms that were not <br />
changed to be sufficiently defined and <br />
appropriately referenced, and the <br />
requested administrative changes would <br />
not have resulted in a substantive <br />
change.
 
a. SPA/SPD/Asset
 
''Comment: ''Numerous comments asked
 
the DoD to expand on the definition, <br />
explanation, and guidance for Security <br />
Protection Data (SPD) and Security <br />
Protection Assets (SPA). Several other <br />
comments requested that the rule and <br />
supplemental documents add or expand <br />
definitions for ‘‘Asset’’, including <br />
various specific types of assets like <br />
‘‘Technology Assets’’, ‘‘Personnel <br />
Assets’’, ‘‘Organizational Assets’’ <br />
‘‘Specialized Assets’’. Some comments <br />
asked to modify the definition for <br />
‘‘Security Protection Asset’’, ‘‘CUI <br />
Asset’’, ‘‘FCI Asset’’, and ‘‘Out-of-Scope <br />
Assets’’.
 
''Response: ''The DoD modified the rule
 
to add a definition for ‘‘Security <br />
Protection Data (SPD).’’ The DoD <br />
considered the NIST definitions for <br />
‘‘System Information’’ and ‘‘Security <br />
Relevant Information’’ in the <br />
development of the new SPD definition. <br />
CMMC does not regulate the OSA’s <br />
SPD, but instead implements existing <br />
regulatory requirements for the <br />
safeguarding of CUI. The DoD does not <br />
agree with the statement that the ESP <br />
definition conflates SPA with CUI <br />
assets. The definition of Security <br />
Protection Assets is consistent with its <br />
application in the NIST SP 800–171 R2 <br />
abstract. The phrase ‘‘FCI Assets are part <br />
of the Level 1 CMMC Assessment Scope <br />
and are assessed against all CMMC
 
Level 1 requirements’’ was removed <br />
from the rule. The DoD declined to <br />
rephrase the term ‘‘CUI Assets.’’ The <br />
DoD reviewed the recommended edit <br />
and declined to make an update to <br />
‘‘Out-of-Scope Assets.’’ The definition, <br />
as written, provides a clear distinction <br />
with Security Protection Assets (SPAs).
 
b. Senior Official
 
''Comment: ''Several comments asked
 
for additional definition or guidance <br />
about the Senior Official role.
 
''Response: ''The DoD modified the rule
 
to replace all references to the ‘‘Senior <br />
Official’’ with ‘‘Affirming Official’’ and <br />
provided additional clarity on this term. <br />
It is beyond the purview of the DoD to <br />
define technical qualifications for an <br />
OSA Affirming Official.
 
c. ESP/CSP/MSP
 
''Comment: ''Some comments asked for
 
additional clarification of the terms <br />
related to External Service Providers <br />
(ESPs) and Cloud Service Providers <br />
(CSPs). Two comments requested the <br />
rule add a definition and acronym for <br />
‘‘Managed Service Provider’’.
 
''Response: ''The DoD received
 
numerous comments about the use of <br />
ESPs which do not process, store, or <br />
transmit CUI. In response to these <br />
comments, the DoD modified the rule to <br />
reduce the assessment burden on ESPs. <br />
An ESP that utilizes staff augmentation, <br />
where the OSA provides all processes, <br />
technology, and facilities, does not <br />
require a CMMC assessment. The rule <br />
was also updated to add a definition of <br />
‘‘CSP’’ that is based on the NIST SP <br />
800–145 Sept2011 definition of cloud <br />
computing. The term ‘‘Managed Service <br />
Provider’’ is not used in the rule; <br />
therefore, the acronym was removed <br />
from § 170.4.
 
d. IoT/OT/ICS
 
''Comment: ''Several comments
 
recommended DoD clarify the definition <br />
of IoT, OT, and ICS. Regarding IoT, one <br />
comment requested the rule specify that <br />
the exchange of data and information <br />
between devices occurs over the <br />
internet.
 
''Response: ''As specified in the rule,
 
IoT, IIoT, and OT, are Specialized <br />
Assets, and all requirements associated <br />
with Specialized Assets apply to any <br />
equipment that processes, stores, or <br />
transmits CUI but is unable to be fully <br />
secured. The description of Internet of <br />
Things (IoT) in the level 2 and level 3 <br />
Scoping Guides is consistent with the <br />
definition of IOT in § 170.4 and is <br />
defined in NIST SP 800–172A Mar2022. <br />
Scoping Guide text also provides <br />
examples to help clarify what types of <br />
devices may be IoT. The definition of
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00071
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83162 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
OT is from NIST SP 800–60 V2R1 and <br />
the definition of ICS is from NIST SP <br />
800–82r3. Requests for revisions to <br />
these definitions should be addressed to <br />
NIST. OSAs determine the asset <br />
categories and assessment scope based <br />
on how and where they will process, <br />
store, and transmit FCI and CUI. The <br />
DoD declined to comment on individual <br />
use cases included in the comments.
 
e. Program and Security Requirements
 
''Comment: ''Two comments asked for a
 
definition of ‘‘Security Requirements’’ <br />
while another asked for the DoD to <br />
define the term ‘‘CMMC Program <br />
requirements’’ in the rule. Three <br />
comments addressed concerns with the <br />
CMMC security practices numbering <br />
scheme in §§ 170.14(c)(i). One comment <br />
requested clarification on what <br />
constitutes a ‘‘priority’’ program. <br />
Another commenter stated the term ‘‘all <br />
applicable CMMC security <br />
requirements’’ is ambiguous and many <br />
OSAs will only attest to fulfilling the <br />
FAR 52.204–21 or NIST SP 800–171 R2 <br />
security requirements. The commenter <br />
felt this could lead to a significant <br />
disconnect at CMMC Level 2 since Level <br />
2 includes security requirements <br />
associated with the use of ESPs, as <br />
defined in DFARS clause 252.204–7012 <br />
paragraphs (''e.g., ''para (b)(2)(ii)(D)) and <br />
the DoD CIO FedRAMP Equivalency <br />
memorandum.
 
''Response: ''CMMC Program
 
requirements are all the requirements <br />
codified in the 32 CFR part 170 CMMC <br />
Program rule. The term ‘‘CMMC <br />
Security Requirements’’ is defined in <br />
§ 170.14(c). The CMMC supplemental <br />
guidance documents add clarity; <br />
however, they are not authoritative and <br />
the rule itself takes precedence. The <br />
CMMC numbering scheme in the rule is <br />
a key element of the model that must <br />
pull together the independent <br />
numbering schemes of FAR clause <br />
52.204–21 (for Level 1), NIST SP 800– <br />
171 R2 (for Level 2), and NIST SP 800– <br />
172 Feb2021 (for Level 3). For the <br />
CMMC Program, the numbering scheme <br />
must also identify the domain and <br />
CMMC Level of each security <br />
requirement. The term ‘‘priority <br />
program’’ is not used in the rule; <br />
therefore, no definition of this term is <br />
needed. A commenter incorrectly <br />
associated CMMC Program requirements <br />
as CMMC security requirements. To <br />
address potential confusion, the rule <br />
was updated to define ‘‘CMMC security <br />
requirements’’ as the 15 Level 1 FAR <br />
requirements, the 110 NIST SP 800–171 <br />
R2 requirements, and the 24 selected <br />
NIST SP 800–172 Feb2021 <br />
requirements.
 
f. OSA and OSC
 
''Comment: ''Several comments
 
requested clarification of the terms OSA <br />
and OSC. One recommended combining <br />
them into a single term.
 
''Response: ''The definitions of
 
Organization Seeking Assessment (OSA) <br />
and Organization Seeking Certification <br />
(OSC) are provided in § 170.4. It is <br />
important to note that OSC is a sub-set <br />
of OSA.
 
g. Process, Store, or Transmit
 
''Comment: ''Several comments asked
 
about use of the term, ‘‘Process, store or <br />
transmit’’. One asked about its <br />
application to a turnkey cloud based <br />
CMMC solution and whether the intent <br />
was to consider ‘‘access’’ a subset of <br />
‘‘process’’. Another recommended using <br />
the term ‘‘Handle’’ in lieu of this term <br />
and noted that this would also require <br />
amendments to DFARS clause 252–204– <br />
7012. Another comment recommended <br />
rephrasing the definition to provide <br />
clarity while another asked that the <br />
definition of ‘‘Process, store, or <br />
transmit’’ (§ 170.4(b)) explicitly include <br />
residence of data in memory, which has <br />
not previously been identified in this <br />
context and could raise interpretation <br />
issues.
 
''Response: ''The phrase ‘‘process, store,
 
or transmit’’ is more specific than the <br />
term ‘‘handle’’ and is consistent with <br />
DoD contract requirements for Non- <br />
Federal Information systems as <br />
specified in DFARS clause 252.204– <br />
7012. The DoD intended ‘‘Access’’ to be <br />
included in the ‘‘Process, store, or <br />
transmit definition as written in <br />
§ 170.4(b). An organization offering a <br />
turnkey cloud based CMMC solution <br />
would be considered an ESP by this <br />
rule, and the rule was updated to <br />
address assessment and certification <br />
requirements of ESPs. The rule <br />
definitions are provided for additional <br />
clarity of the terms included in the rule <br />
and does not nor cannot include every <br />
potential instance of the term’s <br />
application to a contractor’s information <br />
systems.
 
h. Clarification of Definitions for FCI <br />
and CUI
 
''Comment: ''Three comments requested
 
clarification of and noted inconsistency <br />
between the terms ‘‘FCI’’ and ‘‘CUI’’. <br />
One perceived ‘‘[FCI]’’ and ‘‘[CUI]’’ as <br />
new acronyms and asked why this rule <br />
includes them. One comment noted the <br />
inconsistent use of the terms ‘‘CUI and <br />
FCI’’ and ‘‘sensitive unclassified <br />
information’’ and recommended <br />
selecting one term for use throughout <br />
the rule. Another comment requested <br />
definitions for CMMC be distinguished <br />
with formatting or another notation.
 
''Response: ''FCI is defined in FAR
 
clause 52.204–21. The definition of CUI <br />
and general requirements for its <br />
safeguarding are included in 32 CFR <br />
2002.4 and 2002.14, respectively. CUI is <br />
not a new acronym. The notation <br />
‘‘[FCI]’’ is identified in table 2 to <br />
§ 170.15(c)(1)(ii) to reflect its alignment <br />
to the requirements of FAR clause <br />
52.204–21 for basic safeguarding of <br />
information. Similarly, ‘‘[CUI]’’ has been <br />
added to reflect the use of those <br />
requirements for CMMC Level 2, which <br />
is designed to protect CUI, not FCI. The <br />
DoD amended the rule such that <br />
‘‘sensitive unclassified information’’ <br />
will consistently be replaced with ‘‘FCI <br />
and/or CUI’’ as appropriate.
 
i. Use of Terms Information and Data
 
''Comment: ''One comment noted the
 
terms ‘‘data’’, ‘‘technical data’’, and <br />
‘‘information’’ are used synonymously <br />
throughout the rule and supplemental <br />
documents. They also noted that neither <br />
NARA’s CUI Registry nor the NIST SP <br />
800–171 R2 define the word <br />
‘‘information’’ and asserted this was a <br />
major oversight by NARA ISOO, the CUI <br />
Program Executive Agent. The <br />
commenter requested this rule adopt the <br />
term ‘‘Information’’ throughout the rule <br />
and only use ‘‘data’’ when specifically <br />
intended based on its definition. <br />
Another commenter requested the term <br />
‘‘Technical Data’’ be replaced with the <br />
term ‘‘Information’’.
 
''Response: ''As a commenter stated,
 
both the CUI program and NIST use the <br />
term ‘‘information’’. Suggestions that <br />
the DoD work with NARA or NIST to <br />
define this term are outside the scope of <br />
this rule. Within this rule, data <br />
generally refers to individual facts, such <br />
as those submitted to eMASS or SPRS; <br />
however, data and information may be <br />
used interchangeably. DoD declined to <br />
make requested administrative edits <br />
because they would not result in a <br />
substantive change.
 
j. Source Materials Incorporated by <br />
Reference
 
''Comment: ''Four comments asked for
 
clarification of those documents <br />
incorporated by reference, or the <br />
specific versions of documents <br />
referenced in the rule.
 
''Response: ''The DoD declined to
 
incorporate by reference the <br />
Department’s role as data owner. NIST <br />
SP 800–53 R5 was incorporated by <br />
reference only for use with applicable <br />
definitions because it provided the <br />
latest definitions available.
 
The OSA is responsible for
 
determining its CMMC Assessment <br />
Scope and its relationship to security <br />
domains. Assets are out-of-scope when
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00072
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83163 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
they are physically or logically <br />
separated from the assessment scope. <br />
Contractor Risk Managed Assets are <br />
only applicable within the OSA’s <br />
assessment scope. Table 3 to <br />
§ 170.19(c)(1) is used to identify the <br />
asset categories within the assessment <br />
scope and the associated requirements <br />
for each asset category. Contractor’s <br />
risk-based security policies, procedures, <br />
and practices are not used to define the <br />
scope of the assessment, they are <br />
descriptive of the types of documents an <br />
assessor will use to meet the CMMC <br />
assessment requirements.
 
To ensure the source of every
 
definition is accounted for, the terms in <br />
§ 170.4 either cite a reference or are <br />
designated as CMMC-custom using the <br />
notation ‘‘(CMMC-custom term).’’ The <br />
rule has been updated to eliminate the <br />
CNSS Glossary definitions and replaced <br />
them with appropriate NIST definitions.
 
k. Miscellaneous Other Terms, <br />
References and Notations
 
''Comment: ''Three comments asked
 
about references to the DoD Manual <br />
8570, ‘‘Information Assurance <br />
Workforce Improvement Program,’’ and <br />
one asked if the references should be <br />
replaced by the newer DoD Manual <br />
8140.
 
One commenter suggested DoD add
 
an enhanced definition of ‘‘Security <br />
Domain’’ domain to the glossary.
 
One questioned use of the CNSSI–
 
4009 Glossary instead of the NIST <br />
Glossary of Terms. One comment <br />
requested a change to text quoted from <br />
another source. One commenter asserted <br />
that the rule includes no reference to <br />
‘‘existing FAR, DFARS, or DoD <br />
authoritative sources’’ and <br />
recommended that they be added in <br />
instead referencing NIST publications <br />
only.
 
One comment asked if it is necessary
 
to read and understand all FIPS, NIST <br />
SP 800, CNSSI, and ISO/IEC documents <br />
incorporated by referenced in § 170.2. <br />
One comment requested the references <br />
for CMMC Assessment Guides in <br />
Appendix A be changed to NIST SP <br />
800–171A Jun2018 and NIST SP 800– <br />
172A Mar2022. Two comments noted <br />
version numbers are not always <br />
provided for two specific document <br />
sources. Another comment requested <br />
references for supporting information, <br />
resources, and training for the DIB.
 
A commenter asked if the term
 
‘‘Government Information Systems’’ was <br />
equivalent to the term ‘‘Federal <br />
Information Systems’’ while another <br />
expressed that the term, ‘‘CMMC Level <br />
2 Final Certification Assessment was <br />
confusing given that ‘‘Assessment’’ and <br />
‘‘Certification’’ are two separate and
 
distinct terms. Another comment noted <br />
that the Summary Information section <br />
states there is a difference between a <br />
POA and a POA&amp;M but recommended <br />
both terms be defined for clarity.
 
One comment stated the ‘‘CMMC
 
Certified Assessor (CCA)’’ definition <br />
and acronym are not used consistently <br />
in the rule and the current CMMC AB’s <br />
website. Another comment noted that <br />
the term, ‘‘related practitioners’’ under <br />
the definition of CAICO in § 170.4 could <br />
be confused with the term ‘‘Registered <br />
Practitioners (RP)’’ used by the CMMC <br />
AB as their designation for consultants.
 
One comment stated that the DoD
 
must be deliberate in its use of certain <br />
terms, especially the words ‘‘must’’ and <br />
‘‘shall’’, which connote legal <br />
requirements, versus words like ‘‘will’’, <br />
‘‘expected’’, ‘‘can’’, ‘‘may’’, ‘‘should’’, <br />
etc., which are permissive (''i.e., <br />
''optional)
 
One commenter noted the word
 
‘‘practice’’ was replaced multiple times <br />
based on a comparison of pre- <br />
publication drafts with the formal drafts <br />
that were published for public <br />
comment.
 
Another comment asserted that the
 
DoD is falsely describing the CMMC <br />
program as addressing ‘‘basic’’ <br />
cybersecurity requirements when this is <br />
the most demanding cybersecurity <br />
standard ever produced.
 
One commenter objected to the
 
CMMC Level 1, 2, and 3 Assessment <br />
definitions in § 170.4 referring to the <br />
content of corresponding rule sections <br />
and suggested that the definitions be <br />
deleted from § 170.4 unless they can be <br />
succinctly defined without doing so.
 
''Response: ''The rule has been updated
 
to reference DoD Manual 8140 <br />
‘‘Cyberspace Workforce Qualification <br />
and Management Program’’ which <br />
replaced DoD Manual 8570, <br />
‘‘Information Assurance Workforce <br />
Improvement Program.’’ DOD Manual <br />
8140.03 is available at: [https://dodcio.defense.gov/Portals/0/Documents/Library/DoDM-8140-03.pdf ''https://<br />
dodcio.defense.gov/Portals/0/ <br />
Documents/Library/DoDM-8140-03.pdf''. ]
 
No changes were made to quotations
 
from sources outside the rule. A <br />
definition cited from a source must <br />
exactly match the source, it cannot be <br />
altered. To address a commenter’s <br />
misperception that the rule does not <br />
reference ‘‘existing FAR/DFARS, or <br />
other DoD authoritative sources,’’ it <br />
should be noted that the CMMC <br />
proposed rule includes 54 mentions <br />
each of FAR clause 52.204–21 and <br />
DFARS clause 252.204–7012. The <br />
DFARS clause 252.204–7012 is added to <br />
DoD contracts to implement the <br />
requirements of NIST SP 800–171, <br />
which is the authoritative reference for <br />
adequate safeguarding of CUI.
 
Contractors complying with CMMC
 
need to be familiar with those <br />
documents that are incorporated by <br />
reference, which address requirement- <br />
related topics. NIST SP 800–53 R5 is <br />
incorporated by reference only for <br />
applicable definitions because DoD <br />
chose to use the latest definitions <br />
available. The purpose of a reference <br />
listed in § 170.2 should be interpreted <br />
based on the context in which it is used. <br />
For example, the references provided in <br />
§ 170.4 specify the source of the <br />
definition. The references for the CMMC <br />
Assessments Guides listed in Appendix <br />
A have been updated. These guides are <br />
largely derived from NIST SP 800–171 <br />
R2, NIST SP 800–171A Jun2018, NIST <br />
SP 800–172 Feb2021, and NIST SP 800– <br />
172A Mar2022.
 
The DoD has updated § 170.3 to align
 
with the FAR terminology and now <br />
reflects ‘‘Federal Information System’’ <br />
instead of ‘‘Government Information <br />
System’’.
 
The DoD updated the rule to reference
 
the latest version of ‘‘Cloud Security <br />
Technical Reference Architecture’’ and, <br />
where appropriate, to identify a revision <br />
number for NIST SP 800–171. Specific <br />
details of cybersecurity-related <br />
resources and training developed to <br />
support the DIB are outside the scope of <br />
this rule. As it becomes available, <br />
supporting resources and training <br />
information will be disseminated. <br />
Currently, multiple public resources are <br />
available to help educate companies on <br />
NIST and CMMC requirements.
 
The DoD declined to respond to
 
comments based on comparison of pre- <br />
publication draft versions of the <br />
supplemental guidance documents.
 
A commenter’s claim that DoD views
 
the CMMC program as only addressing <br />
‘‘basic cybersecurity’’ is incorrect. <br />
Throughout the rule, references to <br />
‘‘basic safeguarding’’ mean the <br />
requirements of CMMC Level 1, which <br />
align directly to the requirements of <br />
FAR clause 52.204–21. That FAR clause <br />
is titled ‘‘Basic Safeguarding of Covered <br />
Contractor Information Systems’’. <br />
Similarly, the CMMC program <br />
establishes a CMMC Level 3 <br />
requirement to comply with a subset of <br />
requirements from NIST SP 800–172 <br />
Feb2021, titled, ‘‘Enhanced Security <br />
Requirements for Protecting Controlled <br />
Unclassified Information.’’
 
Section 170.4 includes acronyms and
 
definitions used in the rule text. Terms <br />
from other authoritative sources are <br />
listed in § 170.4 and are properly <br />
sourced. 1 CFR part 51 governs drafting <br />
of this rule.
 
The DoD updated the rule throughout
 
to reflect new terminology better <br />
differentiating between the activity of
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00073
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83164 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
undergoing an assessment and the <br />
CMMC Status that may result from that <br />
activity. An OSA undergoes one of the <br />
following: Level 1 self-assessment; Level <br />
2 self-assessment; Level 2 certification <br />
assessment; or Level 3 certification <br />
assessment. The result of that <br />
assessment activity is either failure to <br />
meet minimum requirements or one of <br />
the following CMMC Statuses: Final <br />
Level 1 (Self); Conditional Level 2 (Self); <br />
Final Level 2 (Self); Conditional Level 2 <br />
(C3PAO); Final Level 2 (C3PAO); <br />
Conditional Level 3 (DIBCAC); or Final <br />
Level 3 (DIBCAC).
 
The official DoD acronym for CCA is
 
‘‘CMMC Certified Assessor,’’ as <br />
addressed in § 170.4. All CMMC terms <br />
and definitions provided in this 32 CFR <br />
part 170 CMMC Program rule are <br />
codified and therefore take precedence <br />
over definitions and acronym usage <br />
from the CMMC website or other <br />
sources.
 
To avoid confusion in the ecosystem
 
with the term ‘‘practitioner’’, the DoD <br />
modified the definition in § 170.4 to <br />
replace the word ‘‘practitioners’’ with <br />
‘‘professionals.’’
 
While ‘‘must’’ is a more commonly
 
used term than ‘‘shall’’, both terms <br />
impose a requirement as defined in FAR <br />
2.101 Definitions.
 
''33. Rule Text Modifications ''
 
a. Changes to the Preamble
 
''Comment: ''One commenter
 
recommended that the supplemental <br />
Assessment Guides be consolidated <br />
with and cross referenced to <br />
requirements for the CMMC Levels in <br />
the same document. Eighty-three <br />
comments requested changes to the <br />
preamble section of the rule text. Of <br />
those, 17 were incorporated and are <br />
summarized below.
 
''Writing Style: ''Multiple commenters
 
wanted shorter, simpler, and more <br />
focused wording starting with changes <br />
to the first sentence in the Summary <br />
section.
 
Word Choices: In the ‘‘CMMC 2.0
 
Overview as Proposed by this Rule’’ <br />
section several comments objected to <br />
the description of FAR clause 52.204–21 <br />
requirements as ‘‘elementary’’ or <br />
‘‘basic’’. One comment asserted that <br />
‘‘may’’ is not the correct verb for <br />
‘‘Defense contracts . . . may include <br />
applicable requirements . . . ,’’. One <br />
comment suggested the preamble <br />
sentence ‘‘Once CMMC is implemented, <br />
the required CMMC level for contractors <br />
will be specified in the solicitation,’’ be <br />
revised to use wording that is more <br />
consistent with other parts of the <br />
preamble and rule text. One commenter <br />
proposed edits to remove passive voice
 
from a sentence in the preamble <br />
description of Key Changes <br />
Incorporated in the Revised CMMC <br />
Program. One commenter requested a <br />
change to reference the relevant DFARS <br />
clause 252.204–7012, rather than the <br />
DFARS subpart 204.73.
 
''Clarifications: ''Two comments
 
asserted that the description of <br />
affirmations requirement could be mis- <br />
interpreted as suggesting that primes <br />
and subcontractors all submit a single <br />
affirmation or that one contractor must <br />
affirm another’s continuing compliance. <br />
One comment requested clarification <br />
about FedRAMP requirements for Cloud <br />
Service Providers. Some comments <br />
asked whether POA&amp;Ms must be <br />
documented in the System Security <br />
Plan. One comment recommended <br />
punctuation and grammatical edits and <br />
asked for clarification of rule text that <br />
discusses the impact of not logically or <br />
physically separating contractor-owned <br />
information systems that process, store, <br />
or transmit FCI (or CUI) from those that <br />
do not.
 
''Response: ''This rule follows the
 
format and includes all sections <br />
required in OMB guidelines for formal <br />
rulemaking. The DoD lacks authority to <br />
modify the template or omit required <br />
sections, as requested by some <br />
commenters. In addition, one <br />
commenter recommended that the <br />
supplemental Assessment Guides be <br />
consolidated with and cross referenced <br />
to requirements for the CMMC Levels in <br />
the same document. The DoD <br />
interpreted this recommendation as a <br />
request to integrate all information in <br />
the supplemental guidance into the rule <br />
text, which does not align with <br />
rulemaking guidelines (1 CFR part 51). <br />
No changes were made to consolidate or <br />
integrate the supplemental guidance <br />
documents, which are not codified and <br />
are provided as optional resources to <br />
assist OSAs. The regulatory content in <br />
the 32 CFR part 170 CMMC Program <br />
rule takes precedence.
 
Some commenters criticized the
 
preamble summary paragraph, and one <br />
submitted a preferred rewrite that <br />
oversimplified the content so far as to <br />
alter the intended meaning. For that <br />
reason, the specific revisions were not <br />
incorporated. However, the DoD has <br />
revised the final rule to begin with a <br />
simplified statement of its purpose, as <br />
follows: ‘‘With this final rule, DoD <br />
establishes a scalable way to verify, <br />
through assessment, that contractors <br />
have implemented required security <br />
measures necessary to safeguard DoD’s <br />
Federal Contract Information (FCI) and <br />
Controlled Unclassified Information <br />
(CUI)’’.
 
The DoD strove to streamline the
 
writing style. Note that the preamble is <br />
not part of the regulatory text, however, <br />
it is a required part of the rulemaking <br />
template. The DoD made the following <br />
changes to the preamble based on <br />
requests for text modifications.
 
The preamble is updated to change
 
the verb ‘‘will’’ to ‘‘should’’, where <br />
appropriate. The preamble and <br />
regulatory text have been updated to <br />
clarify that a Plan of Action need not be <br />
part of the System Security Plan. The <br />
sentence in the preamble overview <br />
about FAR clause 52.204–21 <br />
requirements has been rewritten to <br />
describe them as ‘‘the minimum <br />
necessary’’ to receive FCI, rather than <br />
describing them as ‘‘elementary’’ for <br />
‘‘basic’’ cybersecurity. Note that the title <br />
of the FAR clause 52.204–21 clause is <br />
Basic Safeguarding Requirements.
 
A preamble overview paragraph about
 
Affirming Officials is revised to clarify <br />
that CMMC affirmations shall be <br />
submitted by the OSA and apply only <br />
to the information systems of that <br />
organization. DoD’s use of the term OSA <br />
within the affirmations section is <br />
deliberate and conveys that each <br />
organization is responsible for <br />
affirmations pertaining to their own <br />
assessments. A preamble overview <br />
paragraph about Cloud Service <br />
Providers has been aligned to DFARS <br />
clause 252.204–7012 language and <br />
specifies that defense contractors must <br />
confirm that any CSPs they use to <br />
handle CUI must meet FedRAMP <br />
Moderate Baseline standards. Wording <br />
in the preamble overview of the rule has <br />
been edited from ‘‘may include’’ to <br />
‘‘require’’, to clarify a statement about <br />
when DFARS clause 252.204–7012 <br />
applies. One sentence in the preamble <br />
about the regulatory impact of CMMC <br />
Requirements has been edited into two <br />
sentences to make clear that <br />
solicitations identify CMMC contract <br />
requirements, rather than ‘‘for <br />
contractors’’, and that only contractors <br />
handling FCI or CUI must meet the <br />
specified CMMC requirements.
 
The DoD has incorporated a suggested
 
re-wording to simplify the description <br />
of CMMC Level 2 assessments in the <br />
preamble paragraph describing Key <br />
Changes Incorporated in the Revised <br />
CMMC Program.
 
b. Changes to the Regulatory Text
 
''Comment: ''Of the 52 comments that
 
requested changes to the regulatory text <br />
(§§ 170.1 through 170.24), the nine <br />
which DoD incorporated are <br />
summarized below.
 
''Word choices: ''In § 170.1(b), two
 
comments posited that the word <br />
‘‘enhance’’ is inaccurate in the phrase
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00074
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83165 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
‘‘The CMMC Program is designed to <br />
enhance protection of FCI and CUI <br />
. . .’’. In § 170.9(a) one comment noted <br />
that C3PAOs do not ‘‘grant’’ <br />
assessments, they ‘‘conduct’’ them. <br />
Another asked why, in table 3 to <br />
§ 170.19(c)(1), the CUI Asset category <br />
needs to be assessed against ‘‘CMMC <br />
security requirements’’ but in table 5 to <br />
§ 170.19(d)(1), the same category is <br />
assessed against ‘‘all CMMC security <br />
requirements.’’ For § 170.4(b) One <br />
comment requested appending ‘‘and to <br />
the DoD’’ to the definition of <br />
Assessment Findings Report.
 
Paragraph Organization: For
 
Applicability, a comment recommended <br />
changing the order of paragraphs in <br />
§ 170.3 and other text changes to <br />
improve clarity.
 
''Reference: ''One comment noted that
 
the § 170.6(b) phrase ‘‘as provided for <br />
under DFARS clauses 252.204–7012 and <br />
7020 . . .’’ is in error because the <br />
section describes CMMC PMO <br />
responsibilities and only DFARS clause <br />
252.204–7020 references DIBCAC <br />
assessments of OSAs.
 
''Redundancy: ''One comment asserted
 
that § 170.9(b)(9) and § 170.9(b)(20) are <br />
redundant as both describe that <br />
assessment appeals and results are <br />
entered into eMASS.
 
''Consistency: ''One comment pointed
 
out an inconsistency between the text in <br />
§ 170.18(c)(1)(i) and the Scoping Guide <br />
related to whether a CMMC Level 3 <br />
Assessment Scope must be the same as, <br />
or may be a subset of, the Assessment <br />
Scope of the prerequisite CMMC Level <br />
2 certification.
 
''Clarifications: ''One comment asked
 
whether the stipulation that CCIs must <br />
not disclose CMMC data or metrics <br />
applies to all data or only ‘‘non-public’’ <br />
data.
 
Consistency: One commenter asked
 
for clarification regarding templates and <br />
formats required for information <br />
uploaded into the CMMC instantiation <br />
of eMASS.
 
''Response: ''The DoD has incorporated
 
a request to delete the word ‘‘enhance’’ <br />
from § 170.1(b), and the purpose of the <br />
CMMC Program now reads that the <br />
CMMC Program is designed as a <br />
compliance assessment to assist in <br />
DoD’s enforcement of information <br />
safeguarding requirements. Lower level <br />
paragraphs in § 170.3 have been <br />
reordered for added clarity.
 
The words ‘‘and to the DoD via
 
CMMC eMASS’’ have been added to the <br />
end of the Assessment Findings Report <br />
definition in § 170.4(b). In addition, <br />
§ 170.9(b)(17) has been rephrased to <br />
stipulate that all assessment data and <br />
information uploaded into the CMMC <br />
instantiation of eMASS must be
 
compliant with the data standard <br />
provided in the eMASS CMMC <br />
Assessment Import Templates available <br />
on the CMMC eMASS website.
 
The DoD replaced the word
 
‘‘granting’’ with the word ‘‘conducting’’ <br />
in the description of C3PAO <br />
assessments in § 170.9(a). Sections <br />
170.9(b)(9) and (b)(20) have been <br />
modified to eliminate redundancy <br />
between the two paragraphs, however <br />
the DoD did not concur that <br />
§§ 170.9(b)(17) and (18) are redundant <br />
and made no change.
 
Section 170.18(c)(1)(i) was revised to
 
clarify that the CMMC Assessment <br />
Scope for Level 3 must be equal to or <br />
a subset of the CMMC Assessment <br />
Scope for the Level 2 certification <br />
assessment of the system in question. <br />
Section 170.19 was revised to clarify <br />
that, for CMMC Level 2, OSAs will be <br />
assessed against all Level 2 <br />
requirements. For CMMC Level 3, OSAs <br />
will be assessed against all Level 2 and <br />
Level 3 requirements.
 
Section 170.1 has been revised to
 
correct punctuation and improve <br />
grammar. The section now conveys <br />
more clearly that the CMMC Program is <br />
designed as a compliance assessment to <br />
assist in DoD’s enforcement of <br />
information safeguarding requirements. <br />
No changes were made regarding use of <br />
‘‘not logically or physically isolated <br />
from all such CUI systems’’. Specifying <br />
a CMMC Assessment Scope is a <br />
necessary preparatory step for a CMMC <br />
assessment. Assessment requirements <br />
are specified in § 170.19. At Levels 2 <br />
and 3, logical or physical isolation is the <br />
primary mechanism used to separate in- <br />
scope from out-of-scope assets. CRMA <br />
and Specialized Asset categories only <br />
apply to assets that are within the <br />
Assessment Scope or boundary.
 
§ 170.6(b) has been revised to
 
reference DFARS clause 252.204–7020 <br />
rather than DFARS clause 252.204– <br />
7012. In addition, § 170.05 was revised <br />
to reference DFARS clause 252.204– <br />
7012, rather than DFARS 204.73, for <br />
consistency and clarity.
 
The title of § 170.16(c)(1) has been
 
updated to specify self-assessment of <br />
the OSA. DoD declined to make other <br />
administrative changes because they <br />
would not result in a substantive <br />
change.
 
§ 170.12(b)(8) has been revised to
 
clarify that CCIs must not disclose <br />
CMMC data or metrics that are PPI, FCI, <br />
or CUI without prior coordination with <br />
and approval from DoD.
 
c. Changes Recommended but Not <br />
Incorporated
 
''Comment: ''Many comments addressed
 
non-substantive administrative changes
 
or writing style and were not <br />
incorporated. Many comments <br />
requested substantive changes that were <br />
not incorporated, and which are <br />
described more fully in the response <br />
below.
 
''Response: ''In addition, thirty-eight
 
other recommendations were not <br />
incorporated because they did not result <br />
in substantive changes. The DoD <br />
declines to delete references or convert <br />
narrative text explanations into tables, <br />
bullets, or other truncated formats <br />
because the intent is to facilitate reader <br />
understanding of complex requirements. <br />
Other recommended administrative <br />
changes which did not result in a <br />
substantive change were also not <br />
incorporated.
 
Other changes were not incorporated
 
because the revisions would result in <br />
unintended or inaccurate meaning of <br />
the text. The following explanation is <br />
provided for those unincorporated but <br />
substantive recommendations.
 
The DoD did not change content in
 
the Discussion of Public Comments <br />
section that addressed responses to the <br />
original 48 CFR CMMC interim final <br />
rule, because intervening rule changes <br />
made in response to public comments <br />
received about the more recent <br />
proposed rule(s) supersede text of the <br />
earlier rule.
 
Section 170.3(a)(1) applies to contract
 
awardees. While the rule may impact <br />
External Service Providers and Cloud <br />
Service providers, the rule is not <br />
directly applicable to them. CMMC <br />
requirements apply at the time of <br />
contract award and thereafter.
 
DoD declined to change the program
 
name as it is well known in the <br />
community, and the tiered approach to <br />
the model still embodies a concept of <br />
cybersecurity maturity. OSA <br />
responsibilities for complying with <br />
CMMC are provided throughout the rule <br />
and do not need to be repeated.
 
CMMC is a program that validates
 
implementation via assessment, the rule <br />
does not prescribe how to implement.
 
In the first sentence of the Summary,
 
this rule describes that the CMMC <br />
assessment mechanism will cover both <br />
existing security requirements for CUI, <br />
and new security requirements for <br />
certain programs. No additional <br />
reference is necessary in the <br />
introductory summary because the <br />
specific NIST reference documents are <br />
mentioned shortly after the summary <br />
and throughout the rule text.
 
DoD declined to revise § 170.2 to use
 
the word ‘‘competent’’ because <br />
‘‘competence’’ is the word included in <br />
the referenced ISO/IEC 17011:2017(E) <br />
Abstract.
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00075
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83166 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
The rule retains requirements to
 
provide all documentation and records <br />
in English because it is necessary for <br />
adequate program management and <br />
specifying this requirement is required <br />
to ensure clarity of interpretation.
 
The DoD has reviewed
 
§ 170.17(c)(2)(ii) and does not agree that <br />
a noun is missing. The lead-in <br />
paragraph provides the noun, and it is <br />
not necessary to repeat the phrase. The <br />
DoD disagrees that portions of <br />
§ 170.18(c)(1) are redundant and <br />
therefore did not delete the lower level <br />
paragraphs, however revisions were <br />
made to clarify that a Level 2 <br />
certification assessment is needed prior <br />
to Level 3 certification assessment.
 
Recommended edits to § 170.24(9)
 
that would change the meaning were <br />
not accepted. During the assessment <br />
process, the Lead Assessor/Assessor <br />
must view any prior DoD CIO <br />
adjudication of proposed variances to <br />
security requirements in the system <br />
security plan to ensure correct <br />
implementation and render a <br />
determination of MET if there have been <br />
no changes in the environment.
 
The DoD did not modify § 170.10 to
 
permit CCAs, CCPs, and CCIs to retrain <br />
‘‘or’’ recertify, instead of both, upon <br />
significant change to DoD’s CMMC <br />
Program requirements under this rule. <br />
The DoD disagreed with one <br />
commenter’s assertion that the summary <br />
within the preamble to the rule implies <br />
CMMC assessments address all DFARS <br />
clause 252.204–7012 requirements, <br />
therefore no edits were necessary. The <br />
rule indicates that the applicable CMMC <br />
Level 2 security requirements are those <br />
in NIST SP 800–171 R2 as implemented <br />
in DFARS clause 252.204–7012.
 
Revisions suggesting that all
 
objectives identified in NIST SP 800– <br />
171A Jun2018 need not be met are not <br />
accurate and not incorporated. Each <br />
assessment objective in NIST SP 800– <br />
171A Jun2018 must yield a finding of <br />
MET or NOT APPLICABLE for the <br />
overall security requirement to be <br />
scored as MET. Assessors exercise <br />
judgment in determining when <br />
sufficient and adequate evidence has <br />
been presented to make an assessment <br />
finding. This is consistent with current <br />
DIBCAC High Assessments and <br />
assessments conducted under the Joint <br />
Surveillance Voluntary Assessment <br />
Program (JSVAP). A security <br />
requirement can be applicable, even <br />
with assessment objectives that are N/A. <br />
The security requirement is NOT MET <br />
when one or more applicable <br />
assessment objectives is NOT MET.
 
Recommendations to address specific
 
contractual matters were not addressed, <br />
because this is a 32 CFR part 170 CMMC
 
Program rule and not an acquisition <br />
regulation. Any comments related to <br />
contract requirements should be <br />
provided in response to the 48 CFR part <br />
204 CMMC Acquisition rule.
 
The CMMC rule does not specify the
 
number of POA&amp;Ms that may be used to <br />
address one or more CMMC security <br />
requirement that were NOT MET during <br />
a CMMC assessment. The OSA may <br />
choose to use a single POA&amp;M or <br />
multiple POA&amp;Ms.
 
No edits were made to reference CCAs
 
in § 170.7, which covers responsibilities <br />
for only the DIBCAC, and not CCAs. <br />
§ 170.11 covers responsibilities for <br />
CCAs. DoD declined to add verbiage to <br />
address the potential revision or <br />
cancellation of an ISO/IEC standard <br />
because § 170.8 adequately reflects that <br />
the Accreditation Body shall achieve <br />
full compliance with revised ISO/IEC <br />
17011:2017(E) standards. Standards are <br />
not effective until published as final.
 
The DoD declined to adopt one
 
commenter’s suggestion to submit all <br />
appeals investigation materials with the <br />
final decision into eMASS, however, an <br />
updated assessment result, if any, will <br />
be input into eMASS. In addition, <br />
C3PAOs are required to retain <br />
assessment artifacts for 6 years.
 
DoD did not agree with one
 
commenter’s assertion that the preamble <br />
description of the CMMC Program is <br />
incomplete or inaccurate, or that the <br />
rule makes implicit changes to DFARS <br />
clause 252.204–7010 reporting <br />
requirements for activities subject to the <br />
U.S.-International Atomic Energy <br />
Agency Additional Protocol. The <br />
referenced paragraph, which appears <br />
both in the preamble background <br />
section and in an overview paragraph of <br />
the supplemental documents, accurately <br />
portrays the CMMC Program as a <br />
compliance assessment model to assist <br />
in DoD’s enforcement of FCI and CUI <br />
safeguarding requirements. No change <br />
has been made in either location.
 
The DoD also declines to specify in
 
the rule the DoD offices that review Tier <br />
3 background investigations or <br />
equivalency determinations. No <br />
language related to Cloud Service <br />
Offerings (CSO) was added in § 170.19 <br />
column two. Assets that process, store, <br />
or transmit CUI are handled the same <br />
way regardless of whether they are from <br />
a CSO or otherwise. Therefore, there is <br />
no need to call out CSOs in the table.
 
The DoD minimized use of the
 
passive voice to an extent in this final <br />
rule; however, in some places the <br />
passive voice is used to emphasize the <br />
action occurring rather than the <br />
individual or entity performing the <br />
action.
 
There is no version number in the
 
title of the CMMC Program. Terms such <br />
as versions 1.0 or 2.0 have previously <br />
been used in DoD’s public engagements <br />
as a colloquial way to communicate <br />
differences in content as the program <br />
has evolved. This final rule codifies the <br />
program and does include changes from <br />
the proposed rule. Only those public <br />
comments received during the 60-day <br />
comment period following the <br />
December 26, 2023 publication (88 FR <br />
89058) are addressed in this final rule.
 
''34. Error Corrections ''
 
''Comment: ''Numerous administrative
 
comments were received that addressed <br />
formatting grammar, punctuation, and <br />
typographical errors as well as word <br />
usage and acronym errors: Wording <br />
discrepancies, redundancies, and <br />
inaccuracies were also reported by <br />
multiple comments.
 
Several comments identified
 
inconsistencies between FedRAMP <br />
equivalency as stated § 170.16(c)(2)(ii) <br />
and as described in the DOD CIO’s <br />
December 21, 2023, Federal Risk and <br />
Authorization Management Program <br />
Moderate Equivalency for Cloud Service <br />
Provider’s Cloud Service Offerings <br />
memorandum. One comment requested <br />
moving the phrase ‘‘in accordance with <br />
all applicable policies, procedures, and <br />
requirements’’ in § 170.5(d) to an earlier <br />
part of the sentence to be grammatically <br />
correct.
 
One comment noted that DFARS
 
provision 252.204–7019 does not <br />
stipulate assessments must be a ‘‘self- <br />
assessment’’ as stated in the CMMC 2.0 <br />
Overview as Proposed by this Rule <br />
section. Also in the same section, one <br />
comment indicated the SSP description <br />
should not direct the user to explain <br />
how each requirement is implemented, <br />
monitored, and enforced.
 
One comment asked if the reference to
 
NIST SP 900–171A refers to the current <br />
version or if a version number should be <br />
specified. Three comments indicated <br />
issues using embedded links to <br />
websites. One comment noted that <br />
‘‘inspection activities’’ should be <br />
changed to ‘‘assessment activities’’ in <br />
170.9(b)(10). One comment asserted that <br />
in 170.17(a)(1) the word ‘‘obtaining’’ <br />
should be deleted in the phrase ‘‘. . . <br />
the OSC must achieve either CMMC <br />
Level 2 Conditional Certification or <br />
Final Certification through obtaining a <br />
CMMC Level 2 Certification Assessment <br />
. . .’’
 
''Response: ''
 
Typographical, Grammatical, and <br />
Punctuation Errors, and Formatting
 
The DOD reviewed all reported
 
grammatical, punctuation,
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00076
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83167 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
typographical, and acronym-related <br />
errors and the preamble, RIA, and rule <br />
have been updated to address all <br />
confirmed errors. Additionally, the <br />
formatting errors in the CMMC Level 2 <br />
Asset Categories and Associated <br />
Requirements row of table 1 of <br />
§ 170.19(c)(1), have been corrected. The <br />
final rule has been revised to correct <br />
document titles as needed.
 
A commenter provided feedback on
 
the PRA and identified incorrect <br />
markings in information collection <br />
samples. DoD will work with DISA to <br />
ensure the final versions of the eMASS <br />
templates contain the proper markings. <br />
An OSA’s CMMC certification <br />
assessment results will be ingested into <br />
DoD’s CMMC instance using the eMASS <br />
CMMC Assessment Import Templates <br />
[https://cmmc.emass.apps.mil published at ''https://<br />
cmmc.emass.apps.mil''. The <br />
]requirements for C3PAOs and DCMA <br />
DIBCAC and what is submitted into <br />
CMMC eMASS is described in §§ 170.7, <br />
170. 9, 170.17(a)(1)(i), 170.18(a)(1)(i), <br />
and 170.19. The documents <br />
accompanying the PRA were intended <br />
to serve as samples. The comment also <br />
contained an incorrect assumption that <br />
commercial privileged information ‘‘is <br />
not CUI because it is incidental to the <br />
performance of the contract.’’ The <br />
commenter has confused CDI with CUI <br />
and is incorrect in the assumption that <br />
commercial privileged information is <br />
not CUI because of it being incidental to <br />
the performance of the contract.
 
Word Usage
 
Incorrect uses of ‘‘tri-annually’’ have
 
been corrected. Where appropriate the <br />
wording has been changed to ‘‘every <br />
three years’’ for clarity. In the preamble <br />
to the rule, the statement ‘‘. . . and <br />
triennial affirmation . . .’’ has been <br />
corrected to indicate the affirmations are <br />
an ‘‘annual’’ requirement.—DoD has <br />
updated the preamble to the rule to the <br />
correct certification assessment <br />
terminology.
 
The link on the '''Federal Register '''
 
website has been corrected and now <br />
resolves to the website indicated.
 
Incorrect or Incomplete References
 
Several incorrect or incomplete
 
references have also been corrected. <br />
§ 170.9(b)(1) has been corrected to refer <br />
to the authorization in § 170.8(a). One <br />
comment asserted that there is no <br />
section (c) associated with the reference <br />
‘‘§ 170.17(a)(1) and (c)’’ which is in <br />
§ 170.9(b)(6). The section ‘‘§ 170.17(c) <br />
Procedures’’ does exist and addresses <br />
the procedures associated with a CMMC <br />
Level 2 Certification Assessment. <br />
Section 170.17(a)(1) addresses the Level <br />
2 Certification Assessment requirements
 
for an OSC. The rule has been updated <br />
in § 170.9(b)(6) for clarity.
 
Commenters accurately noted that
 
§ 170.17(a)(1) should refer to the Level <br />
2 requirements in § 170.14(c)(3), and <br />
this has been corrected. The reference in <br />
§ 170.18(c)(5)(ii) has been updated to <br />
say, ‘‘that maps to the NIST SP 800–171 <br />
R2 and a subset of the NIST SP 800–172 <br />
Feb2021 requirements’’. The rule is <br />
updated to replace the instruction <br />
‘‘(insert references L1–3)’’ with <br />
‘‘§ 170.19 CMMC scoping.’’
 
Wording Discrepancies, Redundancies, <br />
and Inaccuracies
 
To address a discrepancy between the
 
rule and scoping guidance, the Level 2 <br />
Scoping Guide has been updated for <br />
clarity and alignment with § 170.16(a) <br />
which states that meeting the CMMC <br />
Level 2 Self-Assessment requirements <br />
also satisfies the CMMC Level 1 Self- <br />
Assessment requirements for the same <br />
CMMC Assessment Scope. Additionally, <br />
the preamble to this rule has been <br />
updated to clarify that not all <br />
affirmations will occur prior to contract <br />
award because POA&amp;M closeout <br />
affirmations may occur after contract <br />
award.
 
To address a discrepancy about Level
 
1 scoring, in § 170.24 the phrase ‘‘; <br />
therefore, no score is calculated, and no <br />
scoring methodology is needed,’’ has <br />
been deleted.
 
The regulatory text was updated to
 
require FedRAMP moderate or <br />
FedRAMP moderate equivalency in <br />
accordance with DoD Policy. CMMC <br />
Program Requirements make no change <br />
to existing policies for information <br />
security requirements implemented by <br />
DoD. The preamble was modified to <br />
indicate DFARS provision 252.204– <br />
7019 requires an assessment (basic, <br />
medium, or high) and not just a self- <br />
assessment (basic).
 
The data input at § 170.17(a)(1)(i)(F)
 
for CMMC eMASS is redundant so it has <br />
been removed. In the preamble, the DoD <br />
has also removed the inaccurate phrase, <br />
‘‘certified by DoD’’, from the statement <br />
‘‘Under CMMC, compliance will be <br />
checked by independent third-party <br />
assessors certified by DoD.’’
 
DoD has updated language in
 
§ 170.18(a)(1)(i)(B) to reflect for each <br />
DCMA DIBCAC Assessor conducting the <br />
assessment, ‘‘name and government <br />
organization information’’ will be <br />
required for the CMMC instantiation of <br />
eMASS.
 
The DoD has considered the
 
recommendation to change the <br />
description of what an SSP should <br />
contain and declines to revise the rule <br />
text. The NIST SP 800–171 R2 <br />
requirement states that an SSP must
 
describe ‘‘. . . how security <br />
requirements are implemented . . .’’ <br />
which is equivalent to going ‘‘. . . <br />
through each NIST SP 800–171 security <br />
requirement and explain how the <br />
requirement is implemented, monitored, <br />
and enforced.’’
 
Perceived Errors
 
DoD declines to make the edit to
 
change ‘‘shall’’ to ‘‘will’’ in § 170.9(b). <br />
The existing language is consistent with <br />
standard rulemaking usage. The title for <br />
NIST SP 800–171A Jun2018 is the <br />
current title used by NIST and does not <br />
have a version number, so no change <br />
was needed. While not used in the rule <br />
text, the term enterprise is used in the <br />
description of the CMMC Program in the <br />
preamble’s Statement of Need for This <br />
Rule section: Defense contractors can <br />
achieve a specific CMMC Level for its <br />
entire enterprise network or an <br />
enclave(s), depending upon where the <br />
information to protected is processed, <br />
stored, or transmitted, therefore <br />
enterprise remains in the definitions <br />
list.
 
DoD verified links by clicking on
 
them in the PDF and by copying and <br />
pasting the links into a web browser. In <br />
both cases links resolved correctly.
 
The DoD has changed ‘‘all personnel
 
involved in inspection activities’’ to ‘‘all <br />
personnel involved in assessment <br />
activities’’ in § 170.9(b)(9).
 
A comment asserted that there was a
 
rulemaking formatting error in <br />
§ 170.4(b). DoD is following the Office of <br />
the Federal Register standards for this <br />
section. In sections or paragraphs <br />
containing only definitions, paragraph <br />
designations are not used, and the terms <br />
are listed in alphabetical order. The <br />
definition paragraph begins with the <br />
term being defined. If a definition <br />
contains subordinate paragraphs, these <br />
paragraphs are numbered with <br />
paragraph designations beginning with <br />
the next appropriate level based on the <br />
dedicated definitions section.
 
The 2nd sentence of § 170.17(a)(1)
 
includes the word ‘‘obtaining’’ for <br />
clarity.
 
''35. Comments in Favor of the CMMC <br />
Program ''
 
''Comment: ''Some commenters
 
expressed favorable opinions about the <br />
CMMC program as a viable long-term <br />
solution to ensure cybersecurity <br />
controls are in place. Others commented <br />
about specific content of the 32 CFR <br />
part 170 CMMC Program proposed rule <br />
and the supplemental documents. For <br />
example, two commenters specifically <br />
complimented the inclusion of an <br />
Affirmation requirement and another <br />
supported CMMC implementation as a
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00077
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83168 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
pre-award requirement. Another <br />
commenter appreciated the regulatory <br />
text which ‘‘encourages’’ contractors to <br />
consult with the Government for <br />
additional guidance if or when unsure <br />
of appropriate CMMC Level to assign a <br />
subcontract solicitation. Two <br />
commenters applauded the use of <br />
already established workforce <br />
qualifications while another concurred <br />
with the regulatory text permitting <br />
CMMC Certified Professionals (CCPs) to <br />
participate in assessments with <br />
oversight of a CMMC Certified Assessor <br />
(CCA). A commenter also expressed <br />
appreciation for the regulatory text’s <br />
alignment to a specific version of the <br />
guidelines (''i.e., ''NIST SP 800–171 R2). <br />
One commenter appreciated the video <br />
that DoD published to accompany and <br />
explain the proposed rule. Several <br />
comments cited the longstanding <br />
requirements of DFARS clause 252.204– <br />
7012 and cybersecurity risks of not <br />
implementing NIST SP 800–171 R2 as <br />
reasons that the 32 CFR part 170 CMMC <br />
Program final rule should be <br />
implemented as soon as possible.
 
''Response: ''The Department
 
appreciates that several commenters <br />
expressed agreement to and <br />
encouragement for the CMMC Program <br />
requirement and its associated specific <br />
rule text. The DoD recognizes that not <br />
all entities impacted by these <br />
regulations hold the same view of its <br />
requirements and appreciates those that <br />
took the time to express both positive <br />
and constructive feedback.
 
Applicability
 
Once CMMC is implemented in the 48
 
CFR part 204 CMMC Acquisition rule, <br />
the CMMC Program will require DoD to <br />
identify the CMMC Level and <br />
assessment type as a solicitation <br />
requirement and in the resulting <br />
contract for any effort that will cause a <br />
contractor or subcontractor to process, <br />
store, or transmit FCI or CUI on its <br />
unclassified information system(s). <br />
Once CMMC is implemented in the 48 <br />
CFR part 204 CMMC Acquisition rule, <br />
contractors handling FCI or CUI will be <br />
required to meet the CMMC Level and <br />
assessment type specified in the <br />
solicitation and resulting contract.
 
''Summary of Program Changes: ''
 
DFARS Case 2019–D041 implemented <br />
DoD’s original model for assessing <br />
contractor information security <br />
protections. The initial CMMC Program <br />
was comprised of five progressively <br />
advanced levels of cybersecurity <br />
standards and required defense <br />
contractors and subcontractors to <br />
undergo a certification process to <br />
demonstrate compliance with the
 
cybersecurity standards associated with <br />
a given CMMC Level.
 
In March 2021, the Department
 
initiated an internal review of CMMC’s <br />
implementation that engaged DoD’s <br />
cybersecurity and acquisition leaders to <br />
refine policy and program <br />
implementation, focusing on the need to <br />
reduce costs for small businesses and <br />
align cybersecurity requirements to <br />
other Federal standards and guidelines. <br />
This review resulted in the revised <br />
CMMC Program, which streamlines <br />
assessment and certification <br />
requirements and improves <br />
implementation of the CMMC Program. <br />
These changes include:
 
• Eliminating Levels 2 and 4, and
 
renaming the remaining three CMMC <br />
Levels as follows:
 
• Level 1 will remain the same as the
 
initial CMMC Program Level 1;
 
• Level 2 will be similar to the initial
 
CMMC Program Level 3;
 
• Level 3 will be similar to the initial
 
CMMC Program Level 5.
 
• Removing CMMC-unique
 
requirements and maturity processes <br />
from all levels;
 
• For CMMC Level 1, allowing annual
 
self-assessments with an annual <br />
affirmation by company leadership;
 
• Allowing a subset of companies at
 
Level 2 to demonstrate compliance <br />
through self-assessment rather than <br />
C3PAO assessment.
 
• For CMMC Level 3, requiring
 
Department-conducted assessments; and
 
• Developing a time-bound and
 
enforceable POA&amp;M process.
 
In December 2023, the Department
 
published a proposed rule to amend 32 <br />
CFR part 170 in the '''Federal Register <br />
'''(Docket ID DOD–2023–OS–0063, 88 FR <br />
89058), which implemented the DoD’s <br />
vision for the revised CMMC Program <br />
outlined in November 2021. The <br />
comment period for the proposed rule <br />
concluded on February 26, 2024. <br />
Changes have been made to the CMMC <br />
Program based on public comment. <br />
Significant changes include:
 
• The Implementation Phase 1 has
 
been extended by an additional six <br />
months.
 
• A new taxonomy was created
 
differentiating the level and type of <br />
assessment conducted from the CMMC <br />
Status achieved as a result.
 
• Clarification was added regarding
 
the DoD’s role in achievement or loss of <br />
CMMC Statuses.
 
• CMMC Status will be automatically
 
updated in SPRS for OSAs who have <br />
met standards acceptance.
 
• Requirements regarding conflict of
 
interest were updated to expand the <br />
cooling-off period for the CMMC <br />
Accreditation Body to one year and
 
bounded the timeframe between <br />
consulting and assessing for the CMMC <br />
Ecosystem to three years.
 
• A requirement was added for the
 
CMMC Ecosystem members to report <br />
adverse information to the CAICO.
 
• A Provisional Instructor role was
 
added to cover the transitional period <br />
that ends 18 months after the effective <br />
date of this rule.
 
• A CCI requirement was added to
 
clarify that a CCI must be certified at the <br />
same or higher level than the classes <br />
they are instructing.
 
• A requirement for artifact retention
 
was added to Level 1 self-assessments <br />
and Level 2 self-assessments.
 
• The assessment requirements for
 
ESPs have been reduced.
 
• The definition of CSP has been
 
narrowed and is now based on NIST SP <br />
800–145 Sept2011.
 
• The assessment requirements for
 
Security Protection Assets and Security <br />
Protection Data have been reduced.
 
• References to FedRAMP
 
equivalency have been tied to DoD <br />
policy.
 
• Clarified the requirements for CSPs
 
for an OSC seeking a CMMC Status of <br />
Level 3 (DIBCAC).
 
• Clarified that DCMA DIBCAC has
 
the authority to perform limited checks <br />
of compliance of assets that changed <br />
asset category or changed assessment <br />
requirements between the Level 2 and <br />
Level 3 certification assessment.
 
• Clarification was added around the
 
use of VDI clients.
 
• Provided clarification to distinguish
 
between Plan of Action &amp; Milestones <br />
(POA&amp;Ms) and operational plan of <br />
action.
 
• Definitions have been added for:
 
Affirming Official, Assessment <br />
objective, Asset, CMMC security <br />
requirement, CMMC Status, DoD <br />
Assessment Methodology, Enduring <br />
Exception, Operational plan of action, <br />
Personally Identifiable Information, <br />
Security Protection Data (SPD), and <br />
Temporary deficiency. Some definitions <br />
were also changed to source from NIST <br />
documentation instead of Committee on <br />
National Security Systems (CNSS) <br />
Instruction No. 4009.
 
'''Background '''
 
''A. Statement of Need for This Rule ''
 
The Department of Defense (DoD)
 
requires defense contractors to protect <br />
FCI and CUI. To verify contractor and <br />
subcontractor implementation of DoD’s <br />
cybersecurity information protection <br />
requirements, the Department <br />
developed the Cybersecurity Maturity <br />
Model Certification (CMMC) Program as <br />
a means of assessing and verifying
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00078
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83169 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
24
 
Based on information from the Council of
 
Economic Advisors report: The Cost of Malicious <br />
Cyber Activity to the U.S. Economy, 2018.
 
25
 
Based on information from the Center for
 
Strategic and International Studies report on the <br />
Economic Impact of Cybercrime; [http://www.csis.org/analysis/economic-impact-cybercrime ''www.csis.org/ <br />
analysis/economic-impact-cybercrime''. ]
 
26
 
Based on information from the Federal
 
Procurement Data System, the average number of <br />
unique prime contractors is approximately 212,650 <br />
and the number of known unique subcontractors is <br />
approximately 8,300. (FPDS from FY18–FY21).
 
adequate protection of contractor <br />
information systems that process, store, <br />
or transmit either FCI or CUI.
 
The CMMC Program is intended to:
 
(1) align cybersecurity requirements to <br />
the sensitivity of unclassified <br />
information to be protected, (2) add a <br />
self-assessment element to affirm <br />
implementation of applicable <br />
cybersecurity requirements, (3) add a <br />
certification element to verify <br />
implementation of cybersecurity <br />
requirements, and (4) add an affirmation <br />
to attest to continued compliance with <br />
assessed requirements. As part of the <br />
program, DoD also intends to provide <br />
supporting resources and training to the <br />
DIB, to help support companies who are <br />
working to achieve the required CMMC <br />
Status. The CMMC Program provides for <br />
assessment at three levels, starting with <br />
basic safeguarding of FCI at CMMC <br />
Level 1, moving to the broad protection <br />
of CUI at CMMC Level 2, and <br />
culminating with higher-level <br />
protection of CUI against risk from <br />
Advanced Persistent Threats (APTs) at <br />
CMMC Level 3.
 
The CMMC Program addresses DoD’s
 
need to protect FCI and CUI during the <br />
acquisition and sustainment of products <br />
and services from the DIB. This effort is <br />
instrumental in establishing <br />
cybersecurity as a foundation for DoD <br />
acquisitions.
 
Although DoD contract requirements
 
to provide adequate security for covered <br />
defense information (reflected in <br />
DFARS clause 252.204–7012) predate <br />
CMMC by many years, a verification <br />
requirement for the handling of CUI to <br />
assess a contractor or subcontractor’s <br />
implementation of those required <br />
information security controls is new <br />
with the CMMC Program.
 
The theft of intellectual property and
 
sensitive information from all U.S. <br />
industrial sectors from malicious cyber <br />
activity threatens economic security and <br />
national security. The Council of <br />
Economic Advisers estimates that <br />
malicious cyber activity cost the U.S. <br />
economy between $57 billion and $109 <br />
billion in 2016.24 The Center for <br />
Strategic and International Studies <br />
estimates that the total global cost of <br />
cybercrime was as high as $600 billion <br />
in 2017.25
 
Malicious cyber actors have targeted
 
and continue to target defense <br />
contractors and the DoD supply chain. <br />
These attacks not only focus on the large
 
prime contractors, but also target <br />
subcontractors that make up the lower <br />
tiers of the DoD supply chain. Many of <br />
these subcontractors are small entities <br />
that provide critical support and <br />
innovation. Overall, the DIB sector <br />
consists of over 220,000 companies 26 <br />
that process, store, or transmit CUI or <br />
FCI in support of the warfighter and <br />
contribute towards the research, <br />
engineering, development, acquisition, <br />
production, delivery, sustainment, and <br />
operations of DoD systems, networks, <br />
installations, capabilities, and services. <br />
The aggregate loss of intellectual <br />
property and controlled unclassified <br />
information from the DoD supply chain <br />
can undercut U.S. technical advantages <br />
and innovation, as well as significantly <br />
increase the risk to national security. As <br />
part of multiple lines of effort focused <br />
on the security and resiliency of the <br />
DIB, the Department is working with <br />
industry to enhance the protection of <br />
FCI and CUI within the DoD supply <br />
chain. Toward this end, DoD has <br />
developed the CMMC Program.
 
Cybersecurity Maturity Model <br />
Certification Program
 
The CMMC Program provides a
 
comprehensive and scalable <br />
certification approach to verify the <br />
implementation of requirements <br />
associated with the achievement of a <br />
cybersecurity level. CMMC is designed <br />
to provide increased assurance to the <br />
Department that defense contractors can <br />
adequately protect FCI and CUI at a <br />
level commensurate with the risk, <br />
accounting for information flow down <br />
to its subcontractors in a multi-tier <br />
supply chain. Defense contractors can <br />
achieve a specific CMMC Status for <br />
their entire enterprise network or an <br />
enclave(s), depending upon where the <br />
information to be protected is <br />
processed, stored, or transmitted.
 
The CMMC Program assesses
 
implementation of cybersecurity <br />
requirements. The CMMC requirements <br />
for safeguarding and security are the <br />
same as those required by FAR Subpart <br />
4.19 and DFARS clause 252.204–7012, <br />
as well as selected NIST SP 800–172 <br />
Feb201 requirements. CMMC Level 1 <br />
requires implementation of the <br />
safeguarding requirements set forth in <br />
FAR clause 52.204–21. CMMC Level 2 <br />
requires implementation of the security <br />
requirements in NIST SP 800–171 R2. <br />
CMMC Level 3 requires implementation <br />
of the security requirements in NIST SP <br />
800–171 R2 as well as selected NIST SP
 
800–172 Feb2021 requirements, with <br />
DoD specified parameters. The CMMC <br />
security requirements for all three <br />
Levels are provided in § 170.14. In <br />
general, CMMC assessments do not <br />
duplicate efforts from existing DoD <br />
assessments. In rare circumstances a re- <br />
assessment may be necessary when <br />
cybersecurity risks, threats, or <br />
awareness have changed.
 
Under the CMMC Program, CMMC
 
contract requirements include self- <br />
assessments and third-party assessments <br />
for CMMC Level 2, predicated on <br />
program criticality, information <br />
sensitivity, and the severity of cyber <br />
threat. Based on the type and sensitivity <br />
of the information to be protected, a <br />
defense contractor must achieve the <br />
appropriate CMMC Status and <br />
demonstrate implementation of the <br />
associated set of information protection <br />
requirements.
 
If the CMMC Status of Level 1 (Self)
 
or Level 2 (Self) is a contract <br />
requirement, the defense contractor will <br />
be required to self-assess its compliance <br />
with the CMMC Level 1 or Level 2 <br />
security requirements and submit both <br />
the self-assessment results and an <br />
affirmation of conformance in SPRS. <br />
Level 1 self-assessment and associated <br />
affirmation is required annually. Level 2 <br />
self-assessment is required every three <br />
years with an affirmation following the <br />
self-assessment and annually after the <br />
Final CMMC Status Date.
 
If the CMMC Status of Level 2
 
(C3PAO) is a contract requirement, the <br />
Level 2 certification assessment must be <br />
performed by an authorized or <br />
accredited CMMC Third Party <br />
Assessment Organization (C3PAO). <br />
When the CMMC Status of Level 3 <br />
(DIBCAC) is a contract requirement, the <br />
Level 3 certification assessment by <br />
DCMA DIBCAC is required following <br />
the achievement of the CMMC Status of <br />
Final Level 2 (C3PAO). Upon <br />
achievement of the CMMC Status of <br />
Level 2 (C3PAO) or Level 3 (DIBCAC), <br />
the offeror will be issued a Certificate of <br />
CMMC Status. The assessment results <br />
are documented in SPRS to enable <br />
contracting officers to verify the CMMC <br />
Status and CMMC Status Date (''i.e., ''not <br />
more than three years old) of an offeror <br />
prior to contract award. The offeror <br />
must also submit an affirmation of <br />
conformance in SPRS following the <br />
assessment and annually after the Final <br />
CMMC Status Date.
 
CMMC allows the use of a Plan of
 
Action and Milestones (POA&amp;Ms) for <br />
specified CMMC Level 2 and Level 3 <br />
security requirements. Each POA&amp;M <br />
must be closed (''i.e., ''all requirements <br />
completed), within 180 days of the <br />
initial assessment.
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00079
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83170 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
27
 
[http://www.govinfo.gov/content/pkg/PLAW-116publ92/pdf/PLAW-116publ92.pdf ''www.govinfo.gov/content/pkg/PLAW- '']
 
[http://www.govinfo.gov/content/pkg/PLAW-116publ92/pdf/PLAW-116publ92.pdf ''116publ92/pdf/PLAW-116publ92.pdf. '']
 
The details of the requirements for
 
self-assessment, certification <br />
assessment, and affirmation for each <br />
CMMC Level, are provided in §§ 170.15 <br />
through 170.18. POA&amp;M requirements <br />
and affirmation requirements are <br />
provided in §§ 170.21 and 170.22.
 
DoD’s phased implementation of the
 
CMMC Status requirements is described <br />
in § 170.3(e). Once CMMC requirements <br />
have been implemented in the DFARS, <br />
the solicitation and resulting contract <br />
will identify the specific CMMC Status <br />
required for that procurement. Selection <br />
of a CMMC Status will be based upon <br />
careful consideration of market research <br />
and the likelihood of a robust <br />
competitive market of prospective <br />
offerors capable of meeting the <br />
requirement. In some scenarios, DoD <br />
may elect to waive application of <br />
CMMC Status requirements to a <br />
particular procurement. In such cases, <br />
the solicitation will not include a <br />
CMMC Status requirement. Such <br />
waivers may be requested and approved <br />
by the Department in accordance with <br />
DoD’s internal policies and procedures. <br />
For a DoD solicitation or contract that <br />
does include CMMC requirements, <br />
including those for the acquisition of <br />
commercial items (except those <br />
exclusively COTS items) valued at <br />
greater than the micro-purchase <br />
threshold, contracting officers will not <br />
make award, or exercise an option on a <br />
contract, if the offeror or contractor does <br />
not meet the requirements for the <br />
required CMMC Status. Furthermore, <br />
CMMC requirements are required to <br />
flow down to subcontractors as <br />
prescribed in the solicitation and <br />
resulting contract at all tiers, <br />
commensurate with the sensitivity of <br />
the unclassified information flowed <br />
down to each subcontractor.
 
''B. Legal Authority ''
 
5 U.S.C. 301 authorizes the head of an
 
Executive department or military <br />
department to prescribe regulations for <br />
the government of his or her <br />
department, the conduct of its <br />
employees, the distribution and <br />
performance of its business, and the <br />
custody, use, and preservation of its <br />
records, papers, and property ([http://www.govinfo.gov/content/pkg/USCODE-2009-title5/pdf/USCODE-2009-title5-partI-chap3-sec301.pdf ''www.<br />
govinfo.gov/content/pkg/USCODE-2009- <br />
title5/pdf/USCODE-2009-title5-partI- <br />
chap3-sec301.pdf''). ]
 
Section 1648 of the National Defense
 
Authorization Act for Fiscal Year 2020 <br />
(Pub. L. 116–92) 27 directs the Secretary <br />
of Defense to develop a consistent, <br />
comprehensive framework to enhance <br />
cybersecurity for the U.S. Defense
 
Industrial Base (DIB). The CMMC <br />
Program is an important part of this <br />
framework.
 
''C. Community Impact ''
 
This final rule impacts all prospective
 
and actual DoD contractors and <br />
subcontractors that are handling or will <br />
handle DoD information that meets the <br />
standards for FCI or CUI on a contractor <br />
information system during performance <br />
of the DoD contract or subcontract. This <br />
final rule also impacts all companies <br />
who are performing or will perform <br />
accreditation, training, certification, or <br />
assessment functions in connection <br />
with implementation of the CMMC <br />
Program.
 
''D. Regulatory History ''
 
The CMMC Program verifies defense
 
contractor compliance with DoD’s <br />
cybersecurity information protection <br />
requirements. It is designed to protect <br />
FCI and CUI that is shared by the <br />
Department with, or generated by, its <br />
contractors and subcontractors. The <br />
cybersecurity standards required by the <br />
program are the same as those set forth <br />
in FAR clause 52.204–21 (CMMC Level <br />
1), the NIST SP 800–171 R2 guidelines, <br />
which is presently required by DFARS <br />
clause 252.204–7012 (CMMC Level 2), <br />
and additional selected requirements <br />
from the NIST SP 800–172 Feb2021 <br />
guidelines (CMMC Level 3). The <br />
program adds a robust assessment <br />
element and provides the Department <br />
increased assurance that contractors and <br />
subcontractors are meeting these <br />
requirements.
 
In September 2020, the DoD
 
published the 48 CFR CMMC interim <br />
final rule to the DFARS in the '''Federal <br />
Register '''(DFARS Case 2019–D041, 85 <br />
FR 48513, September 9, 2020), which <br />
implemented the DoD’s vision for the <br />
initial CMMC Program and outlined the <br />
basic features of the program (tiered <br />
model, required assessments, and <br />
implementation through contracts). The <br />
48 CFR CMMC interim final rule <br />
became effective on November 30, 2020, <br />
establishing a five-year phase-in period.
 
In March 2021, the Department
 
initiated an internal review of CMMC’s <br />
implementation, informed by more than <br />
750 CMMC-related public comments in <br />
response to the 48 CFR CMMC interim <br />
final rule. This comprehensive, <br />
programmatic assessment engaged <br />
cybersecurity and acquisition leaders <br />
within DoD to refine policy and <br />
program implementation.
 
In November 2021, the Department
 
announced plans for a revised CMMC <br />
Program, which incorporates an <br />
updated program structure and <br />
requirements designed to achieve the
 
primary goals of an internal DoD review <br />
of the CMMC Program. With the <br />
implementation of the CMMC Program, <br />
the Department introduced several key <br />
changes that build on and refine the <br />
original program requirements. These <br />
include:
 
• Streamlining the model from five to
 
three certification levels;
 
• Allowing all companies at Level 1
 
and a subset of companies at Level 2 to <br />
demonstrate compliance through self- <br />
assessments;
 
• Increased oversight of professional
 
and ethical standards of third-party <br />
assessors; and
 
• Allowing companies, under certain
 
limited circumstances, to make <br />
POA&amp;Ms to achieve certification.
 
In December 2023, the Department
 
published a proposed rule to amend 32 <br />
CFR part 170 in the '''Federal Register <br />
'''(Docket ID 2023–OS–0063, 88 FR 89058, <br />
December 26, 2023), which <br />
implemented the DoD’s vision for the <br />
revised CMMC Program outlined in <br />
November 2021. The comment period <br />
for the proposed rule concluded on <br />
February 26, 2024.
 
The CMMC requirements established
 
pursuant to DFARS Case 2019–D041 <br />
have not been revised as of the date of <br />
publication of this final rule. However, <br />
the CMMC Program requirements in this <br />
final rule will be implemented in the <br />
DFARS, as needed, which may result in <br />
changes to the current DFARS text, <br />
solicitation provisions, and contract <br />
clauses relating to DoD’s cybersecurity <br />
protection requirements, including <br />
DFARS subpart 204.75 and DFARS <br />
clause 252.204–7021, Cybersecurity <br />
Maturity Model Certification (CMMC) <br />
Requirements.
 
'''Context of the CMMC Program in Light <br />
of Other DoD-Related Work '''
 
At present, and prior to the DFARS
 
CMMC Acquisition rule becoming <br />
effective, the Department is using the <br />
DCMA DIBCAC to conduct CMMC Level <br />
2-like assessments. To date, the DCMA <br />
DIBCAC has assessed 357 entities <br />
including DoD’s major prime <br />
contractors. The CMMC Program’s <br />
assessment phase-in plan, as described <br />
in § 170.3 Applicability, does not <br />
preclude entities from immediately and <br />
voluntarily seeking a CMMC <br />
certification assessment prior to the <br />
DFARS CMMC Acquisition rule being <br />
finalized and the clause being added to <br />
new or existing DoD contracts.
 
The Department estimates 8,350
 
medium and large entities will require <br />
CMMC Level 2 certification <br />
assessments. Once the CMMC DFARS <br />
coverage is effective, the Department <br />
will contractually mandate CMMC Level
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00080
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83171 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
28
 
[https://media.defense.gov/2024/Mar/28/2003424523/-1/-1/1/DOD_DOB_CS_STRATEGY_DSD_SIGNED_20240325.PDF ''https://media.defense.gov/2024/Mar/28/ '']
 
[https://media.defense.gov/2024/Mar/28/2003424523/-1/-1/1/DOD_DOB_CS_STRATEGY_DSD_SIGNED_20240325.PDF ''2003424523/-1/-1/1/DOD'']
 
[https://media.defense.gov/2024/Mar/28/2003424523/-1/-1/1/DOD_DOB_CS_STRATEGY_DSD_SIGNED_20240325.PDF _''DOB''_''CS''_''STRATEGY''_]
 
[https://media.defense.gov/2024/Mar/28/2003424523/-1/-1/1/DOD_DOB_CS_STRATEGY_DSD_SIGNED_20240325.PDF ''DSD'']
 
[https://media.defense.gov/2024/Mar/28/2003424523/-1/-1/1/DOD_DOB_CS_STRATEGY_DSD_SIGNED_20240325.PDF _''SIGNED''_''20240325.PDF''. ]
 
29
 
[http://www.govinfo.gov/content/pkg/FR-2020-12-21/pdf/2020-27698.pdf ''www.govinfo.gov/content/pkg/FR-2020-12-21/ '']
 
[http://www.govinfo.gov/content/pkg/FR-2020-12-21/pdf/2020-27698.pdf ''pdf/2020-27698.pdf. '']
 
30
 
[http://www.dcsa.mil/Industrial-Security/National-Industrial-Security-Program-Oversight/32-CFR-Part-117-NISPOM-Rule/ ''www.dcsa.mil/Industrial-Security/National- '']
 
[http://www.dcsa.mil/Industrial-Security/National-Industrial-Security-Program-Oversight/32-CFR-Part-117-NISPOM-Rule/ ''Industrial-Security-Program-Oversight/32-CFR-Part- <br />
117-NISPOM-Rule/''. ]
 
2 certification assessments on these <br />
entities. It is estimated that 135 CMMC <br />
Third-Party Assessment Organization <br />
(C3PAO)-led assessments will be <br />
completed in the first year. The <br />
Department estimates 673 C3PAO-led <br />
assessments in year 2 followed by 2,252 <br />
C3PAO-led assessments in year 3. <br />
During the fourth year, the Department <br />
estimates,4,452 C3PAO-led assessments <br />
will be completed. The DCMA DIBCAC <br />
will perform assessments upon DoD’s <br />
request.
 
Additionally, the Department may
 
include CMMC Level 2 certification <br />
requirements on contracts awarded <br />
prior to the CMMC DFARS coverage <br />
becoming effective, but doing so will <br />
require bilateral contract modification <br />
after negotiations.
 
The CMMC Program has been
 
incorporated in the Department’s 2024 <br />
Defense Industrial Base Cybersecurity <br />
Strategy.28 The strategy requires the <br />
Department to coordinate and <br />
collaborate across components to <br />
identify and close gaps in protecting <br />
DoD networks, supply chains, and other <br />
critical resources. Other prongs of the <br />
Department’s cybersecurity strategy are <br />
described in the Department’s National <br />
Industrial Security Program Operating <br />
Manual (NISPOM) which address <br />
implementation of the Security <br />
Executive Agent Directive (SEAD) 3,29 <br />
including clarifications on procedures <br />
for the protection and reproduction of <br />
classified information; controlled <br />
unclassified information (CUI); National <br />
Interest Determination (NID) <br />
requirements for cleared contractors <br />
operating under a Special Security <br />
Agreement for Foreign Ownership, <br />
Control, or Influence; and eligibility <br />
determinations for personnel security <br />
clearance processes and requirements.30
 
In addition, DCMA DIBCAC is
 
responsible for leading the Department’s <br />
contractor cybersecurity risk mitigation <br />
efforts. As part of this work, the DIBCAC <br />
assesses the defense industrial base <br />
companies to ensure they are meeting <br />
contractually required cybersecurity <br />
standards. The DIBCAC team ensures <br />
contractors have the ability to protect <br />
controlled unclassified information for <br />
government contracts they are awarded. <br />
DIBCAC conducts NIST SP 800–171 <br />
assessments in support of DFARS clause <br />
252.204–7012, ''Safeguarding Covered <br />
Defense Information and Cyber Incident ''
 
''Reporting, ''and DFARS clause 204.204– <br />
7020, ''NIST SP 800–171 DoD <br />
Assessment Requirements. ''The DFARS <br />
204.204–7020 DIBCAC prioritization <br />
process is designed to adjust as DoD’s <br />
cyber priorities evolve based on ongoing <br />
threats. DIBCAC analysts collect and <br />
analyze data on DoD contractors to <br />
include:
 
• Mission critical programs,
 
technologies, and infrastructure and the <br />
contractors (prime or lower tier) that <br />
support DoD capabilities.
 
• Cyber threats, vulnerabilities, or
 
incidents.
 
• DoD Leadership requests.
 
'''Regulatory Impact Analysis '''
 
FAR Subpart 4.19 and DFARS clause
 
252.204–7012 address safeguarding of <br />
FCI and CUI in contractor information <br />
systems and prescribe contract clauses <br />
requiring protection of FCI and CUI <br />
within the supply chain. The FAR and <br />
DFARS requirements for safeguarding <br />
FCI and CUI predate the CMMC <br />
Program by many years, and baseline <br />
costs for their implementation are <br />
assumed to vary widely based on factors <br />
including, but not limited to, company <br />
size and complexity of the information <br />
systems to be secured. FAR clause <br />
52.204–21 is prescribed at FAR section <br />
4.1903 for use in solicitations and <br />
contracts when the contractor or <br />
subcontractor at any tier may have FCI <br />
residing in or transiting through its <br />
information system. This clause requires <br />
contractors and subcontractors to apply <br />
basic safeguarding requirements and <br />
procedures to protect applicable <br />
contractor information systems that <br />
process, store, or transmit FCI. In <br />
addition, DFARS clause 252.204–7012, <br />
''Safeguarding Covered Defense <br />
Information and Cyber Incident <br />
Reporting, ''is prescribed at DFARS <br />
section 204.7304(c) for use by DoD in all <br />
solicitations and contracts, including <br />
solicitations and contracts using FAR <br />
part 12 procedures for the acquisition of <br />
commercial items, except for <br />
solicitations and contracts solely for the <br />
acquisition of commercially available <br />
off-the-shelf items. This clause applies <br />
when a contractor information system <br />
processes, stores, or transmits covered <br />
defense information and requires <br />
contractors and subcontractors to <br />
provide ‘‘adequate security’’ to <br />
safeguard that information when it <br />
resides on or transits through a <br />
contractor information system, and to <br />
report cyber incidents that affect that <br />
system or network. The clause states <br />
that to provide adequate security, the <br />
contractor shall implement, at a <br />
minimum, the security requirements in <br />
National Institute of Standards and
 
Technology (NIST) Special Publication <br />
(SP) 800–171 R2, ''Protecting CUI in <br />
Nonfederal Systems and Organizations. <br />
''Contractors are also required to flow <br />
down DFARS clause 252.204–7012 to <br />
all subcontracts for operationally critical <br />
support or for which subcontractor <br />
performance will involve covered <br />
defense information.
 
However, neither FAR clause 52.204–
 
21 nor DFARS clause 252.204–7012 <br />
provide for DoD assessment of a <br />
contractor’s implementation of the <br />
information protection requirements <br />
required by those clauses. The <br />
Department developed the CMMC <br />
Program to verify implementation of <br />
cybersecurity requirements in DoD <br />
contracts and subcontracts, by assessing <br />
adequacy of contractor information <br />
system security compliance prior to <br />
award and during performance of the <br />
contract. With limited exceptions, the <br />
Department intends to require <br />
compliance with CMMC as a condition <br />
of contract award. Once CMMC is <br />
implemented, the required CMMC <br />
Status will be specified in the <br />
solicitation and resulting contract. <br />
Contractors handling FCI or CUI will be <br />
required to meet the CMMC Status <br />
specified in the contract.
 
There are three different levels of
 
CMMC assessment, starting with basic <br />
safeguarding of FCI at Level 1, moving <br />
to the broad protection of CUI at Level <br />
2, and culminating with higher level <br />
protection of CUI against risk from <br />
Advanced Persistent Threats (APTs) at <br />
Level 3. The benefits and costs <br />
associated with implementing this final <br />
rule, as well as alternative approaches <br />
considered, are as follows:
 
'''Costs '''
 
A Regulatory Impact Analysis (RIA)
 
that includes a detailed discussion and <br />
explanation about the assumptions and <br />
methodology used to estimate the cost <br />
of this regulatory action follows and is <br />
available at [http://www.regulations.gov ''www.regulations.gov ''](search <br />
for ‘‘DoD–2023–OS–0063,’’ click ‘‘Open <br />
Docket,’’ and view ‘‘Supporting <br />
Documents’’).
 
'''Background '''
 
The Department of Defense (DoD or
 
Department) requires a secure and <br />
resilient supply chain to ensure the <br />
development, production, and <br />
sustainment of capabilities critical to <br />
national security. The DoD supply chain <br />
is targeted by adversaries with <br />
increasing frequency and sophistication, <br />
and to devastating effect. Therefore, <br />
implementation of cybersecurity <br />
standards and enforcement mechanisms <br />
are critically important. Executive Order <br />
(E.O.) 14028, ‘‘Improving the Nation’s
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00081
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83172 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
31
 
[http://www.gao.gov/assets/gao-22-104746.pdf ''www.gao.gov/assets/gao-22-104746.pdf''. ]
 
32
 
[http://www.ic3.gov/Media/News/2021/210310.pdf ''www.ic3.gov/Media/News/2021/210310.pdf''. ]
 
33
 
[http://www.cisa.gov/uscert/ncas/current-activity/2021/07/04/cisa-fbi-guidance-msps-and-their-customers-affected-kaseya-vsa ''www.cisa.gov/uscert/ncas/current-activity/ '']
 
[http://www.cisa.gov/uscert/ncas/current-activity/2021/07/04/cisa-fbi-guidance-msps-and-their-customers-affected-kaseya-vsa ''2021/07/04/cisa-fbi-guidance-msps-and-their- <br />
customers-affected-kaseya-vsa''. ]
 
34
 
[http://www.mitre.org/sites/default/files/publications/pr-18-2417-deliver-uncompromised-MITRE-study-26AUG2019.pdf ''www.mitre.org/sites/default/files/publications/ '']
 
[http://www.mitre.org/sites/default/files/publications/pr-18-2417-deliver-uncompromised-MITRE-study-26AUG2019.pdf ''pr-18-2417-deliver-uncompromised-MITRE-study- <br />
26AUG2019.pdf''. ]
 
35
 
[http://www.cisa.gov/uscert/ncas/alerts/aa22-057a ''www.cisa.gov/uscert/ncas/alerts/aa22-057a''. ]
 
Cybersecurity,’’ emphasizes the need to <br />
strengthen cybersecurity protections for <br />
both the Federal Government and the <br />
private sector.
 
Nation-state adversaries attack the
 
U.S. supply chain for a myriad of <br />
reasons, including exfiltration of <br />
valuable technical data (a form of <br />
industrial espionage); disruption to <br />
control systems used for critical <br />
infrastructure, manufacturing, and <br />
weapons systems; corruption of quality <br />
and assurance across a broad range of <br />
product types and categories; and <br />
manipulation of software to achieve <br />
unauthorized access to connected <br />
systems and to degrade the integrity of <br />
system operations. For example, since <br />
September 2020, major cyber-attacks <br />
such as the SolarWinds,31 Colonial <br />
Pipeline, Hafnium,32 and Kaseya 33 <br />
attacks, have been spearheaded or <br />
influenced by nation-state actors 34 and <br />
resulted in significant failures and <br />
disruption. In context of this threat, the <br />
size and complexity of defense <br />
procurement activities provide <br />
numerous pathways for adversaries to <br />
access DoD’s sensitive systems and <br />
information. Moreover, adversaries <br />
continue to evolve their tactics, <br />
techniques, and procedures. For <br />
example, on April 28, 2022, CISA and <br />
the FBI issued an advisory on <br />
destructive ‘‘wiperware,’’ a form of <br />
malware which can destroy valuable <br />
information 35. Protection of FCI and <br />
CUI is critically important, and the DoD <br />
needs assurance that contactor <br />
information systems are adequately <br />
secured to protect such information <br />
when it resides on or transits those <br />
systems.
 
The Department is committed to
 
working with defense contractors to <br />
protect FCI and CUI.
 
• Federal Contract Information (FCI):
 
As defined in section 4.1901 of the FAR, <br />
FCI means information, not intended for <br />
public release, that is provided by or <br />
generated for the Government under a <br />
contract to develop or deliver a product <br />
or service to the Government, but not <br />
including information provided by the <br />
Government to the public, such as that <br />
on public websites, or simple <br />
transactional information, such as that <br />
necessary to process payments.
 
• Controlled Unclassified Information
 
(CUI): 32 CFR 2002.4(h) defines CUI, in
 
part, as information the Government <br />
creates or possesses, or that an entity <br />
creates or possesses for or on behalf of <br />
the Government, that a law, regulation, <br />
or Government-wide policy requires or <br />
permits an agency to handle using <br />
safeguarding or dissemination controls, <br />
including FCI.
 
In September 2020, the DoD
 
published 48 CFR CMMC interim final <br />
rule (DFARS Case 2019–D041, 85 FR <br />
48513, September 9, 2020), which <br />
implemented DoD’s vision for the initial <br />
Cybersecurity Maturity Model <br />
Certification (CMMC) Program and <br />
outlined basic program features, to <br />
include: 5-level tiered model, CMMC <br />
Certified Third Party Assessment <br />
Organization (C3PAO) assessments in <br />
support of contractor and subcontractor <br />
certification, with no allowance for a <br />
Plan of Action and Milestones <br />
(POA&amp;Ms), and implementation of all <br />
security requirements by the time of a <br />
contract award. A total of 750 comments <br />
were received on the 48 CFR CMMC <br />
interim final rule during the public <br />
comment period that ended on <br />
November 30, 2020. These comments <br />
highlighted a variety of industry <br />
concerns including concerns relating to <br />
the costs for a C3PAO certification, and <br />
the costs and burden associated with <br />
implementing, prior to award, the <br />
required process maturity and 20 <br />
additional cybersecurity practices that <br />
were included in the initial CMMC <br />
Program. The Small Business <br />
Administration Office of Advocacy also <br />
raised similar concerns on the impact <br />
the rule would have on small businesses <br />
in the DIB.
 
Pursuant to DFARS clause 252.204–
 
7012, DoD has required certain defense <br />
contractors and subcontractors to <br />
implement the security protections set <br />
forth in the National Institute of <br />
Standards and Technology (NIST) <br />
Special Publication (SP) 800–171 R2 to <br />
provide adequate security for CUI that is <br />
processed, stored, or transmitted on <br />
contractor information systems. The <br />
CMMC Program provides the <br />
Department the mechanism needed to <br />
verify that a defense contractor or <br />
subcontractor has implemented the <br />
security requirements at each CMMC <br />
Level and is maintaining that status <br />
across the contract period of <br />
performance, as required.
 
In calendar year (CY) 2021 DoD
 
paused the planned CMMC rollout to <br />
conduct an internal review of the <br />
CMMC Program. The internal review <br />
resulted in a refined and streamlined set <br />
of requirements that addressed many of <br />
the concerns identified in the public <br />
comments received relating to the initial <br />
CMMC Program. These changes have
 
been incorporated into the revised <br />
CMMC Program structure and policies. <br />
In July 2022, the CMMC PMO met with <br />
the Office of Advocacy for the United <br />
States Small Business Administration <br />
(SBA) to address the revisions planned <br />
to the CMMC Program that are <br />
responsive to prior SBA concerns.
 
The CMMC Program will enhance the
 
ability of the DoD to safely share FCI <br />
and CUI with defense contractors and <br />
know the information will be suitably <br />
safeguarded. Once fully implemented, <br />
CMMC will incorporate a set of <br />
cybersecurity requirements into <br />
acquisition contracts to provide <br />
verification that applicable cyber <br />
protections have been implemented. <br />
Under the CMMC Program, defense <br />
contractors and subcontractors will be <br />
required to implement certain <br />
cybersecurity protection requirements <br />
tied to a designated CMMC level and <br />
either perform a self-assessment or <br />
obtain an independent assessment from <br />
either a C3PAO or DCMA DIBCAC as a <br />
condition of a DoD contract award. <br />
CMMC is designed to validate the <br />
protection of FCI and CUI that is shared <br />
with and generated by the Department’s <br />
contractors and subcontractors. Through <br />
protection of information by adherence <br />
to the requirements verified in the <br />
revised CMMC Program, the Department <br />
and its contractors will prevent <br />
disruption in service and the loss of <br />
intellectual property and assets, and <br />
thwart access to FCI and CUI by the <br />
nation’s adversaries.
 
The CMMC Program is intended to:
 
(1) align cybersecurity requirements to <br />
the sensitivity of unclassified <br />
information to be protected, and (2) add <br />
a certification element, where <br />
appropriate, to verify implementation of <br />
cybersecurity requirements. As part of <br />
the program, DoD also intends to <br />
provide supporting resources and <br />
training to defense contractors to help <br />
support companies who are working to <br />
achieve the required CMMC Status. The <br />
CMMC Program provides for assessment <br />
at three levels: basic safeguarding of FCI <br />
at CMMC Level 1, broad protection of <br />
CUI at CMMC Level 2, and enhanced <br />
protection of CUI against risk from <br />
Advanced Persistent Threats (APTs) at <br />
CMMC Level 3. The CMMC Program is <br />
designed to provide increased assurance <br />
to the Department that a defense <br />
contractor can adequately protect FCI <br />
and CUI in accordance with prescribed <br />
security requirements, accounting for <br />
information flow down to its <br />
subcontractors in a multi-tier supply <br />
chain.
 
The CMMC Program addresses DoD’s
 
need to protect FCI and CUI during the <br />
acquisition and sustainment of products
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00082
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83173 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
36
 
DODIG–2019–105 ‘‘Audit of Protection of DoD
 
CUI on Contractor-Owned Networks and Systems.’’
 
and services from the DIB. This effort is <br />
instrumental in establishing <br />
cybersecurity as a foundation for future <br />
DoD acquisition.
 
Although DoD contract requirements
 
to provide adequate security for covered <br />
defense information (reflected in <br />
DFARS clause 252.204–7012) predate <br />
CMMC by many years, a certification <br />
requirement for the handling of CUI to <br />
assess a contractor or subcontractor’s <br />
compliance of those required <br />
information security controls is new <br />
with the CMMC Program. Findings from <br />
DoD Inspector General report 36 indicate <br />
that DoD contractors did not <br />
consistently implement mandated <br />
system security requirements for <br />
safeguarding CUI and recommended <br />
that DoD take steps to assess a <br />
contractor’s ability to protect this <br />
information. The report emphasizes that <br />
malicious actors can exploit the <br />
vulnerabilities of contractors’ networks <br />
and systems and exfiltrate information <br />
related to some of the Nation’s most <br />
valuable advanced defense technologies.
 
Currently, the FAR and DFARS
 
prescribe contract clauses intended to <br />
protect FCI and CUI. Specifically, the <br />
clause at FAR 52.204–21, ''Basic <br />
Safeguarding of Covered Contractor <br />
Information Systems'', is prescribed at <br />
FAR 4.1903 for use in Government <br />
solicitations and contracts when the <br />
contractor or a subcontractor at any tier <br />
may have FCI residing in or transiting <br />
through its information system(s). This <br />
clause requires contractors and <br />
subcontractors to implement basic <br />
safeguarding requirements and <br />
procedures to protect FCI being <br />
processed, stored, or transmitted on <br />
contractor information systems. In <br />
addition, DFARS clause 252.204–7012, <br />
''Safeguarding Covered Defense <br />
Information and Cyber Incident <br />
Reporting'', is prescribed at DFARS <br />
204.7304(c) for use in all solicitations <br />
and contracts except for solicitations <br />
and contracts solely for the acquisition <br />
of commercially available off-the-shelf <br />
(COTS) items. This clause requires <br />
contractors and subcontractors to <br />
provide ‘‘adequate security’’ to process, <br />
store or transmit covered defense <br />
information when it resides on or <br />
transits a contractor information system, <br />
and to report cyber incidents that affect <br />
that system or network. The clause <br />
states that to provide adequate security, <br />
the contractor shall implement, at a <br />
minimum, the security requirements in <br />
NIST Special Publication (SP) 800–171 <br />
R2, ''Protecting CUI in Nonfederal <br />
Systems and Organizations. ''Contractors
 
are also required to flow down DFARS <br />
clause 252.204–7012 to all subcontracts <br />
that require processing, storing, or <br />
transmitting of covered defense <br />
information.
 
However, neither FAR clause 52.204–
 
21 nor DFARS clause 252.204–7012 <br />
provide for DoD verification of a <br />
contractor’s implementation of the basic <br />
safeguarding requirements specified in <br />
FAR clause 52.204–21 nor the security <br />
requirements specified in NIST SP 800– <br />
171 R2, implementation of which is <br />
required by DFARS clause 252.204– <br />
7012, prior to contract award. As part of <br />
multiple lines of effort focused on the <br />
security and resilience of the DIB, the <br />
Department is working with industry to <br />
enhance the protection of FCI and CUI <br />
within the DoD supply chain. Toward <br />
this end, DoD has developed the CMMC <br />
Program.
 
''Revised CMMC Program Requirements ''
 
The CMMC Program requirements
 
will be implemented through the DoD <br />
acquisition and contracting process. <br />
With limited exceptions, the <br />
Department intends to require <br />
compliance with CMMC as a condition <br />
of contract award. Once CMMC is <br />
implemented, the required CMMC <br />
Status will be specified in the <br />
solicitation and resulting contract. <br />
Contractors handling FCI or CUI will be <br />
required to meet the CMMC Status <br />
specified in the contract. In accordance <br />
with the implementation plan described <br />
in § 170.3(e), CMMC Status <br />
requirements will apply to new DoD <br />
solicitations and contracts, and shall <br />
flow down to subcontractors, based on <br />
the sensitivity of the FCI and CUI to be <br />
processed, stored or transmitted to or by <br />
the subcontractor. Before contract <br />
award, the offeror must achieve the <br />
specified CMMC Status for the <br />
contractor information system (''e.g., <br />
''enterprise network, network enclave) <br />
that will process, store, or transmit the <br />
information to be protected. The <br />
contractor or subcontractor will also <br />
submit affirmations in the Supplier <br />
Performance Risk System (SPRS). An <br />
overview of requirements at each level <br />
is shown:
 
Level 1 Self-Assessment
 
• Level 1 self-assessment requires
 
compliance with basic safeguarding <br />
requirements to protect FCI are set forth <br />
in FAR clause 52.204–21. CMMC Level <br />
1 does not add any additional security <br />
requirements to those identified in FAR <br />
clause 52.204–21.
 
• OSAs will submit the following
 
information in SPRS:
 
1. the results of a self-assessment of
 
the OSA’s implementation of the basic
 
safeguarding requirements set forth in <br />
§ 170.15 associated with the contractor <br />
information system(s) used in <br />
performance of the contract; and
 
2. an initial affirmation of
 
compliance, and then annually <br />
thereafter, an affirmation of continued <br />
compliance as set forth in § 170.22.
 
3. the Level 1 self-assessment cost
 
burden will be addressed as part of the <br />
48 CFR part 204 CMMC Acquisition <br />
final rule.
 
Level 2 Self-Assessment
 
• Level 2 self-assessment requires
 
compliance with the security <br />
requirements set forth in NIST SP 800– <br />
171 R2 to protect CUI. CMMC Level 2 <br />
does not add any additional security <br />
requirements to those identified in NIST <br />
SP 800–171 R2.
 
• OSAs will submit the following
 
information in SPRS:
 
1. the results of a self-assessment of
 
the OSA’s implementation of the NIST <br />
SP 800–171 R2 requirements set forth in <br />
§ 170.16 associated with the covered <br />
contractor information system(s) used in <br />
performance of the applicable contract.
 
2. an initial affirmation of
 
compliance, and, if applicable, a <br />
POA&amp;M closeout affirmation, and then <br />
annually thereafter, an affirmation of <br />
continued compliance set forth in <br />
§ 170.22.
 
3. the Level 2 self-assessment cost
 
burden will be addressed as part of the <br />
48 CFR part 204 CMMC Acquisition <br />
final rule.
 
Level 2 Certification Assessment
 
• Level 2 certification assessment
 
requires compliance with the security <br />
requirements set forth in in § 170.17 to <br />
protect CUI. CMMC Level 2 does not <br />
add any additional security <br />
requirements to those selected in NIST <br />
SP 800–171 R2.
 
• A Level 2 certification assessment
 
of the applicable contractor information <br />
system(s) provided by an authorized or <br />
accredited C3PAO is required to <br />
validate implementation of the NIST SP <br />
800–171 R2 security requirements prior <br />
to award of any prime contract or <br />
subcontract and exercise of option.
 
• The C3PAO will upload the Level 2
 
certification assessment results in the <br />
CMMC instantiation of eMASS which <br />
will feed the information into SPRS.
 
• OSCs will submit in SPRS an initial
 
affirmation of compliance, and, if <br />
necessary, a POA&amp;M closeout <br />
affirmation, and then annually <br />
following the Final CMMC Status Date, <br />
an affirmation of continued compliance <br />
as set forth in § 170.22.
 
The Level 2 certification assessment
 
cost burdens are included in this part
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00083
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83174 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
with the exception of the requirement <br />
for the OSC to upload the affirmation in <br />
SPRS that is included in the 48 CFR part <br />
204 CMMC Acquisition final rule and <br />
an update to DFARS collection <br />
approved under OMB Control Number <br />
0750–0004, ''Assessing Contractor <br />
Implementation of Cybersecurity <br />
Requirements''. Additionally, the <br />
information collection reporting <br />
requirements for the CMMC <br />
instantiation of eMASS are included in <br />
a separate ICR for this part and cover <br />
only those requirements pertaining to <br />
the CMMC process.
 
Level 3 Certification Assessment
 
• Level 3 certification assessment
 
requires the CMMC Status of Final Level <br />
2 (C3PAO) and compliance with the <br />
security requirements set forth in <br />
§ 170.18 to protect CUI. CMMC Level 3 <br />
adds additional security requirements to <br />
those required by existing acquisition <br />
regulations as specified in this rule.
 
• A Level 3 certification assessment
 
of the applicable contractor information <br />
system(s) provided by the DCMA <br />
Defense Industrial Base Cybersecurity <br />
Assessment Center (DIBCAC) is required <br />
to validate implementation of the DoD- <br />
defined selected security requirements <br />
set forth in NIST SP 800–172 Feb2021. <br />
A CMMC Status of Final Level 2 <br />
(C3PAO) is a prerequisite to schedule a <br />
DCMA DIBCAC Level 3 certification <br />
assessment.
 
• DCMA DIBCAC will upload the
 
Level 3 certification assessment results <br />
into the CMMC instantiation of eMASS, <br />
which will feed the information into <br />
SPRS.
 
• OSCs will submit in SPRS an initial
 
affirmation of compliance, and, if <br />
necessary, a POA&amp;M closeout <br />
affirmation, and then annually <br />
following the Final CMMC Status Date, <br />
an affirmation of continued compliance <br />
as set forth in § 170.22.
 
The Level 3 certification assessment
 
cost burdens are included in this part <br />
with the exception of the requirement <br />
for the OSC to upload the affirmation in <br />
SPRS that is included in the 48 CFR part <br />
204 CMMC Acquisition rule and an <br />
update to DFARS collection approved <br />
under OMB Control Number 0750–0004, <br />
Assessing Contractor Implementation of <br />
Cybersecurity Requirements. <br />
Additionally, the information collection <br />
reporting requirements for the CMMC <br />
instantiation of eMASS are included in <br />
a separate ICR for this part and cover <br />
only those requirements pertaining to <br />
the CMMC process. As described, the <br />
CMMC Program couples an affirmation <br />
of compliance with certification <br />
assessment requirements to verify OSA
 
implementation of cybersecurity <br />
requirements, as applicable.
 
The CMMC Program addresses DoD’s
 
need to protect FCI and CUI during the <br />
acquisition and sustainment of products <br />
and services from the DIB. This effort is <br />
instrumental in ensuring cybersecurity <br />
is the foundation of future DoD <br />
acquisitions.
 
'''Policy Problems Addressed by the <br />
Revised CMMC Program '''
 
Implementation of the CMMC
 
Program is intended to solve the <br />
following policy problems:
 
''Lack of Verification of Contractor <br />
Compliance With Cybersecurity <br />
Requirements ''
 
Neither FAR clause 52.204–21 nor
 
DFARS clause 252.204–7012 provide for <br />
DoD assessment of a defense contractor <br />
or subcontractor’s implementation of <br />
the information protection requirements <br />
within those clauses. Defense <br />
contractors represent that they will <br />
implement the requirements in NIST SP <br />
800–171 R2 upon submission of their <br />
offer. Findings from DoD Inspector <br />
General report (DODIG–2019–105 <br />
‘‘Audit of Protection of DoD Controlled <br />
Unclassified Information on Contractor- <br />
Owned Networks and Systems’’) <br />
indicate that DoD contractors did not <br />
consistently implement mandated <br />
system security requirements for <br />
safeguarding CUI and recommended <br />
that DoD take steps to assess a <br />
contractor’s ability to protect this <br />
information. CMMC adds new <br />
assessment requirements for contractor <br />
implementation of underlying <br />
information security requirements, to <br />
allow DoD to assess a defense <br />
contractor’s cybersecurity posture using <br />
authorized or accredited C3PAOs. The <br />
contractor and subcontractor must <br />
achieve the required CMMC Level as a <br />
condition of contract award.
 
''Inadequate Implementation of <br />
Cybersecurity Requirements ''
 
Under DFARS clause 252.204–7012
 
and DFARS clause 252.204–7020, <br />
defense contractors and subcontractors <br />
must document implementation of the <br />
security requirements in NIST SP 800– <br />
171 R2 in a system security plan and <br />
may use a plan of action to describe <br />
how and when any unimplemented <br />
security requirements will be met. For <br />
the CMMC Program, the solicitation and <br />
resulting contract, will specify the <br />
required CMMC Status, which will be <br />
determined considering program <br />
criticality, information sensitivity, and <br />
severity of cyber threat. Although the <br />
security requirements in NIST SP 800– <br />
171 R2 address a range of threats,
 
additional requirements are needed to <br />
significantly reduce the risk posed by <br />
APTs. An APT is an adversary that <br />
possesses sophisticated levels of <br />
expertise and significant resources that <br />
allow it to create opportunities to <br />
achieve its objectives by using multiple <br />
attack vectors (''e.g., ''cyber, physical, and <br />
deception). CMMC Level 3 requires <br />
implementation of selected security <br />
requirements from NIST SP 800–172 <br />
Feb2021 to reduce the risk of APT <br />
threats.
 
The CMMC Program will require
 
prime contractors to flow the <br />
appropriate CMMC Status requirement <br />
down throughout the entire supply <br />
chain relevant to a particular contract. <br />
Defense contractors or subcontractors <br />
that handle FCI, must meet the <br />
requirements for CMMC Level 1. <br />
Defense contractors that handle CUI <br />
must meet the requirements for CMMC <br />
Level 2 or higher, depending on the <br />
sensitivity of the information associated <br />
with a program or technology being <br />
developed.
 
''Insufficient Scale and Depth of <br />
Resources To Verify Compliance ''
 
Today, DoD prime contractors must
 
include DFARS clause 252.204–7012 in <br />
subcontracts for which performance will <br />
involve covered defense information, <br />
but this does not provide the <br />
Department with sufficient insights with <br />
respect to the cybersecurity posture of <br />
all members of a multi-tier supply chain <br />
for any given program or technology <br />
development effort. The revised CMMC <br />
Program requires prime contractors to <br />
flow down appropriate CMMC Status <br />
requirements, as applicable, to <br />
subcontractors throughout their supply <br />
chain(s).
 
Given the size and scale of the DIB,
 
the Department cannot scale its existing <br />
cybersecurity assessment capability to <br />
conduct on-site assessments of <br />
approximately 220,000 DoD contractors <br />
and subcontractors every three years. <br />
The Department’s existing assessment <br />
capability is best suited for conducting <br />
targeted assessments for the relatively <br />
small subset of DoD contractors and <br />
subcontractors that support designated <br />
high-priority programs involving CUI.
 
CMMC addresses the Department’s
 
scaling challenges by utilizing a private- <br />
sector accreditation structure. A DoD- <br />
authorized Accreditation Body will <br />
authorize, accredit, and provide <br />
oversight of C3PAOs which in turn will <br />
conduct Level 2 certification <br />
assessments of actual and prospective <br />
DoD contractors and subcontractors. <br />
Defense contractors will directly <br />
contract with an authorized or <br />
accredited C3PAO to obtain a Level 2
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00084
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83175 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
certification assessment. The cost of <br />
Level 2 certification assessment <br />
activities is driven by multiple factors, <br />
including market forces that govern <br />
availability of C3PAOs and the size and <br />
complexity of the enterprise or enclave <br />
under assessment. The Government will <br />
perform Level 3 certification <br />
assessments. Government resource <br />
limitations may affect schedule <br />
availability.
 
''Reduces Duplicate or Respective <br />
Assessments of Our Industry Partners ''
 
CMMC assessment results will be
 
posted in SPRS, DoD’s authoritative <br />
source for supplier and product <br />
performance information. Posting <br />
CMMC assessment results in SPRS <br />
precludes the need to validate CMMC <br />
implementation on a contract-by- <br />
contract basis. This enables DoD to <br />
identify whether the CMMC <br />
requirements have been met for relevant <br />
contractor information systems, avoids <br />
duplicative assessments, and eliminates <br />
the need for program level assessments, <br />
all of which decreases costs to both DoD <br />
and industry.
 
''Revised CMMC Program <br />
Implementation ''
 
The DoD is implementing a phased
 
implementation for the revised CMMC <br />
Program and intends to introduce <br />
CMMC Status requirements in <br />
solicitations over a three-year period to <br />
provide appropriate ramp-up time. This <br />
phased implementation is intended to <br />
minimize the financial impacts to <br />
defense contractors, especially small <br />
businesses, and disruption to the <br />
existing DoD supply chain. After CMMC <br />
is implemented in acquisition <br />
regulation, DoD will include CMMC <br />
self-assessment requirements in <br />
solicitations and resulting contracts <br />
when warranted by the type of <br />
information that will be handled by the <br />
contractor of subcontractor(s). CMMC <br />
Status requirements for Levels 1, 2, and <br />
3 will be included in solicitations and <br />
resulting contracts issued after the <br />
phase-in period when warranted by any <br />
FCI and/or CUI information protection <br />
requirements for the contract effort. In <br />
the intervening period, Government <br />
Program Managers will have discretion <br />
to include CMMC Status requirements <br />
or exclude them and rely upon existing <br />
DFARS clause 252.204–7012 <br />
requirements, in accordance with DoD <br />
policy. As stated in § 170.20(a), there is <br />
qualified standards acceptance between <br />
DCMA DIBCAC High Assessment and <br />
the CMMC Status of Level 2(C3PAO), <br />
which will result in staggering of the <br />
dates for new Level 2 certification <br />
assessments. The implementation
 
period will consist of four (4) phases as <br />
set forth in § 170.3(e), during which <br />
time the Government will include <br />
CMMC requirements in certain <br />
solicitations and contracts. During the <br />
CMMC phase-in period, program <br />
managers and requiring activities will <br />
be required to include CMMC Status <br />
requirements in certain solicitations and <br />
contracts and will have discretion to <br />
include in others.
 
A purpose of the phased
 
implementation is to ensure adequate <br />
availability of authorized or accredited <br />
C3PAOs and assessors to meet the <br />
demand.
 
''Revised CMMC Program Flow Down ''
 
CMMC Level requirements will be
 
flowed down to subcontractors at all <br />
tiers as set forth in § 170.23; however, <br />
the specific CMMC Status required for <br />
a subcontractor will be based on the <br />
type of unclassified information and the <br />
priority of the acquisition program and/ <br />
or technology being developed.
 
'''Key Changes Incorporated in the <br />
Revised CMMC Program '''
 
In November 2021, the Department
 
announced the revised CMMC Program, <br />
which is an updated program structure <br />
with revised requirements. In the <br />
revised CMMC Program, the Department <br />
has introduced several key changes that <br />
build on and refine the original program <br />
requirements. These include:
 
• Streamlining the model from five
 
levels to three levels.
 
• Exclusively implementing National
 
Institute of Standards and Technology <br />
(NIST) cybersecurity standards and <br />
guidelines.
 
• Allowing all companies subject to
 
Level 1, and a subset of companies <br />
subject to Level 2 to demonstrate <br />
compliance through self-assessments.
 
• Increased oversight of professional
 
and ethical standards of CMMC third- <br />
party assessors.
 
• Allowing Plans of Action &amp;
 
Milestones (POA&amp;M) under limited <br />
circumstances to achieve conditional <br />
certification.
 
As a result of the alignment of the
 
revised CMMC Program to NIST <br />
guidelines, the Department’s <br />
requirements will continue to evolve as <br />
changes are made to the underlying <br />
NIST SP 800–171 R2, NIST SP 800– <br />
171A Jun2018, NIST SP 800–172 <br />
Feb2021, and NIST SP 800–172A <br />
Mar2022 requirements.
 
'''CMMC Assessment '''
 
Assessment Criteria
 
CMMC requires that defense
 
contractors and subcontractors
 
entrusted with FCI and CUI implement <br />
cybersecurity standards at progressively <br />
more secure levels, depending on the <br />
type and sensitivity of the information.
 
Level 1 Self-Assessment
 
An annual Level 1 self-assessment
 
and annual affirmation asserts that an <br />
OSA has implemented all the basic <br />
safeguarding requirements to protect <br />
FCI as set forth in § 170.14(c)(2).
 
An OSA can choose to perform the
 
annual self-assessment internally or <br />
engage a third-party to assist with <br />
evaluating its Level 1 compliance. Use <br />
of a third party to assist with the <br />
assessment process is still considered a <br />
self-assessment and results in a CMMC <br />
Status of Final Level 1 (Self). An OSA <br />
achieve the CMMC Status of Level 1 <br />
(Self) for an entire enterprise network or <br />
for a particular enclave(s), depending <br />
upon where the FCI is or will be <br />
processed, stored, or transmitted.
 
Level 2 Self-Assessment
 
A Level 2 self-assessment and annual
 
affirmation attests that an OSA has <br />
implemented all the security <br />
requirements to protect CUI as specified <br />
in § 170.14(c)(3).
 
Level 2 Certification Assessment
 
A Level 2 certification assessment,
 
conducted by a C3PAO, verifies that an <br />
OSC is conforming to the security <br />
requirements to protect CUI as specified <br />
in § 170.14(c)(3). Each OSC information <br />
system that will process, store, or <br />
transmit CUI in the execution of the <br />
contract is subject to the corresponding <br />
CMMC Status requirements set forth in <br />
the contract.
 
Level 3 Certification Assessment
 
Achievement of the CMMC Status of
 
Final Level 2 (C3PAO) for information <br />
systems within the Level 3 CMMC <br />
Assessment Scope is a prerequisite for <br />
initiating a Level 3 certification <br />
assessment. A Level 3 certification <br />
assessment, conducted by DCMA <br />
Defense Industrial Base Cybersecurity <br />
Assessment Center (DIBCAC), verifies <br />
that an OSC has implemented the <br />
CMMC Level 3 security requirements to <br />
protect CUI as specified in <br />
§ 170.14(c)(4). A Level 3 certification <br />
assessment must be conducted for each <br />
OSC information system that will be <br />
used in the execution of the contract <br />
that will process, store, or transmit CUI.
 
'''Impact and Cost Analysis of the <br />
Revised CMMC Program '''
 
''Summary of Impact ''
 
Public comment feedback on the
 
initial CMMC Program indicated that <br />
cost estimates were too low. The revised
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00085
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83176 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
CMMC Program cost estimates account <br />
for that feedback with the following <br />
improvements:
 
• Allowance for outsourced IT
 
services
 
• Increased total time for the
 
contractor to prepare for the assessment, <br />
including limited time for learning the <br />
reporting and affirmation processes
 
• Allowance for use of consulting
 
firms to assist with the assessment <br />
process
 
• Time for a senior level manager to
 
review the assessment and affirmation <br />
before submitting the results in SPRS
 
• Updated government and contractor
 
labor rates that include applicable <br />
burden costs
 
As a result, some costs of the revised
 
CMMC Program may be higher than <br />
those included in the initial CMMC <br />
Program.
 
The revised CMMC Program impact
 
analysis includes estimated costs for
 
implementation of the revised CMMC <br />
Program requirements across Level 1, <br />
Level 2, and Level 3 for the Public <br />
(small and other than small entities, <br />
including the CMMC Ecosystem as set <br />
forth in 32 CFR subpart C) and the <br />
Government. In summary, the total <br />
estimated Public and Government costs <br />
associated with this rule, calculated for <br />
a 20-year horizon in 2023 dollars at a 7 <br />
percent discount rate and a 3 percent <br />
discount rate are provided as follows:
 
Estimating the number of CMMC
 
assessments for unique entities per level <br />
per year is complicated by the fact that <br />
companies may serve as a prime <br />
contractor on one effort but a <br />
subcontractor on others, and may also <br />
enter into subcontract agreements with <br />
more than one prime contractor for <br />
various opportunities.
 
In addition, the CMMC Program relies
 
upon free market influences of supply <br />
and demand to propel implementation. <br />
Specifically, the Department does not <br />
control which defense contractors aspire
 
to compete for which business <br />
opportunities, nor does it control access <br />
to the assessment services offered by <br />
C3PAOs. OSAs may elect to complete a <br />
self-assessment or pursue a certification <br />
assessment at any time after issuance of <br />
the rule, in an effort to distinguish- <br />
themselves as competitive for efforts <br />
that require an ability to adequately <br />
protect CUI. For that reason, the number <br />
of CMMC assessments for unique <br />
entities per level per year may vary <br />
significantly from the assumptions used
 
in generating the cost estimate. The <br />
estimates represent the best estimates at <br />
this time based on internal expertise <br />
and public feedback.
 
DoD utilized historical metrics
 
gathered for the initial CMMC Program <br />
and subject matter expertise from <br />
Defense Pricing and Contracting (DPC) <br />
and DCMA DIBCAC to estimate the <br />
number of entities by type and by <br />
assessment level for this analysis. The <br />
following table summarizes the <br />
estimated profile used in this analysis.
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00086
 
Fmt 4701
 
Sfmt 4725
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.002&lt;/GPH&gt;
 
ER15OC24.001&lt;/GPH&gt;
 
ER15OC24.003&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83177 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
DoD is planning for a phased roll-out
 
of each assessment level across 7 years <br />
with the entity numbers reaching a <br />
maximum by Year 4 as shown in the <br />
tables. The target of Year 4 was selected <br />
based on the projected capacity of the
 
CMMC Ecosystem to grow to efficiently <br />
support the entities in the pipeline. For <br />
modeling efficiency, a similar roll-out is <br />
assumed regardless of entity size or <br />
assessment level. It is assumed that by <br />
year 7 the maximum number of entities
 
is reached. Beyond year 7, the number <br />
of entities entering and exiting are <br />
expected to net to zero. The following <br />
tables reflect the number of new entities <br />
in each year and for each level.
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00087
 
Fmt 4701
 
Sfmt 4725
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.004&lt;/GPH&gt;
 
ER15OC24.005&lt;/GPH&gt;
 
ER15OC24.006&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83178 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
37
 
The number of unique awardees impacted each
 
year is 1⁄3 of the average number of annual awardees <br />
according to the Electronic Data Access system <br />
(31,338/3 = 10,446). This estimate does not address <br />
new entrants or awardees who discontinue doing <br />
business with DoD.
 
38
 
Includes all businesses with the exception of
 
those defined under the small business criteria and <br />
size standards provided in 13 CFR 121.201 (See <br />
FAR Part 19.102)
 
39
 
The Level I self-assessment and Level 2 self-
 
assessment information collection reporting and <br />
recordkeeping requirements will be included in a <br />
modification of an existing DFARS collection <br />
approved under OBM Control Number 0750–0004, <br />
Assessing Contractor Implementation of <br />
Cybersecurity Requirements. Modifications to this <br />
DFARS collection will be addressed as part of the <br />
48 CFR part 204 CMMC Acquisition rule.
 
40
 
The Level 1 self-assessment and Level 2 self-
 
assessment information collection reporting and <br />
recordkeeping requirements will be included in a <br />
modification of an existing DFARS collection <br />
approved under OBM Control Number 0750–0004, <br />
Assessing Contractor Implementation of <br />
Cybersecurity Requirements. Modifications to this <br />
DFARS collection will be addressed as part of the <br />
48 CFR part 204 CMMC Acquisition rule.
 
''Public Costs ''
 
Summary of Impacted Awardee Entities
 
According to data available in the
 
Electronic Data Access system for fiscal <br />
years (FYs) 2019, 2020, and 2021, DoD <br />
awards an average of 1,366,262
 
contracts and orders per year that <br />
contain DFARS clause 252.204–7012, to <br />
31,338 unique awardees, of which <br />
683,718 awards (50%) are made to <br />
23,475 small entities (75%).37
 
''Public Cost Analysis ''
 
The following is a summary of the
 
estimated Public costs the revised <br />
CMMC Program for other than small 38 <br />
entities, per assessment of a contractor <br />
information system, at the required <br />
periodicity for each CMMC level.
 
The following is a summary of the
 
estimated Public costs of the revised <br />
CMMC Program for Small Entities, per
 
assessment of each contractor <br />
information system, estimated at one
 
per entity, at the required periodicity for <br />
each CMMC level.
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00088
 
Fmt 4701
 
Sfmt 4725
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.007&lt;/GPH&gt;
 
ER15OC24.008&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83179 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
41
 
The terms nonrecurring engineering costs and
 
recurring engineering costs are terms of art and do <br />
not only encompass actual engineering costs.
 
The total estimated Public (large and
 
small entities) costs associated with this
 
rule, calculated for a 20-year horizon in <br />
2023 dollars at a 7 percent and 3 percent
 
discount rate, per OMB guidance, is <br />
provided as follows:
 
''Assumptions ''
 
In estimating the Public costs, DoD
 
considered applicable nonrecurring <br />
engineering costs, recurring engineering <br />
costs,41 assessment costs, and <br />
affirmation costs for each CMMC Level. <br />
For CMMC Levels 1 and 2, the cost <br />
estimates are based only upon the self- <br />
assessment, certification assessment, <br />
and affirmation activities that a defense <br />
contractor, subcontractor, or ecosystem <br />
member must take to allow DoD to <br />
verify implementation of the relevant <br />
underlying security requirements, ''i.e., <br />
''for CMMC Level 1, the security <br />
requirements set forth in FAR clause <br />
52.204–21, and for CMMC Level 2, the <br />
security requirements set forth in NIST <br />
SP 800–171 R2. DoD did not consider <br />
the cost of implementing the security <br />
requirements themselves because <br />
implementation is already required by <br />
FAR clause 52.204–21, effective June 15, <br />
2016, and by DFARS clause 252.204– <br />
7012, requiring implementation by Dec. <br />
31, 2017, respectively; therefore, the <br />
costs of implementing the security <br />
requirements for CMMC Levels 1 and 2 <br />
should already have been incurred and <br />
are not attributed to this rule. As such, <br />
the nonrecurring engineering and <br />
recurring engineering costs to <br />
implement the security requirements <br />
defined for CMMC Level 1 and Level 2 <br />
are not included in this economic <br />
analysis. However, cost estimates to <br />
implement CMMC Level 3, are <br />
included, as that CMMC level will <br />
require defense contractors and <br />
subcontractors, as applicable, to <br />
implement a DoD-defined subset of the <br />
security requirements set forth in NIST <br />
SP 800–172 Feb2021, a new addition to <br />
current security protection <br />
requirements.
 
In estimating the public cost for a
 
defense contractor small entity to <br />
comply with CMMC Program <br />
requirements for each CMMC level, DoD <br />
considered non-recurring engineering <br />
costs, recurring engineering costs, <br />
assessment costs, and affirmation costs
 
for each CMMC Level. These costs <br />
include labor and consulting.
 
Estimates include size and complexity
 
assumptions to account for typical <br />
organizational differences between <br />
small entities and other than small <br />
entities with respect to the handling of <br />
Information Technology (IT) and <br />
cybersecurity:
 
• small entities are likely to have a
 
less complex, less expansive operating <br />
environment and IT/Cybersecurity <br />
infrastructure compared to larger <br />
defense contractors
 
• small entities are likely to outsource
 
IT and cybersecurity to an External <br />
Service Provider (ESP)
 
• entities (small and other than small)
 
pursuing Level 2 self-assessment are <br />
likely to seek consulting or <br />
implementation assistance from an ESP <br />
to either help them prepare for the <br />
assessment technically or participate in <br />
the assessment with the C3PAOs.
 
Estimates do not include the cost to
 
implement (Non-recurring Engineering <br />
Costs (NRE)) or maintenance costs <br />
(Recurring Engineering (RE)) associated <br />
with the security requirements <br />
prescribed in current regulations.
 
For CMMC Levels 1 and 2, cost
 
estimates are based upon assessment, <br />
reporting, and affirmation activities that <br />
a contractor or subcontractor will need <br />
to take to verify implementation of <br />
existing security requirements set forth <br />
in FAR clause 52.204–21, effective June <br />
15, 2016, to protect FCI, and DFARS <br />
clause 252.204–7012 which required <br />
implementation of NIST SP 800–171 <br />
requirements not later than December <br />
31, 2017, to protect CUI. As such, cost <br />
estimates are not included for an entity <br />
to implement the CMMC Level 1 or 2 <br />
security requirements, maintain <br />
implementation of these existing <br />
security requirements, or remediate a <br />
plan of action for unimplemented <br />
requirements.
 
For CMMC Level 3, the cost estimates
 
factor in the assessment, reporting, and <br />
affirmation activities in addition to <br />
estimates for NRE and RE to implement <br />
and maintain CMMC Level 3 security <br />
requirements. In addition to <br />
implementing the CMMC Level 2 <br />
security requirements, CMMC Level 3
 
requires implementing selected security <br />
requirement set forth in NIST SP 800– <br />
172 Feb2021 as described in <br />
§ 170.14(c)(4) which are not currently <br />
required through other regulations. <br />
CMMC Level 3 is expected to apply only <br />
to a small subset of defense contractors <br />
and subcontractors.
 
The Cost Categories used for each
 
CMMC Level are described:
 
1. ''Nonrecurring Engineering Costs: ''
 
Estimates consist of hardware, software, <br />
and the associated labor to implement <br />
the same. Costs associated with <br />
implementing the requirements set forth <br />
in FAR clause 52.204–21 and NIST SP <br />
800–171 R2 are assumed to have been <br />
already implemented and, therefore, are <br />
not accounted for in this cost estimate. <br />
As such, these costs only appear in <br />
CMMC Level 3. If nonrecurring <br />
engineering costs are referenced, they <br />
are only accounted for as a one-time <br />
occurrence and are reflected in the year <br />
of the initial assessment.
 
2. ''Recurring Engineering Costs: ''
 
Estimates consist of annually recurring <br />
fees and associated labor for technology <br />
refresh. Costs associated with <br />
implementing the requirements set forth <br />
in FAR clause 52.204–21 and NIST SP <br />
800–171 R2 are assumed to have been <br />
already implemented and, therefore, are <br />
not accounted for in this cost estimate. <br />
As such, these costs only appear in <br />
CMMC Level 3.
 
3. ''Assessment Costs: ''Estimates consist
 
of activities for pre-assessment <br />
preparations (which includes gathering <br />
and/or developing evidence that the <br />
assessment objectives for each <br />
requirement have been satisfied), <br />
conducting and/or participating in the <br />
actual assessment, and completion of <br />
any post-assessment work. Assessment <br />
costs are represented by notional <br />
phases. Assessment costs assume the <br />
OSA passes the assessment on the first <br />
attempt (conditional—with an allowable <br />
POA&amp;M or final). Each phase includes <br />
an estimate of hours to conduct the <br />
assessment activities including: <br />
(a) Labor hour estimates for a company
 
(and any ESP support) to prepare <br />
for and participate in the <br />
assessment.
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00089
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.009&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83180 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
42
 
IT = Information Technology, MGMT =
 
Management.
 
43
 
IT and MGMT rates represent an estimate for
 
in-house labor and includes the labor rate plus <br />
fringe and employee-related expenses.
 
44
 
Background assumes a Bachelor’s degree as the
 
minimum education level, additional requirements <br />
are noted including required years of experience. A <br />
Master’s degree may reduce the required years of <br />
experience as noted.
 
45
 
The ESP/C3PAO rate represents an estimate for
 
outsourced labor and includes the labor rate, <br />
overhead expense, G&amp;A expense, and profit.
 
(b) C3PAO cost estimates for companies
 
pursuing a certification
 
• labor hour estimates for authorized or
 
certified assessors to work with the <br />
business to conduct the actual <br />
assessment
 
• Assessment Costs broken down into
 
phases
 
• Phase 1: Planning and preparing for
 
the assessment
 
• Phase 2: Conducting the assessment
 
(self or C3PAO)
 
• Phase 3: Reporting of Assessment
 
Results
 
• Phase 4: POA&amp;M Closeout (for
 
CMMC Level 3 only, if applicable <br />
and allowed)
 
• CMMC allows a limited open Plan
 
of Action and Milestones (POA&amp;M) <br />
for a period of 180 days to
 
remediate the POA&amp;M, see § 170.21.
 
4. ''Affirmations: ''Estimates consist of
 
costs for an OSA to submit to SPRS an <br />
initial and, as applicable, any <br />
subsequent affirmations of compliance <br />
that the contractor information system is <br />
compliant with and will maintain <br />
compliance with the security <br />
requirements of the applicable CMMC <br />
Level. If POA&amp;Ms are allowed, an <br />
affirmation must be submitted with the <br />
POA&amp;M closeout. With the exception of <br />
Small Entities for Level 1 and Level 2, <br />
it is assumed the task requires the same <br />
labor categories and estimated hours as <br />
the final reporting phase of the <br />
assessment.
 
The categories and rates used for
 
estimating purposes were compiled by
 
subject matter experts based on current <br />
data available from within the DoD <br />
contractor database for comparable labor <br />
categories. A factor estimate of 30 <br />
percent was added to the labor rate per <br />
hour to include but are not limited to <br />
company-sponsored benefits (fringe) <br />
and limited employee-related expenses <br />
such as training and certifications. This <br />
estimate is based on labor performed by <br />
indirect personnel (''i.e., ''personnel who <br />
are part of overhead expense); therefore, <br />
the 30 percent factor represents an <br />
estimate for fringe expense and G&amp;A <br />
expenses versus full overhead expense. <br />
The categories and rates inclusive of the <br />
labor cost plus the additional factor are <br />
defined in the table.
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00090
 
Fmt 4701
 
Sfmt 4725
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.010&lt;/GPH&gt;
 
ER15OC24.011&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83181 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
46
 
CMMC Level 1 consists of the same 15 basic
 
safeguarding requirements specified in FAR clause <br />
52.204–21. This cost analysis assumes that defense <br />
contractors and subcontractors already have <br />
contracts with FAR clause 52.204–21 and, therefore,
 
have already implemented the 15 basic <br />
safeguarding requirements.
 
47
 
Again, it is assumed that that defense
 
contractors and subcontractors have already
 
implemented the 15 basic safeguarding <br />
requirements in FAR clause 52.204–21.
 
48
 
A person needs to enter the information into
 
SPRS, which should only take five minutes.
 
'''CMMC Level 1 Self-Assessment and <br />
Affirmation Costs '''
 
''Other Than Small Entities ''
 
• ''Nonrecurring and recurring ''
 
''engineering costs: ''There are no <br />
nonrecurring or recurring engineering <br />
costs associated with CMMC Level 1, <br />
since it is assumed that the contractor <br />
or subcontractor has already <br />
implemented the applicable security <br />
requirements.46
 
• ''Assessments Costs: ''It is estimated
 
that the cost to support a CMMC Level <br />
1 self-assessment and affirmation is <br />
*$4,042 (as summarized in 4.1.2, table <br />
9). A Level 1 self-assessment is <br />
conducted annually, and is based on the <br />
assumptions detailed:
 
• ''Phase 1: Planning and preparing for ''
 
''the self-assessment: ''$1,146
 
• A director (MGMT5) for 4 hours
 
($190.52/hr
 
× 4hrs = $762)
 
• A manager (MGMT2) for 4 hours
 
($95.96/hr
 
× 4hrs = $384)
 
• ''Phase 2: Conducting the self- ''
 
''assessment: ''$1,728
 
• A director (MGMT5) for 6 hours
 
($190.52/hr
 
× 6hrs = $1,143)
 
• A staff IT specialist (IT4) for 6 hours
 
($97.49/hrs
 
× 6hrs = $585)
 
• ''Phase 3: Reporting of self-assessment ''
 
''results into SPRS: ''$584
 
• A director (MGMT5) for 2 hours
 
($190.52/hr
 
× 2hrs = $381)
 
• A staff IT specialist (IT4) for 2.08
 
hours ($97.49/hrs
 
× 2.08hrs = $203)
 
• ''Affirmations: ''It is estimated that the
 
costs to perform an initial and
 
annual affirmation of compliance <br />
with CMMC Level 1 for an ‘‘other <br />
than small’’ entity is $584
 
• A director (MGMT5) for 2 hours
 
($190.52/hr
 
× 2hrs = $381)
 
• A staff IT specialist (IT4) for 2.08
 
hours ($97.49/hrs
 
× 2.08hrs = $203)
 
• The Level 1 self-assessment and
 
affirmations cost burden will be <br />
addressed as part of the 48 CFR part 204 <br />
CMMC Acquisition rule.
 
• ''Summary: ''The following is the
 
annual other than small entities total <br />
cost summary for Level 1 self- <br />
assessments and affirmations over a ten- <br />
year period: (Example calculation, Year <br />
1: *$4,042 per entity
 
× 246 entities
 
(cumulative) = $994,233)
 
''Small Entities ''
 
• ''Nonrecurring and recurring ''
 
''engineering costs: ''There are no <br />
nonrecurring or recurring engineering <br />
costs associated with CMMC Level 1 <br />
since it is assumed the contractor or <br />
subcontractor has implemented the <br />
applicable security requirements.47
 
• ''Assessment Costs and Initial ''
 
''Affirmation Costs: ''It is estimated that <br />
the cost to support a CMMC Level 1 self- <br />
assessment and affirmation is *$5,977 <br />
(as summarized in 4.1.2, table 10). A <br />
Level 1 self-assessment is conducted <br />
annually, and is based on the <br />
assumptions detailed: <br />
• ''Phase 1: Planning and preparing for ''
 
''the self-assessment: ''$1,803
 
• A director (MGMT5) for 4 hours
 
($190.52/hr
 
× 4hrs = $762)
 
• An external service provider (ESP)
 
for 4 hours ($260.28
 
× 4hrs =
 
$1,041)
 
• ''Phase 2: Conducting the self- ''
 
''assessment: ''$2,705
 
• A director (MGMT5) for 6 hours
 
($190.52/hr
 
× 6hrs = $1,143)
 
• An external service provider (ESP)
 
for 6 hours ($260.28
 
× 6hrs =
 
$1,562)
 
• ''Phase 3: Reporting of assessment ''
 
''results into SPRS: ''$909
 
• A director (MGMT5) for 2 hours
 
($190.52/hr
 
× 2hrs = $381)
 
• An external service provider (ESP)
 
for 2 hours ($260.28/hr * 2hrs = <br />
$521)
 
• A staff IT specialist (IT4–SB) for
 
0.08 hours 48 ($86.24/hr
 
× 0.08hrs =
 
$7)
 
• ''Affirmation: ''initial affirmation post
 
assessment: $ 560
 
• ''Reaffirmations: ''It is estimated that the
 
costs to reaffirm a CMMC Level 1 <br />
annually for a small entity is $560
 
• A director (MGMT5) for 2 hours
 
($190.52/hr
 
× 2hrs = $381)
 
• A staff IT specialist (IT4–SB) for
 
2.08 hours ($86.24/hr
 
× 2.08hrs =
 
$179)
 
• The Level 1 self-assessment and
 
affirmations cost burden will be <br />
addressed as part of the 48 CFR part 204 <br />
CMMC Acquisition rule.
 
• ''Summary: ''The following is the
 
annual small entities total cost summary
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00091
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.012&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83182 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
for Level 1 self-assessments and <br />
affirmations over a ten-year period: <br />
(Example calculation, Year 1: *$5,977
 
per entity
 
× 699 entities (cumulative) =
 
$4,177,845)
 
''All Entities Summary ''
 
The following is a summary of the
 
combined costs for both small and other
 
than small entities for Level 1 self- <br />
assessments and affirmations over a ten- <br />
year period:
 
'''CMMC Level 2 Self-Assessment and <br />
Affirmation Costs '''
 
''Other Than Small Entities ''
 
• ''Nonrecurring and Recurring ''
 
''Engineering Costs: ''There are no <br />
nonrecurring or recurring engineering <br />
costs associated with Level 2 self- <br />
assessment since it is assumed the
 
contractor or subcontractor has <br />
implemented the NIST SP 800–171 R2 <br />
security requirements.
 
• ''Self-Assessment Costs and Initial ''
 
''Affirmation Costs: ''It is estimated that <br />
the cost to support a Level 2 self- <br />
assessment and affirmation is *$43,403. <br />
The three-year cost is $48,827 (as
 
summarized in 4.1.2, table 9), which <br />
includes the triennial assessment + <br />
affirmation, and two additional annual <br />
affirmations ($43,403 + $2,712 + <br />
$2,712). <br />
• ''Phase 1: Planning and preparing for ''
 
''the self-assessment: ''$18,015
 
• A director (MGMT5) for 30 hours
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00092
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.013&lt;/GPH&gt;
 
ER15OC24.014&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83183 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
($190.52/hr
 
× 30hrs = $5,716)
 
• A manager (MGMT2) for 40 hours
 
($95.96/hr
 
× 40hrs = $3,838)
 
• A staff IT specialist (IT4) for 46
 
hours ($97.49/hr
 
× 46hrs = $4,485)
 
• A senior IT specialist (IT3) for 26
 
hours ($81.96/hr
 
× 26hrs = $2,131)
 
• An IT specialist (IT2) for 34 hours
 
($54.27/hr
 
× 34hrs = $1,845)
 
• ''Phase 2: Conducting the self- ''
 
''assessment: ''$19,964
 
• A director (MGMT5) for 24 hours
 
($190.52/hr
 
× 24hrs = $4,572)
 
• A manager (MGMT2) for 24 hours
 
($95.96/hr
 
× 24hrs = $2,303)
 
• A staff IT specialist (IT4) for 56
 
hours ($97.49/hr
 
× 56hrs = $5,460)
 
• A senior IT specialist (IT3) for 56
 
hours ($81.96/hr
 
× 56hrs = $4,590)
 
• An IT specialist (IT2) for 56 hours
 
($54.27/hr
 
× 56hrs = $3,039)
 
• ''Phase 3: Reporting of self-assessment ''
 
''results into SPRS: ''$2,712
 
• A director (MGMT5) for 4 hours
 
($190.52/hr
 
× 4hrs = $762)
 
• A manager (MGMT2) for 4 hours
 
($95.96/hr
 
× 4hrs = $384)
 
• A staff IT specialist (IT4) for 16
 
hours ($97.49/hr
 
× 16hrs = $1,560)
 
• A senior IT specialist (IT3) for 0.08
 
hours ($81.96/hr
 
× 0.08hrs = $7)
 
• ''Affirmation: ''initial affirmation post
 
assessment: $ 2,712
 
• ''Reaffirmations: ''It is estimated that the
 
cost to perform an annual <br />
affirmation for CMMC Level 2 self- <br />
assessment is $2,712 (three-year <br />
cost is $8,136, or $2,712
 
× 3):
 
• A director (MGMT5) for 4 hours
 
($190.52/hr
 
× 4hrs = $762)
 
• A manager (MGMT2) for 4 hours
 
($95.96/hr
 
× 4hrs = $384)
 
• A staff IT specialist (IT4) for 16
 
hours ($97.49/hr
 
× 16hrs = $1,560)
 
• A senior IT specialist (IT3) for 0.08
 
hours ($81.96/hr
 
× 0.08hrs = $7)
 
• The Level 2 self-assessment and
 
affirmations cost burden will be <br />
addressed as part of the 48 CFR part 204 <br />
CMMC Acquisition rule.
 
• ''Summary: ''The following is the
 
annual other than small entities total <br />
cost summary for CMMC Level 2 self- <br />
assessments and affirmations over a ten- <br />
year period: (Example calculation, Year <br />
2: (*$43,403 assessment per entity
 
× 35
 
entities) + ($2,712 annual affirmation <br />
per entity
 
× 7 entities) = $1,538,092
 
''Small Entities ''
 
• ''Nonrecurring and recurring ''
 
''engineering costs: ''There are no <br />
nonrecurring or recurring engineering <br />
costs associated with Level 2 self- <br />
assessment since it is assumed the <br />
contractor or subcontractor has <br />
implemented the NIST SP 800–171 R2 <br />
security requirements.
 
• ''Self-Assessment Costs and Initial ''
 
''Affirmation Costs: ''It is estimated that <br />
the cost to support a Level 2 self- <br />
assessment and affirmation for a small <br />
entity is *$34,277. The three-year cost is <br />
$37,196 (as summarized in 4.1.2, table <br />
10), which includes the triennial <br />
assessment + affirmation, plus two
 
additional annual affirmations ($34,277 <br />
+ $1,459 + $1,459).
 
• ''Phase 1: Planning and preparing for ''
 
''the self-assessment: ''$14,426
 
• A director (MGMT5) for 32 hours
 
($190.52/hr x* 32hrs = $6,097)
 
• An external service provider (ESP)
 
for 32 hours ($260.28/hr
 
× 32hrs =
 
$8,329)
 
• ''Phase 2: Conducting the self- ''
 
''assessment: ''$15,542
 
• A director (MGMT5) for 16 hours
 
($190.52/hr
 
× 16hrs = $3,048)
 
• An external service provider (ESP)
 
for 48 hours ($260.28/hr
 
× 48hrs =
 
$12,493)
 
• ''Phase 3: Reporting of self-assessment ''
 
''results into SPRS: ''$2,851
 
• A director (MGMT5) for 4 hours
 
($190.52/hr
 
× 4hrs = $762)
 
• An external service provider (ESP)
 
for 8 hours ($260.28/hr
 
× 8hrs =
 
$2,082)
 
• A staff IT specialist (IT4–SB) for
 
0.08 hours ($86.24/hr
 
× 0.08hrs =
 
$7)
 
• ''Affirmation: ''initial affirmation post
 
assessment: $ 1,459
 
• ''Reaffirmations: ''It is estimated that the
 
costs to reaffirm a Level 2 self- <br />
assessment annually is $1,459 <br />
(three-year costs to reaffirm a Level <br />
2 self-assessment annually is <br />
$4,377, or $1,459
 
× 3):
 
• A director (MGMT5) for 4 hours
 
($190.52/hr
 
× 4hrs = $762)
 
• A staff IT specialist (IT4–SB) for
 
8.08 hours ($86.24/hr
 
× 8.08hrs =
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00093
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.015&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83184 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
$697)
 
• The Level 2 self-assessment and
 
affirmations cost burden will be <br />
addressed as part of the 48 CFR part 204 <br />
CMMC Acquisition rule.
 
• ''Summary: ''The following is the
 
annual small entities total cost summary <br />
for Level 2 self-assessments and <br />
affirmations over a ten-year period:
 
(Example calculation, Year 2: (*$34,277 <br />
self-assessment per entity
 
× 101 entities)
 
+ ($1,459 annual affirmation per entity
 
× 20 entities) = $3,491,193)
 
''All Entities Summary ''
 
The following is a summary of the
 
cost to all entities regardless of size for
 
Level 2 self-assessments and <br />
affirmations over a ten-year period:
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00094
 
Fmt 4701
 
Sfmt 4725
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.016&lt;/GPH&gt;
 
ER15OC24.017&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83185 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
'''CMMC Level 2 Certification Assessment <br />
and Affirmation Costs '''
 
''Other Than Small Entities ''
 
• ''Nonrecurring and recurring ''
 
''engineering costs: ''There are no <br />
nonrecurring or recurring engineering <br />
costs associated with Level 2 <br />
certification assessment since it is <br />
assumed the contractor or subcontractor <br />
has implemented the NIST SP 800–171 <br />
R2 security requirements.
 
• ''Assessment and Initial Affirmation ''
 
''Costs: ''It is estimated that the cost to <br />
support a Level 2 certification <br />
assessment and annual affirmation for <br />
an ‘‘other than small’’ entity is <br />
*$112,345. The three-year cost is <br />
$117,768 (as summarized in 4.1.2, table <br />
9), and includes a triennial assessment <br />
+ affirmation, plus two additional <br />
annual affirmations ($112,345 + $2,712 <br />
+ $2,712, with a minor rounding <br />
difference.) <br />
• ''Phase 1: Planning and preparing for ''
 
''the certification assessment: <br />
''$26,264
 
• A director (MGMT5) for 32 hours
 
($190.52/hr
 
× 32hrs = $6,097)
 
• A manager (MGMT2) for 64 hours
 
($95.96/hr
 
× 64hrs = $6,141)
 
• A staff IT specialist (IT4) for 72
 
hours ($97.49/hr
 
× 72hrs = $7,019)
 
• A senior IT specialist (IT3) for 40
 
hours ($81.96/hr
 
× 40hrs = $3,278)
 
• An IT specialist (IT2) for 58 hours
 
($54.27/hr
 
× 58hrs = $3,148)
 
• An associate IT specialist (IT1) for
 
16 hours ($36.32/hr
 
× 16hrs = $581)
 
• ''Phase 2: Conducting the certification ''
 
''assessment: ''$28,600
 
• A director (MGMT5) for 32 hours
 
($190.52/hr
 
× 32hrs = $6,097)
 
• A manager (MGMT2) for 32 hours
 
($95.96/hr
 
× 32hrs = $3,071)
 
• A staff IT specialist (IT4) for 72
 
hours ($97.49/hr
 
× 72hrs = $7,019)
 
• A senior IT specialist (IT3) for 72
 
hours ($81.96/hr
 
× 72hrs = $5,901)
 
• An IT specialist (IT2) for 120 hours
 
($54.27/hr
 
× 120hrs = $6,512)
 
• ''Phase 3: Reporting of certification ''
 
''assessment results: ''$2,712
 
• A director (MGMT5) for 4 hours
 
($190.52/hr
 
× 4hrs = $762)
 
• A manager (MGMT2) for 4 hours
 
($95.96/hr
 
× 4hrs = $384)
 
• A staff IT specialist (IT4) for 16
 
hours ($97.49/hr
 
× 16hrs = $1,560)
 
• A senior IT specialist (IT3) for 0.08
 
hours ($81.96/hr
 
× 0.08hrs = $7)
 
• ''Affirmations: ''initial affirmation post
 
assessment: $2,712
 
• ''C3PAO Costs: ''C3PAO engagement
 
inclusive of Phases 1, 2, and 3 (5- <br />
person team) for 200 hours <br />
($260.28/hr
 
× 200hrs = $52,056)
 
• ''Reaffirmations: ''It is estimated that the
 
costs to reaffirm a Level 2 <br />
certification assessment annually is <br />
$2,712 (three-year cost is $8,136 or <br />
$2,712
 
× 3)
 
• A director (MGMT5) for 4 hours
 
($190.52/hr
 
× 4hrs = $762)
 
• A manager (MGMT2) for 4 hours
 
($95.96/hr
 
× 4hrs = $384)
 
• A staff IT specialist (IT4) for 8 hours
 
($97.49/hr
 
× 8hrs = $1,560)
 
• A senior IT specialist (IT3) for 0.08
 
hours ($81.96/hr
 
× 0.08hrs = $7)
 
• The Level 2 affirmations cost
 
burden will be addressed as part of the <br />
48 CFR part 204 CMMC Acquisition <br />
rule.
 
• ''Summary: ''The following is the
 
annual other than small entities total <br />
cost summary for Level 2 certification <br />
assessments and affirmations over a ten- <br />
year period: (Example calculation, Year <br />
2: (*$112,345 assessment per entity
 
×
 
673 entities) + ($2,712 annual <br />
affirmation per entity
 
× 135 entities) =
 
$75,974,425)
 
''Small Entities ''
 
• ''Nonrecurring or recurring ''
 
''engineering costs: ''There are no <br />
nonrecurring or recurring engineering <br />
costs associated with Level 2 <br />
certification assessment since it is <br />
assumed the contractor or subcontractor <br />
has implemented the NIST SP 800–171 <br />
R2 security requirements.
 
• ''Assessment Costs and Initial ''
 
''Affirmation Costs: ''It is estimated that <br />
the cost to support a Level 2 <br />
certification assessment and affirmation <br />
for a small entity is *$101,752. The <br />
three-year cost is $104,670 (as <br />
summarized in 4.1.2, table 10), and <br />
includes the triennial assessment + <br />
affirmation plus two additional annual
 
affirmations ($101,752 + $1,459 + <br />
$1,459). <br />
• ''Phase 1: Planning and preparing for ''
 
''the certification assessment: <br />
''$20,699
 
• A director (MGMT5) for 54 hours
 
($190.52/hr
 
× 54hrs = $10,288)
 
• An external service provider (ESP)
 
for 40 hours ($260.28/hr
 
× 40hrs =
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00095
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.018&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83186 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
$10,411)
 
• ''Phase 2: Conducting the certification ''
 
''assessment: ''$45,509
 
• A director (MGMT5) for 64 hours
 
($190.52/hr
 
× 64hrs = $12,193)
 
• An external service provider (ESP) for
 
128 hours ($260.28/hr
 
× 128hrs =
 
$33,316)
 
• ''Phase 3: Reporting of certification ''
 
''assessment results: ''$2,851
 
• A director (MGMT5) for 4 hours
 
($190.52/hr
 
× 4hrs = $762)
 
• An ESP for 8 hours ($260.28/hr ×
 
8hrs = $2,082)
 
• A staff IT specialist (IT4–SB) for
 
0.08 hours ($86.24/hr
 
× 0.08hrs =
 
$7)
 
• ''Affirmations: ''cost to post initial
 
affirmation $1,459
 
• ''C3PAO Costs: ''C3PAO engagement
 
inclusive of Phases 1, 2, and 3 (3- <br />
person team) for 120 hours <br />
($260.28/hr
 
× 120hrs = $31,234)
 
• ''Reaffirmations: ''It is estimated that the
 
costs to reaffirm a Level 2 <br />
certification assessment annually is <br />
$1,459 (three-year cost is $4,377, or <br />
$1,459
 
× 3)
 
• A director (MGMT5) for 4 hours
 
($190.52/hr
 
× 4hrs = $762)
 
• A staff IT specialist (IT4–SB) for
 
8.08 hours ($86.24/hr
 
× 8.08hrs =
 
$697)
 
• The Level 2 affirmations cost
 
burden will be addressed as part of the <br />
48 CFR part 204 CMMC Acquisition <br />
rule.
 
• ''Summary: ''The following is the
 
annual small entities total cost summary <br />
for Level 2 certification assessments and <br />
affirmations over a ten-year period: <br />
(Example calculation, Year 2: <br />
(*$101,752 assessment per entity
 
×
 
1,926 entities) + ($1,459 annual <br />
affirmation per entity
 
× 382 entities) =
 
$196,531,451)
 
''All Entities Summary ''
 
The following is a summary of the
 
cost to all entities regardless of size for
 
Level 2 certification assessment and <br />
affirmation costs over a ten-year period:
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00096
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.019&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83187 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
49
 
DoD utilized subject matter expertise from
 
Defense Pricing and Contracting (DPC) and DCMA <br />
DIBCAC to estimate the Nonrecurring and <br />
Recurring Engineering Costs.
 
50
 
Costs for closing out POA&amp;Ms are included at
 
Level 3 because the requirement to implement a <br />
subset of NIST SP 800–172 Feb2021 security <br />
requirements is new with the CMMC rule. These <br />
costs are not included at Level 2 because the <br />
implementation of all NIST SP 800–171 R2 security <br />
requirements are already required.
 
'''CMMC Level 3 Certification Assessment <br />
and Affirmation Costs '''
 
An OSC pursuing Level 3 certification
 
assessment must have a CMMC Status of <br />
Final Level 2 (C3PAO), and also must <br />
demonstrate compliance with CMMC <br />
Level 3, which includes implementation <br />
of selected security requirements from <br />
NIST SP 800–172 Feb2021 not required <br />
in prior rules. Therefore, the <br />
Nonrecurring Engineering and <br />
Recurring Engineering cost estimates <br />
have been included for the initial <br />
implementation and maintenance of the <br />
required selected NIST SP 800–172 <br />
Feb2021 security requirements. The cost <br />
estimates account for time for an OSC to <br />
implement these security requirements <br />
and prepare for, support, participate in, <br />
and closeout a Level 3 certification <br />
assessment conducted by DCMA <br />
DIBCAC. The OSC should keep in mind <br />
that the total cost of a Level 3 <br />
certification assessment includes the <br />
cost of a Level 2 certification assessment <br />
as well as the costs to implement and <br />
assess the security requirements specific <br />
to Level 3. CMMC Level 3 is expected <br />
to affect a small subset of the DIB.
 
''Other Than Small Entities, per Entity ''
 
• ''Nonrecurring Engineering Costs: ''
 
$21,100,000.49
 
• ''Recurring Engineering Costs: ''
 
$4,120,000.
 
• ''Assessment Costs and Initial ''
 
''Affirmation Costs: ''It is estimated that <br />
the cost to support a Level 3
 
certification assessment and affirmation <br />
for an other than small entity is <br />
*$39,021. The three-year cost is $44,445 <br />
(as summarized in 4.1.2, table 23), and <br />
includes the triennial assessment + <br />
affirmation, plus two additional annual <br />
affirmations ($39,021 + $2,712 + <br />
$2,712). <br />
• ''Phase 1: Planning and preparing for ''
 
''the certification assessment: ''$7,066
 
• A director (MGMT5) for 12 hours
 
($190.52/hr
 
× 12hrs = $2,286)
 
• A manager (MGMT2) for 12 hours
 
($95.96/hr
 
× 12hrs = $1,152)
 
• A staff IT specialist (IT4) for 16
 
hours ($97.49/hr
 
× 16hrs = $1,560)
 
• A senior IT specialist (IT3) for 12
 
hours ($81.96/hr
 
× 12hrs = $984)
 
• An IT specialist (IT2) for 20 hours
 
($54.27/hr
 
× 20hrs = $1,085)
 
• ''Phase 2: Conducting the certification ''
 
''assessment: ''$23,136
 
• A director (MGMT5) for 24 hours
 
($190.52/hr
 
× 24hrs = $4,572)
 
• A manager (MGMT2) for 24 hours
 
($95.96/hr
 
× 24hrs = $2,303)
 
• A staff IT specialist (IT4) for 64
 
hours ($97.49/hr
 
× 64hrs = $6,239)
 
• A senior IT specialist (IT3) for 64
 
hours ($81.96/hr
 
× 64hrs = $5,245)
 
• An IT specialist (IT2) for 88 hours
 
($54.27/hr
 
× 88hrs = $4,776)
 
• ''Phase 3: Reporting of certification ''
 
''assessment results: ''$2,712
 
• A director (MGMT5) for 4 hours
 
($190.52/hr
 
× 4hrs = $762)
 
• A manager (MGMT2) for 4 hours
 
($95.96/hr
 
× 4hrs = $384)
 
• A staff IT specialist (IT4) for 16
 
hours ($97.49/hr
 
× 16hrs = $1,560)
 
• A senior IT specialist (IT3) for 0.08
 
hours ($81.96/hr
 
× 0.08hrs = $7)
 
• ''Phase 4: Closing out POA&amp;Ms ''50 ''(for ''
 
''CMMC Level 3 if necessary and <br />
allowed): ''$3,394
 
• A director (MGMT5) for 8 hours
 
($190.52/hr
 
× 8hrs = $1,524)
 
• A senior staff IT specialist (IT5) for
 
16 hours ($116.87/hr
 
× 16hrs =
 
$1,870)
 
• Affirmations: initial affirmation
 
post assessment: $2,712
 
• ''Reaffirmations: ''It is estimated that the
 
costs to reaffirm a Level 3 <br />
certification assessment annually is <br />
$2,712 (three-year cost is $8,136, or <br />
$2,712
 
× 3)
 
• A director (MGMT5) for 4 hours
 
($190.52/hr
 
× 4hrs = $762)
 
• A manager (MGMT2) for 4 hours
 
($95.96/hr
 
× 4hrs = $384)
 
• A staff IT specialist (IT4) for 16
 
hours ($97.49/hr
 
× 16hrs = $1,560)
 
• A senior IT specialist (IT3) for 0.08
 
hours ($81.96/hr
 
× 0.08hrs = $7)
 
The Level 3 affirmations cost burden
 
will be addressed as part of the 48 CFR <br />
part 204 CMMC Acquisition rule.
 
• ''Summary: ''The following is the
 
annual other than small entities total <br />
cost summary for Level 3 certification <br />
assessments and affirmations over a ten- <br />
year period. Example calculation, Year <br />
2 (reference per entity amounts shown):
 
• *($39,021 Certification per entity × 5
 
entities) + ($2,712 Annual <br />
Affirmation per entity
 
× 1 entity) =
 
$197,818, and
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00097
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.020&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83188 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
51
 
Costs for closing out POA&amp;Ms are included at
 
Level 3 because the requirement to implement a <br />
subset of NIST SP 800–172 Feb2021 security <br />
requirements is new with the CMMC rule. These <br />
costs are not included at Level 2 because the <br />
implementation of all NIST SP 800–171 R2 security <br />
requirements is already required.
 
• $105,500,000 Nonrecurring
 
Engineering cost ($21,100,000 per <br />
entity
 
× 5 entities being certified),
 
and
 
• $24,720,000 Recurring Engineering
 
cost ($4,120,000 per entity
 
× 5
 
entities being certified) + <br />
($4,120,000 per entity
 
× 1 entity
 
performing affirmations)
 
• $130,417,818 Total Cost =
 
Certification and Affirmation Cost <br />
($197,818) + Nonrecurring
 
Engineering cost ($105,500,000) + <br />
Recurring Engineering cost <br />
($24,720,000), or $145,432,897.
 
''Small Entities ''
 
• ''Nonrecurring Engineering Costs: ''
 
$2,700,000.
 
• ''Recurring Engineering Costs: ''
 
$490,000.
 
• ''Assessment Costs and Initial ''
 
''Affirmation Costs: ''It is estimated that <br />
the cost to support a Level 3 <br />
certification assessment for a small <br />
entity is *$9,050 The three-year cost is <br />
$12,802 (summarized in 4.1.2, table 10), <br />
and includes the triennial assessment + <br />
affirmation, plus two additional annual <br />
affirmations ($9,050 + $1,876 + $1,876): <br />
• ''Phase 1: Planning and preparing for ''
 
''the certification assessment: ''$1,905
 
• ''A director (MGMT5) for 10 hours ''
 
''($190.52/hr ''
 
× ''10hrs ''= $1,905)
 
• ''Phase 2: Conducting the certification ''
 
''assessment: ''$1,524
 
• A director (MGMT5) for 8 hours
 
($190.52/hr
 
× 8hrs = $1,524)
 
• ''Phase 3: Reporting of certification ''
 
''assessment results: ''$1,876
 
• A director (MGMT5) for 8 hours
 
($190.52/hr
 
× 8hrs = $1,524)
 
• A staff IT specialist (IT4–SB) for
 
4.08 hours ($86.24/hr
 
× 4.08hrs =
 
$352)
 
• ''Phase 4: Closing out POA&amp;Ms ''51 ''(for ''
 
''CMMC Level 3 if necessary and <br />
allowed): ''$1,869
 
• A director (MGMT5) for 8 hours
 
($190.52/hr
 
× 8hrs = $1,524)
 
• A staff IT specialist (IT4–SB) for 48
 
hours ($86.24/hr
 
× 48hrs = $345)
 
• ''Reaffirmations: ''It is estimated that the
 
costs to reaffirm a Level 3 <br />
certification assessment annually is <br />
$1,876 (three-year cost is $5,628, or <br />
$1,876
 
× 3)
 
• A director (MGMT5) for 8 hours
 
($190.52/hr
 
× 8hrs = $1,524)
 
• A staff IT specialist (IT4–SB) for
 
4.08 hours ($86.24/hr
 
× 4.08hrs =
 
$352)
 
• The Level 3 affirmations cost
 
burden will be addressed as part of the <br />
48 CFR part 204 CMMC Acquisition <br />
rule.
 
''Summary: ''The following is the annual
 
small entities total cost summary for <br />
Level 3 certification assessments and <br />
affirmations over a ten-year period. <br />
Example calculation, Year 2 (reference <br />
per entity amounts shown): <br />
• *($9,050 Certification per entity × 45
 
entities) + ($1,876 Annual <br />
Affirmation per entity
 
× 3 entities)
 
= $412,897, and
 
• $121,500,000 Nonrecurring
 
Engineering cost ($2,700,000 per <br />
entity
 
× 45 entities being certified),
 
and
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00098
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.021&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83189 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
• $23,520,000 Recurring Engineering
 
cost ($490,000 per entity
 
× 45
 
entities being certified) + ($490,000
 
per entity
 
× 3 entities performing
 
affirmations)
 
• $145,432,897 Total Cost =  
 
Certification and Affirmation Cost
 
($412,897) + Nonrecurring <br />
Engineering cost ($121,500,000) + <br />
Recurring Engineering cost <br />
($23,520,000), or $145,432,897.
 
''All Entities Summary ''
 
The following is a summary of the
 
cost to all entities regardless of size for
 
Level 3 certification assessments and <br />
affirmations over a ten-year period:
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00099
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.022&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83190 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
52
 
Nonrecurring engineering costs were first
 
incurred in FY20. The cost has inflation applied to <br />
put the value in 2023 base year (BY) dollars.
 
53
 
The cost for the recurring engineering cost is
 
based on the costs incurred in FY20 and FY21. The <br />
values for Year 1 (FY20) and Year 2 ((FY21) are <br />
actual historic values that have inflation applied to <br />
them to put them in base year 2023 dollars. Every <br />
proceeding years’ recurring engineering cost is <br />
based on the average of the two historic actual <br />
values.
 
'''Government Costs '''
 
'''Summary of Impact '''
 
The following is a summary of the
 
estimated Government costs calculated
 
for a 20-year horizon in 2023 dollars at <br />
a 7 percent and 3 percent discount rate. <br />
The Government costs include <br />
conducting Level 3 certification
 
assessments, uploading results into the <br />
CMMC instantiation of eMASS, and the <br />
CMMC PMO costs.
 
'''Government Costs (All Levels) '''
 
The estimated Government costs
 
utilize the entity numbers and phased <br />
roll-out detailed in the Public cost <br />
section. The DIBCAC estimated the <br />
detailed hours for all activities and <br />
other costs in a manner similar to the <br />
details shown in the Public cost section. <br />
Labor efforts for the Government are <br />
focused on Level 3. For purposes of the <br />
cost estimate, Government labor is <br />
based on the average of step one, five, <br />
and ten for GS–11 through GS–15 labor <br />
elements for the Washington DC area. <br />
The cost of labor was increased by a <br />
factor of approximately 51 percent <br />
which includes an estimated fringe <br />
factor (fringe factor includes estimated <br />
average insurance and pension benefits) <br />
plus overhead (overhead factor <br />
represents supervision and management
 
of the labor) to arrive at the estimated <br />
labor rates. The Government labor in <br />
this estimate is performed by DCMA, <br />
which is a labor-intensive agency with <br />
limited overhead expenses. Therefore, <br />
the overall added factor of 51 percent is <br />
appropriate versus a typical full <br />
overhead factor of 100 percent.
 
'''CMMC Database Infrastructure Costs '''
 
The Government will develop the
 
operational CMMC instantiation of <br />
eMASS. The cost analysis assumes that <br />
the nonrecurring engineering (NRE) cost <br />
includes the requirements development, <br />
architecture design, security, <br />
prototyping and testing, and approvals <br />
or certifications.52 Nonrecurring
 
engineering costs is a one-time fee of <br />
$4,631,213 and is reflected here as <br />
incurred in the initial year of the <br />
estimate. The Year 1 amount is based on <br />
the actual cost incurred in FY2020 with <br />
adjustment for inflation to arrive at base <br />
year (BY) 1 dollars (2023).
 
The recurring engineering (RE) cost
 
includes database management, data <br />
analysis, cybersecurity, storage and <br />
backups, licensing, and infrastructure.53
 
The cost for recurring engineering in
 
Year 1 ($2,336,038) and Year 2 <br />
($1,804,480) are based on historical
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00100
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.023&lt;/GPH&gt;
 
ER15OC24.024&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83191 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
amounts incurred for FY 2020 and FY <br />
2021 with adjustment for inflation to <br />
arrive at base year 1 and Year 2 dollars <br />
(2023 and 2024). The estimated
 
recurring engineering for Year 3 forward <br />
is calculated as the average of the Year <br />
1 and Year 2 amounts (($2,336,038 + <br />
$1,804,480)/2 = $2,070,259).
 
The table summarizes the
 
nonrecurring engineering (NRE) and <br />
recurring engineering (RE) costs for Year <br />
1 through Year 5:
 
'''Total Government Costs '''
 
The following is a summary of the
 
total Government costs over a ten-year <br />
period:
 
'''Total Public and Government Costs '''
 
The following is a summary of the
 
total estimated annual Public and
 
Government cost associated with <br />
implementation of the CMMC Program <br />
over a ten-year period:
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00101
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.025&lt;/GPH&gt;
 
ER15OC24.026&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83192 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
54
 
[http://www.govinfo.gov/content/pkg/CHRG-113hhrg86391/html/CHRG-113hhrg86391.htm ''www.govinfo.gov/content/pkg/CHRG- '']
 
[http://www.govinfo.gov/content/pkg/CHRG-113hhrg86391/html/CHRG-113hhrg86391.htm ''113hhrg86391/html/CHRG-113hhrg86391.htm. '']
 
55
 
[http://www.nbr.org/program/commission-on-the-theft-of-intellectual-property/ ''www.nbr.org/program/commission-on-the- '']
 
[http://www.nbr.org/program/commission-on-the-theft-of-intellectual-property/ ''theft-of-intellectual-property/. '']
 
56
 
[http://www.cybernc.us/fci-cui/ ''www.cybernc.us/fci-cui/. '']
 
57
 
GAO Report to Congress, Defense Contractor
 
Cybersecurity Stakeholder Communication and <br />
Performance Goals Could Improve Certification <br />
Framework, December 2021.
 
''Alternatives ''
 
DoD considered and adopted several
 
alternatives during the development of <br />
this rule that reduce the burden on <br />
defense contractors and still meet the <br />
objectives of the rule. These alternatives <br />
include: (1) maintaining status quo and <br />
leveraging only the current <br />
requirements implemented in DFARS <br />
provision 252.204–7019 and DFARS <br />
clause 252.204–7020 requiring defense <br />
contractors and offerors to self-assess <br />
utilizing the DoD Assessment <br />
Methodology and entering a Basic <br />
Summary Score; (2) revising CMMC to <br />
reduce the burden for small businesses <br />
and contractors who do not process, <br />
store, or transmit critical CUI by <br />
eliminating the requirement to hire a <br />
C3PAO and instead allow self- <br />
assessment with affirmation to maintain <br />
compliance at CMMC Level 1, and <br />
allowing triennial self-assessment with <br />
an annual affirmation to maintain <br />
compliance for some CMMC Level 2 <br />
programs; (3) exempting contracts and <br />
orders exclusively for the acquisition of <br />
commercially available off-the-shelf <br />
items; and (4) implementing a phased <br />
implementation for CMMC.
 
In addition, the Department took into
 
consideration the timing of the <br />
requirement to achieve a specified <br />
CMMC Status: (1) at time of proposal or <br />
offer submission, (2) after contract <br />
award, (3) at the time of contract award, <br />
or (4) permitting government Program <br />
Managers to seek approval to waive <br />
inclusion of CMMC Status requirements <br />
in solicitations that involve disclosure <br />
or creation of FCI or CUI as part of the <br />
contract effort. Such waivers will be <br />
requested and approved by DoD in <br />
accordance with internal policies, <br />
procedures, and approval requirements. <br />
The Department ultimately adopted <br />
alternatives 3 and 4. The drawback of
 
alternative 1 (at time of proposal or offer <br />
submission) is the increased risk for <br />
contractors since they may not have <br />
sufficient time to achieve the required <br />
CMMC Status after the release of the <br />
solicitation. The drawback of alternative <br />
2 (after contract award) is the increased <br />
risk to the Department with respect to <br />
the costs, program schedule, and <br />
uncertainty in the event the contractor <br />
is unable to achieve the required CMMC <br />
Status in a reasonable amount of time <br />
given their current cybersecurity <br />
posture. This potential delay would <br />
apply to the entire supply chain and <br />
prevent the appropriate flow of CUI and <br />
FCI.
 
''Benefits ''
 
The Department of Defense expects
 
this final rule to protect DoD and <br />
industry from the loss of FCI and CUI, <br />
including intellectual property. The <br />
theft of intellectual property and FCI <br />
and CUI due to malicious cyber activity <br />
threatens U.S. economic security and <br />
national security. In 2010, the <br />
Commander of the U.S. Cyber Command <br />
and Director of the National Security <br />
Agency estimated the value of U.S. <br />
intellectual property to be $5 trillion <br />
and that $300 billion is stolen over <br />
networks annually.54 The 2013 <br />
Intellectual Property Commission <br />
Report provided concurrence and noted <br />
that the ongoing theft represents ‘‘the <br />
greatest transfer of wealth in history.’’ <br />
The report also highlighted the <br />
challenges of generating an exact figure <br />
because Government and private studies <br />
tend to understate the impacts due to <br />
inadequate data or scope, which is <br />
evidenced in subsequent analyses.55
 
The responsibility of Federal agencies
 
to protect FCI or CUI does not change <br />
when such information is shared with <br />
defense contractors. A comparable level <br />
of protection is needed when FCI or CUI <br />
is processed, stored, or transmitted on <br />
contractor information systems.56 The <br />
protection of FCI, CUI, and intellectual <br />
property on defense contractor systems <br />
can directly impact the ability of the <br />
Federal Government to successfully <br />
conduct its essential missions and <br />
functions.57
 
Malicious cyber actors have targeted
 
and continue to target the DIB sector <br />
that consists of approximately 220,000 <br />
small-to-large sized entities that support <br />
the warfighter. In particular, actors <br />
ranging from cyber criminals to nation- <br />
states continue to attack companies and <br />
organizations that comprise the <br />
Department’s multi-tier supply chain <br />
including smaller entities at the lower <br />
tiers. From at least January 2020, <br />
through February 2022, the Federal <br />
Bureau of Investigation (FBI), National <br />
Security Agency (NSA), and <br />
Cybersecurity and Infrastructure <br />
Security Agency (CISA) observed <br />
regular targeting of U.S. cleared defense <br />
contractors (CDCs) by Russian state- <br />
sponsored cyber actors. The actors have <br />
targeted sensitive, unclassified <br />
information, as well as proprietary and <br />
export-controlled technology. The <br />
acquired information provides <br />
significant insight into U.S. weapons <br />
platforms development and deployment <br />
timelines, vehicle specifications, and <br />
plans for communications infrastructure <br />
and IT. By acquiring proprietary <br />
internal documents and email
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00102
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.027&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83193 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
58
 
[http://www.cisa.gov/news-events/cybersecurity-advisories/aa22-047a ''www.cisa.gov/news-events/cybersecurity- '']
 
[http://www.cisa.gov/news-events/cybersecurity-advisories/aa22-047a ''advisories/aa22-047a. '']
 
59
 
[http://www.whitehouse.gov/briefing-room/statements-releases/2022/03/21/statement-by-president-biden-on-our-nations-cybersecurity/ ''www.whitehouse.gov/briefing-room/statements- '']
 
[http://www.whitehouse.gov/briefing-room/statements-releases/2022/03/21/statement-by-president-biden-on-our-nations-cybersecurity/ ''releases/2022/03/21/statement-by-president-biden- <br />
on-our-nations-cybersecurity/. '']
 
communications, adversaries may be <br />
able to adjust their own military plans <br />
and priorities, hasten technological <br />
development efforts, inform foreign <br />
policymakers of U.S. intentions, and <br />
target potential sources for <br />
recruitment.58
 
In addition to stealing intellectual
 
property for military gains, Russia may <br />
conduct cyber-attacks against the U.S. <br />
for retaliatory purposes. On March 21, <br />
2022, the Biden-Harris Administration <br />
stated intelligence indicates that the <br />
Russian Government and Russian- <br />
aligned cybercrime groups have <br />
threatened to conduct cyber operations <br />
in retaliation for perceived cyber <br />
offensives against the Russian <br />
Government or the Russian people.59
 
The aggregate loss of intellectual
 
property and CUI from the DoD supply <br />
chain severely undercuts U.S. technical <br />
advantage, limits and disrupts business <br />
opportunities associated with <br />
technological superiority, and <br />
ultimately threatens our national <br />
defenses and economy. By incorporating <br />
heightened cybersecurity into <br />
acquisition programs, the CMMC <br />
Program provides the Department <br />
assurance that contractors and <br />
subcontractors are meeting DoD’s <br />
cybersecurity requirements and <br />
provides a key mechanism to adapt to <br />
an evolving threat landscape. This is <br />
critically important to the Department <br />
because defense contractors are the <br />
target of increasingly frequent and <br />
complex cyberattacks by adversaries <br />
and non-state actors. Dynamically <br />
enhancing DIB cybersecurity to meet <br />
these evolving threats and safeguarding <br />
the information that supports and <br />
enables our warfighters is a top priority <br />
for the Department. The CMMC Program <br />
is a key component of the Department’s <br />
DIB cybersecurity effort.
 
CMMC provides uniform and
 
improved DoD cybersecurity <br />
requirements in three (3) levels, using <br />
the security requirements in NIST SP <br />
800–171 R2 and a selected subset of <br />
those in NIST SP 800–172 Feb2021. <br />
With this rule, the Department is <br />
publishing supplemental guidance <br />
documents to assist the public and in <br />
particular, small businesses, with <br />
CMMC implementation, increasing the <br />
likelihood of successful implementation <br />
and strengthening cybersecurity across <br />
the DIB. CMMC decreases the burden <br />
and cost on companies protecting FCI <br />
by allowing all companies at Level 1,
 
and a subset of companies at Level 2, to <br />
demonstrate compliance through self- <br />
assessments. CMMC allows companies, <br />
under certain limited circumstances, to <br />
make a Plan of Action &amp; Milestones <br />
(POA&amp;M) to provide additional time to <br />
achieve a Final CMMC Status. These <br />
key updates to CMMC benefit the DoD <br />
and our national interest by providing:
 
• improved safeguarding of
 
competitive advantages through <br />
requirements flow-down to the defense <br />
contractor supply chain and protections <br />
for proprietary information and <br />
capabilities, and
 
• increased efficiency in the economy
 
and private markets as a result of the <br />
streamlining of cybersecurity <br />
requirements, the resulting <br />
improvements in cybersecurity, and <br />
accountability across the supply chain.
 
In summary, the CMMC Program
 
enforces and validates implementation <br />
of DoD’s required cyber protection <br />
standards for companies in the DIB, <br />
preserving U.S. technical advantage. In <br />
addition, CMMC increases security for <br />
the most sensitive CUI by applying <br />
additional requirements at Level 3. <br />
Implementation of CMMC will help <br />
protect FCI and CUI upon which DoD <br />
systems and critical infrastructure rely, <br />
making it vital to national security. <br />
CMMC is focused on securing the <br />
Department’s supply chain, including <br />
the smallest, most vulnerable innovative <br />
companies. The security risks that result <br />
from the significant loss of FCI and CUI, <br />
including intellectual property and <br />
proprietary data, make implementation <br />
of the CMMC Program vital, practical, <br />
and in the public interest.
 
'''III. Regulatory Compliance Analysis '''
 
''A. Executive Order 12866, ''‘‘''Regulatory <br />
Planning and Review''’’ ''and Executive <br />
Order 13563, ''‘‘''Improving Regulation <br />
and Regulatory Review,''’’ ''as Amended <br />
by Executive Order 14094, <br />
''‘‘''Modernizing Regulatory Review''’’
 
These Executive Orders direct
 
agencies to assess all costs, benefits, and <br />
available regulatory alternatives and, if <br />
regulation is necessary, to select <br />
regulatory approaches that maximize <br />
net benefits (including potential <br />
economic, environmental, public health, <br />
safety effects, distributive impacts, and <br />
equity). These Executive Orders <br />
emphasize the importance of <br />
quantifying both costs and benefits, of <br />
reducing costs, of harmonizing rules, <br />
and of promoting flexibility. The Office <br />
of Management and Budget (OMB) has <br />
determined this final rule is significant <br />
as defined by Section 3(f)(1) for <br />
purposes of Executive Order 12866, as <br />
amended by Executive Order 14094.
 
''B. Congressional Review Act (5 U.S.C. <br />
801 et seq.) ''
 
As defined by 5 U.S.C. 804(2), a major
 
rule is a rule that the Administrator of <br />
the Office of Information and Regulatory <br />
Affairs of the Office of Management and <br />
Budget finds has resulted in or is likely <br />
to result in—(a) an annual effect on the <br />
economy of $100,000,000 or more; (b) a <br />
major increase in costs or prices for <br />
consumers, individual industries, <br />
Federal, State, or local government <br />
agencies, or geographic regions; or (c) <br />
significant adverse effects on <br />
competition, employment, investment, <br />
productivity, innovation, or on the <br />
ability of United States-based <br />
enterprises to compete with foreign- <br />
based enterprises in domestic and <br />
export markets. This rule has been <br />
designated a major rule as it is expected <br />
to have annual effect on the economy of <br />
$100M dollars or more.
 
''C. Public Law 96–354, ''‘‘''Regulatory <br />
Flexibility Act''’’ ''(5 U.S.C. 601) ''
 
The Department of Defense Chief
 
Information Officer certified that this <br />
rule is subject to the Regulatory <br />
Flexibility Act (5 U.S.C. 601) because it <br />
would, if promulgated, have a <br />
significant economic impact on a <br />
substantial number of small entities.
 
DoD has considered previous
 
comments from Small Business <br />
Administration (SBA) regarding the <br />
impact and cost to small businesses to <br />
implement CMMC. In July 2022, the <br />
CMMC PMO met with the Office of <br />
Advocacy for the U.S. SBA to address <br />
the revisions planned in CMMC that are <br />
responsive to prior SBA concerns, with <br />
which the SBA was satisfied.
 
An Initial Regulatory Flexibility
 
Analysis that includes a detailed <br />
discussion and explanation about the <br />
assumptions and methodology used to <br />
estimate the cost of this regulatory <br />
action on small entities follows and is <br />
available at [http://www.regulations.gov ''www.regulations.gov ''](search <br />
for ‘‘DoD–2023–OS–0063,’’ click ‘‘Open <br />
Docket,’’ and view ‘‘Supporting <br />
Documents’’).
 
This final regulatory flexibility
 
analysis has been prepared consistent <br />
with 5 U.S.C. 603.
 
''D. Final Regulatory Flexibility Analysis ''
 
This final regulatory flexibility
 
analysis has been prepared consistent <br />
with 5 U.S.C. 604(a).
 
Reasons for the Action
 
This final rule is necessary to create
 
a secure and resilient supply chain, by <br />
addressing threats to the U.S. economy <br />
and national security from ongoing <br />
malicious cyber activities and <br />
preventing theft of hundreds of billions
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00103
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83194 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
60
 
[http://www.gsa.gov/technology/it-contract-vehicles-and-purchasing-programs/technology-products-services/it-security/executive-order-14028 ''www.gsa.gov/technology/it-contract-vehicles- '']
 
[http://www.gsa.gov/technology/it-contract-vehicles-and-purchasing-programs/technology-products-services/it-security/executive-order-14028 ''and-purchasing-programs/technology-products- <br />
services/it-security/executive-order-14028. '']
 
of dollars of U.S. intellectual property. <br />
The President’s Executive Order (E.O.) <br />
14028, ‘‘Improving the Nation’s <br />
Cybersecurity,’’ 60 emphasized that <br />
industrial security needs strengthening <br />
to ensure investments are not lost <br />
through intellectual property theft or <br />
among other supply chain risks.
 
Currently, the Federal Acquisition
 
Regulation (FAR) and Defense Federal <br />
Acquisition Regulation Supplement <br />
(DFARS) prescribe contract clauses <br />
intended to protect Federal Contract <br />
Information (FCI) and Controlled <br />
Unclassified Information (CUI) within <br />
the Department of Defense (DoD) supply <br />
chain. Specifically, the clause at FAR <br />
clause 52.204–21, Basic Safeguarding of <br />
Covered Contractor Information <br />
Systems, is prescribed at FAR 4.1903 for <br />
use in Government solicitations and <br />
contracts when the contractor or a <br />
subcontractor at any tier may have FCI <br />
residing in or transiting through its <br />
information system. The FAR clause <br />
focuses on ensuring a basic level of <br />
cybersecurity hygiene and is reflective <br />
of actions that a prudent businessperson <br />
would employ.
 
In addition, DFARS clause 252.204–
 
7012, Safeguarding Covered Defense <br />
Information and Cyber Incident <br />
Reporting, is prescribed in DFARS <br />
204.7304 (c) for use in DoD solicitations <br />
and contracts that require processing, <br />
storing, or transmitting of CUI in <br />
contractor owned information systems. <br />
DFARS clause 252.204–7012 requires <br />
defense contractors and subcontractors <br />
to provide ‘‘adequate security’’ to <br />
process, store or transmit CUI on <br />
information systems or networks, and to <br />
report cyber incidents that affect these <br />
systems or networks. The clause states <br />
that to provide adequate security, the <br />
contractor shall implement, at a <br />
minimum, the security requirements in <br />
‘‘National Institute of Standards and <br />
Technology (NIST) Special Publication <br />
(SP) 800–171 R2, Protecting CUI in <br />
Nonfederal Systems and Organizations.’’ <br />
Contractors are also required to flow <br />
down DFARS clause 252.204–7012 to <br />
all subcontracts that involve CUI.
 
However, neither FAR clause 52.204–
 
21 nor DFARS clause 252.204–7012, <br />
provide for DoD verification of a <br />
contractor’s implementation of basic <br />
safeguarding requirements specified in <br />
those clauses prior to contract award. <br />
DFARS clause 252.204–7020, ''NIST SP <br />
800–171 DoD Assessment Requirements, <br />
''applies to contractor information <br />
systems that are subject to NIST SP 800– <br />
171 requirements pursuant to DFARS
 
clause 252.204–7012. DFARS provision <br />
252.204–7019 and DFARS clause 7020 <br />
require offerors and contractors <br />
(including subcontractors) respectively <br />
to score their implementation of NIST <br />
SP 800–171 requirements for each <br />
contractor information system that is <br />
relevant to the offer or contract and to <br />
submit, at minimum, summary level <br />
self-assessment scores in the Supplier <br />
Performance Risk System (SPRS) for a <br />
minimum of a Basic Assessment, which <br />
is a contractor self-assessment. The <br />
SPRS submission includes the NIST SP <br />
800–171 version against which the <br />
assessment was conducted, all industry <br />
Commercial and Government Entity <br />
(CAGE) code(s) associated with the <br />
information system(s) addressed by the <br />
required system security plan, the date <br />
of assessment, the summary level score, <br />
and the date all NIST SP 800–171 R2 <br />
requirements are expected to be <br />
implemented based on the associated <br />
plan(s) of action in accordance with <br />
NIST SP 800–171 R2. Accordingly, and <br />
upon submission of an offer, when <br />
applicable, the contractor must verify <br />
that a summary level score(s) of a <br />
current NIST SP 800–171 DoD <br />
Assessment is posted in SPRS for all <br />
contractor information systems relevant <br />
to the offer to signify appropriate <br />
implementation of NIST SP 800–171 R2 <br />
requirements.
 
Findings from DoD Inspector General
 
report (DODIG–2019–105 ‘‘Audit of <br />
Protection of DoD CUI on Contractor- <br />
Owned Networks and Systems’’) <br />
indicate that DoD contractors did not <br />
consistently implement mandated <br />
system security requirements for <br />
safeguarding CUI. That report included <br />
recommendations for DoD take steps to <br />
assess a contractor’s ability to protect <br />
this information. The report emphasizes <br />
that malicious actors can exploit <br />
vulnerabilities in contractors’ <br />
information systems and exfiltrate <br />
information related to some of the <br />
Nation’s most valuable advanced <br />
defense technologies. Due to these <br />
shortcomings and the associated risks to <br />
national security, the Department <br />
developed the Cybersecurity Maturity <br />
Model Certification (CMMC) Program to <br />
assess contractor and subcontractor <br />
implementation of DoD’s required <br />
cybersecurity standards.
 
The CMMC Program verifies
 
compliance with DoD cyber protection <br />
standards by defense contractors and <br />
subcontractors and is designed to <br />
protect FCI and CUI that is shared by <br />
the Department with its contractors and <br />
subcontractors, and when developed by <br />
a contractor in the course of contract <br />
performance but not shared. The <br />
program incorporates a set of
 
cybersecurity requirements into <br />
acquisition contracts and provides the <br />
Department increased assurance that <br />
contractors and subcontractors are <br />
meeting these requirements. The CMMC <br />
Program has three key features:
 
• ''Tiered Model: ''CMMC requires that
 
companies demonstrate, through <br />
assessment that they have implemented <br />
cybersecurity requirements. The type of <br />
assessment and requirements against <br />
which it is conducted are selected based <br />
on the information that must be <br />
safeguarded. The program also sets forth <br />
the requirements for flow down of <br />
CMMC requirements to subcontractors.
 
• ''Assessment Requirement: ''CMMC
 
assessments allow the Department to <br />
verify the implementation of <br />
cybersecurity requirements.
 
• ''Implementation through Contracts: ''
 
Once CMMC is fully implemented, DoD <br />
contractors that handle FCI and CUI on <br />
their non-Federal information systems <br />
will be required to achieve a particular <br />
CMMC Status as a condition of contract <br />
award.
 
In September 2020, the DoD
 
published the 48 CFR CMMC interim <br />
final rule in the '''Federal Register <br />
'''(DFARS Case 2019–D041) that <br />
implemented the DoD’s initial vision for <br />
the CMMC Program and outlined the <br />
key features of the program. The 48 CFR <br />
CMMC interim final rule became <br />
effective on November 30, 2020.
 
In March 2021, the Department
 
initiated an internal review of CMMC’s <br />
implementation, informed by more than <br />
750 public comments in response to the <br />
48 CFR CMMC interim final rule. This <br />
comprehensive, programmatic <br />
assessment engaged cybersecurity and <br />
acquisition leaders within DoD to refine <br />
policy and program implementation.
 
In November 2021, the Department
 
announced an updated program <br />
structure with revised requirements <br />
designed to achieve the primary goals <br />
identified by DoD’s internal review of <br />
the CMMC Program. With the <br />
implementation of the revised CMMC <br />
program, the Department introduced <br />
several key changes that build on and <br />
refine the original program <br />
requirements. These include:
 
• Streamlining the CMMC model
 
from five levels to three levels.
 
• Exclusively implementing National
 
Institute of Standards and Technology <br />
(NIST) cybersecurity guidelines.
 
• Allowing all companies subject to
 
CMMC Level 1 requirements and subset <br />
of companies subject to CMMC Level 2 <br />
requirements to demonstrate CMMC <br />
compliance through self-assessments.
 
• Increased oversight of professional
 
and ethical standards of third-party <br />
assessors.
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00104
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83195 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
61
 
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171A.pdf ''https://nvlpubs.nist.gov/nistpubs/ '']
 
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171A.pdf ''SpecialPublications/NIST.SP.800-171A.pdf. '']
 
• Allowing Plans of Action &amp;
 
Milestones (POA&amp;M) under limited <br />
circumstances to achieve conditional <br />
certification.
 
In July 2022, the CMMC Program
 
Management Office (PMO) met with the <br />
Office of Advocacy for the U.S. SBA to <br />
address the revisions planned for <br />
CMMC and again met in July 2023 to <br />
review the proposed 32 CFR part 170 <br />
CMMC Program rule updates that are <br />
responsive to prior SBA concerns. As a <br />
result of the alignment of CMMC <br />
requirements to NIST guidelines, the <br />
Department’s requirements continue to <br />
evolve as changes are made to the <br />
underlying NIST SP 800–171 R2 and <br />
NIST SP 800–172 Feb2021 <br />
requirements. Such changes will not be <br />
effective as CMMC requirements unless <br />
and until made effective through <br />
rulemaking.
 
Objectives of, and Legal Basis for, the <br />
Rule
 
''Legal Basis: ''5 U.S.C. 301; Sec. 1648,
 
Public Law 116–92, 133 Stat. 1198.
 
The objective of this final CMMC
 
Program rule is to provide the <br />
Department with increased assurance <br />
that a defense contractor can adequately <br />
protect FCI and CUI commensurate with <br />
the risk, also accounting for information <br />
flow down to its subcontractors in a <br />
multi-tier supply chain. This rule meets <br />
the objective by providing a mechanism <br />
to assess contractor and subcontractor <br />
implementation of DoD’s cyber security <br />
protection requirements for FCI and <br />
CUI. Implementation of the CMMC <br />
Program is intended to address the <br />
following policy issues:
 
(a) Verification of a Contractor’s <br />
Cybersecurity Posture
 
Effective June 2016, FAR clause
 
52.204–21 Basic Safeguarding of <br />
Contractor Information Systems, <br />
requires Federal contractors and <br />
subcontractors to implement 15 basic <br />
safeguarding requirements, as <br />
applicable, to protect contractor <br />
information systems that process, store, <br />
or transmit FCI.
 
December 31, 2017, was the DoD
 
deadline for contractors to implement, <br />
as applicable, the cybersecurity <br />
protection requirements set forth in <br />
NIST SP 800–171 Re2, Protecting <br />
Controlled Unclassified Information in <br />
Nonfederal Systems and Organizations, <br />
in accordance with requirements of <br />
DFARS clause 252.204–7012, <br />
Safeguarding Covered Defense <br />
Information and Cyber Incident <br />
Reporting. NIST SP 800–171A Jun2018 <br />
states, ‘‘For the CUI security <br />
requirements in NIST Special <br />
Publication 800–171 Rev 2, nonfederal
 
organizations describe in a system <br />
security plan, how the specified <br />
requirements are met or how <br />
organizations plan to meet the <br />
requirements.’’ 61 The NIST process <br />
provides contractors with a tool to <br />
assess their security posture and decide <br />
if or when to mitigate the risks based <br />
upon the organizational risk tolerance. <br />
When the DoD implemented the NIST <br />
SP 800–171 requirements with a not- <br />
later-than date of December 2017, the <br />
policy intent was to permit contractors <br />
some flexibility to remediate lagging <br />
NIST requirements, and document them <br />
in plans of action, and resolve those <br />
deficiencies within a reasonable period. <br />
An unintended consequence of this <br />
flexibility was that some contractors far <br />
exceeded the intention to secure <br />
systems that must adequately safeguard <br />
CUI in a timely manner and instead <br />
created open-ended plans of action with <br />
undefined closure dates. The effect was <br />
to delay full compliance with <br />
safeguarding requirements for years. As <br />
a result, the DoD’s implementation of <br />
the NIST SP 800–171 requirements, as <br />
mandated by 32 CFR part 2002, has not <br />
been fully effective or validated. This <br />
necessitates implementation of the <br />
CMMC Program to enforce a finite <br />
timeline for full compliance of <br />
contractual requirements.
 
Findings from DoD Inspector General
 
report (DODIG–2019–105 ‘‘Audit of <br />
Protection of DoD Controlled <br />
Unclassified Information on Contractor- <br />
Owned Networks and Systems’’) <br />
indicated that DoD contractors did not <br />
consistently implement mandated <br />
system security requirements for <br />
safeguarding CUI and recommended <br />
that DoD take steps to assess a <br />
contractor’s ability to protect this <br />
information.
 
CMMC adds an assessment
 
requirement to verify defense <br />
contractors and subcontractors have <br />
implemented the applicable security <br />
requirements prior to award. CMMC <br />
also adds requirements at each CMMC <br />
level for contractors and subcontractors <br />
to affirm initial compliance with the <br />
specified CMMC security requirements <br />
and provide annual affirmations <br />
thereafter.
 
(b) Comprehensive Implementation of <br />
Cybersecurity Requirements
 
Although the security requirements in
 
NIST SP 800–171 R2 address a range of <br />
threats, they do not sufficiently address <br />
Advanced Persistent Threats (APTs). An <br />
APT is an adversary that possesses <br />
sophisticated levels of expertise and
 
significant resources, which allow it to <br />
create opportunities to achieve its <br />
objectives by using multiple attack <br />
vectors (''e.g., ''cyber, physical, and <br />
deception). To address APTs, NIST has <br />
published NIST SP 800–172 Feb2022. <br />
CMMC Level 3 certification assessment <br />
provides for government assessment of <br />
a contractor’s implementation of a <br />
defined subset of NIST SP 800–172 <br />
Feb2021 Enhanced Security <br />
Requirements with DoD predefined <br />
parameters and specifications.
 
(c) Scale and Depth
 
Today, DoD prime contractors must
 
include DFARS clause 252.204–7012 in <br />
subcontracts for which performance will <br />
involve covered defense information, <br />
but this does not provide the <br />
Department with sufficient insights with <br />
respect to the cybersecurity posture of <br />
all members of a multi-tier supply chain <br />
for any given program or technology <br />
development effort. The revised CMMC <br />
Program requires prime contractors to <br />
flow down CMMC requirements, as <br />
applicable, to subcontractors throughout <br />
their supply chain(s).
 
Given the size of the Defense
 
Industrial Base (DIB), the Department <br />
cannot scale its existing cybersecurity <br />
assessment workforce to conduct on-site <br />
assessments of approximately 220,000 <br />
DoD contractors and subcontractors <br />
every three years. The Department’s <br />
existing assessment capability is best <br />
suited for conducting targeted <br />
assessments for the relatively small <br />
subset of DoD contractors and <br />
subcontractors that support designated <br />
high-priority programs.
 
CMMC addresses the Department’s
 
scaling challenges by utilizing a private- <br />
sector accreditation structure. The DoD- <br />
recognized Accreditation Body will <br />
authorize, accredit, and provide <br />
oversight of CMMC Third-Party <br />
Assessment Organizations (C3PAO) <br />
which in turn will conduct CMMC <br />
Level 2 certification assessments of <br />
actual and prospective DoD contractors <br />
and subcontractors. Organizations <br />
Seeking Certification (OSCs) will <br />
directly contract with an authorized or <br />
accredited C3PAO to undergo a Level 2 <br />
certification assessment to achieve a <br />
CMMC Status of Conditional and Final <br />
Level 2 (C3PAO). The cost of CMMC <br />
Level 2 activities is driven by multiple <br />
factors, including market forces that <br />
govern availability of C3PAOs and the <br />
size and complexity of the enterprise or <br />
enclave under assessment. The <br />
Government will perform Level 3 <br />
certification assessments. Government <br />
resource limitations may affect schedule <br />
availability.
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00105
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83196 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
(d) Reduces Duplicate or Repetitive <br />
Assessments of Our Industry Partners
 
CMMC assessment results and
 
contractor affirmations of compliance <br />
will be posted in Supplier Performance <br />
Risk System (SPRS), DoD’s authoritative <br />
source for supplier and product <br />
performance information. Posting <br />
CMMC assessment results in SPRS <br />
precludes the need to validate CMMC <br />
implementation on a contract-by- <br />
contract basis. This enables DoD to <br />
identify whether the CMMC assessment <br />
requirements have been met for relevant <br />
contractor information system(s), avoids <br />
duplicative assessments, and eliminates <br />
the need for program level assessments, <br />
all of which results in decreased costs <br />
to both DoD and industry.
 
Significant Issues Raised by Public <br />
Comments
 
The CMMC proposed rule was
 
published in the '''Federal Register '''on <br />
December 26, 2023, to initiate the <br />
mandatory 60-day public review and <br />
comment period for this rule and the <br />
supporting documents that ended on 26 <br />
February 2024. From the volume of <br />
comments received on the CMMC rule <br />
documents, from or concerning Small <br />
Businesses, the following significant <br />
issues were raised.
 
1. ''Cost. ''Some comments identified
 
that the proposed rule does not address <br />
how the CMMC Program will be funded, <br />
or how the costs of certification and <br />
compliance will be shared between the <br />
DoD and the contractors. This may raise <br />
questions about the affordability and <br />
sustainability of the CMMC program, <br />
especially for small businesses. <br />
Commenters suggested that the DoD <br />
conduct and publish a comprehensive <br />
cost assessment for each level of CMMC <br />
certification and explore ways to reduce <br />
the financial burden on the contractors, <br />
such as providing incentives, subsidies, <br />
loans, grants, tax credits or <br />
reimbursements. Several comments <br />
presented the opinion that the cost <br />
estimates in the preamble/rule did not <br />
adequately address all possible costs to <br />
become compliant with regulations and <br />
attain a certification ''i.e., ''ongoing <br />
Recurring Engineering and Non- <br />
Recurring Engineering costs. Others <br />
commented that the mandate to comply <br />
with requirements, attain verification of <br />
compliance, and the inability to recoup <br />
costs prior to completing compliance <br />
will be barriers to entry and will drive <br />
many small businesses out of the DoD <br />
market. Concern was also expressed <br />
regarding the cost of failing an <br />
assessment and not being able to recoup <br />
costs fast enough, through increased <br />
Overhead and G&amp;A [General and
 
Administrative] rates. Another concern <br />
was raised that IR&amp;D [Independent <br />
Research and Development] spending <br />
will be negatively impacted due to the <br />
diversion of funds to Cybersecurity <br />
compliance. Some shared concerns <br />
about the potential for overmarking CUI <br />
data, that will drive a higher than <br />
necessary demand for CMMC <br />
certification and create an overburdened <br />
Ecosystem, thereby preventing timely <br />
certification and incentivizing ‘‘price <br />
gouging’’ by assessors. Several suggested <br />
that the Government regulate the prices <br />
for assessment services. Many <br />
commenters also suggested the DoD <br />
needed to find ways to reduce the <br />
financial burdens on small businesses <br />
through direct payment for compliance, <br />
tax incentives, increased profits, or <br />
increased flexibility to comply with <br />
requirements, ''i.e., ''by reducing <br />
requirements for small businesses or <br />
providing more time to comply after <br />
contract award. Commenters also felt <br />
the handling of CUI by small businesses <br />
was too difficult, and recommended <br />
prime contractors should be responsible <br />
for handling all CUI. If a small business <br />
needs CUI to execute its work, the prime <br />
or the Government should provide an <br />
environment for the small business to <br />
complete its work.
 
''DoD Response. ''In recognition of the
 
pervasive cyber threat both to DoD and <br />
to the DIB, CMMC Program <br />
requirements are designed to ensure <br />
compliance with existing standards for <br />
protection of FCI and CUI. These <br />
cybersecurity requirements align <br />
directly to NIST guidelines (NIST SP <br />
800–171 R2 and NIST SP 800–172 <br />
Feb2021) and the basic safeguarding <br />
requirements in FAR clause 52.204–21 <br />
that apply to all executive agencies. <br />
Since December 2017, DFARS clause <br />
252.204–7012 has required contractors <br />
to implement the NIST SP 800–171 <br />
security requirements to provide <br />
''adequate security ''as applicable for <br />
processing, storing, or transmitting CUI <br />
on non-Federal information systems, as <br />
needed in support of the performance of <br />
a DoD contract.
 
The executive branch’s CUI Program
 
is codified in 32 CFR part 2002 and <br />
establishes policy for designating, <br />
handling, and decontrolling information <br />
that qualifies as CUI. The definition of <br />
CUI and general requirements for its <br />
safeguarding are included in 32 CFR <br />
2002.4 and 2002.14. 32 CFR <br />
2002.14(h)(2) specifically requires that <br />
Agencies must use NIST SP 800–171 <br />
when establishing security requirements <br />
to protect CUI’s confidentiality on non- <br />
Federal information systems . . .’’ <br />
Contractually, DFARS clause 252.204– <br />
7012 requires contractors to implement
 
the NIST SP 800–171 R2 security <br />
requirements, and that requirement <br />
applies, regardless of the number of <br />
computers or components in a non- <br />
Federal information system or the size <br />
of the contractor or subcontractor, as <br />
applicable. DoD’s original <br />
implementation of security <br />
requirements for adequate safeguarding <br />
of CUI relied upon self-attestation by <br />
contractors. Since that time, the DoD <br />
Inspector General and the DCMA found <br />
contractors did not consistently <br />
implement mandated system security <br />
requirements for safeguarding CUI and <br />
recommended DoD take steps to assess <br />
a contractor’s ability to protect this <br />
information. The DoD has streamlined <br />
requirements to reduce the burden of <br />
compliance on contractors. Analysis of <br />
costs to meet CMMC requirements is <br />
provided in the regulatory impact <br />
analysis for this rule. As described in <br />
the estimate included with the rule, the <br />
major cost categories for compliance <br />
with CMMC requirements include costs <br />
for completing a self-assessment (''e.g., <br />
''Level 1 or 2); costs to prepare for and <br />
undergo Level 2 certification <br />
assessment; and costs required to <br />
implement the Level 3 security <br />
requirements and for preparing to <br />
undergo DCMA DIBCAC assessment <br />
(Level 3). CMMC Level 3 certification <br />
assessments against the NIST SP 800– <br />
172 Feb2021 baseline are performed free <br />
of cost by DoD assessors, which reduces <br />
the overall cost of achieving CMMC <br />
Status of Level 3 (DIBCAC). Notably, <br />
certification is never required for CMMC <br />
Level 1, and the requirement can be <br />
satisfied through self-assessment. When <br />
CMMC Level 2 requirements apply, they <br />
may be met via self-assessment, or a <br />
certification assessment conducted by a <br />
C3PAO, depending on the specific <br />
CMMC requirement cited in the <br />
solicitation or resulting contract. When <br />
the CMMC Program requirements are <br />
effective, solicitations for DoD contracts <br />
that will involve the processing, storing, <br />
or transmitting of FCI or CUI on any <br />
non-Federal system, notwithstanding <br />
the size or configuration of the non- <br />
Federal system, will specify the <br />
required CMMC Level (1, 2 or 3) and <br />
assessment type (self-assessment or <br />
certification assessment). An <br />
assumption for the cost estimates is that <br />
Non-Small Entities have a full-time <br />
team of cybersecurity professionals on <br />
staff while Small Entities do not. The <br />
assumptions, explained in the <br />
regulatory impact analysis, reflect Small <br />
Entities will likely obtain support from <br />
External Service Providers and have a <br />
staff member submit affirmations and <br />
SPRS scores for self-assessments. All
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00106
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83197 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
these costs, except the open market cost <br />
of a C3PAO, are directly controllable by <br />
the organization seeking assessment. <br />
The CMMC rule does not make any <br />
change to cost allowability as defined in <br />
FAR 31.201–2 Determining <br />
Allowability. The DoD declined to <br />
modify the estimates, which are <br />
intended to be representative and to <br />
inform rulemaking. The cost estimates <br />
represent average derived estimates <br />
based on internal expertise and public <br />
feedback in accordance with OMB <br />
Circular A–4 and represent average <br />
costs for companies to comply with the <br />
CMMC requirements. This rule does not <br />
provide the cost analysis for all actions, <br />
personnel, and security measures <br />
required to protect CUI information, <br />
data, systems, and technical products <br />
through the life cycle of the work and <br />
data generated. The size and complexity <br />
of the network within scope of the <br />
assessment impacts the costs as well. As <br />
required by rulemaking guidance, the <br />
DoD provided cost estimates and impact <br />
analyses. An analysis of profit margins <br />
is not required. Additionally, this rule <br />
and the required cost analysis and <br />
resulting cost estimates were reviewed <br />
by DoD cost analysts and OMB <br />
economists for realism and <br />
completeness.
 
Some public comments received
 
reflect a misinterpretation of the cost <br />
estimates that accompany this rule, <br />
which are representative of average <br />
assessment efforts, and do not include <br />
actual prices of C3PAO services <br />
available in the marketplace. Market <br />
forces of supply and demand will <br />
determine C3PAO pricing for CMMC <br />
Level 2 certification assessments.
 
Costs associated with meeting the
 
requirements of existing DFARS clause <br />
252.204–7012 are not captured in the <br />
CMMC rule documentation. Please refer <br />
to 81 FR 72990, October 21, 2016, for <br />
DoD’s final rule implementing the DoD’s <br />
requirement that ‘‘contractors shall <br />
implement NIST SP 800–171 as soon as <br />
practical, but not later than December <br />
31, 2017.’’ Public comments related to <br />
implementation costs were published <br />
with that final rule, along with DoD’s <br />
responses. Within the limitations of <br />
section § 170.21 Plan of Action and <br />
Milestones Requirements, offerors may <br />
bid on contract opportunities while <br />
continuing to work towards full <br />
compliance.
 
Verifying compliance with applicable
 
security requirements may increase <br />
costs and is necessary for the adequate <br />
protection of DoD FCI and CUI. The cost <br />
of lost technological advantage over <br />
potential adversaries is far greater than <br />
the costs of such enforcement. The <br />
value of information and impact of its
 
loss does not diminish when the <br />
information is shared with contractors.
 
At the time of contract award, the
 
DoD may not have visibility into <br />
whether the prime contractor’s decision <br />
to further disseminate DoD FCI and CUI. <br />
However, FAR clause 52–204–21, <br />
DFARS clause 252.204–7012, and <br />
DFARS clause 252.204–7021 require the <br />
prime contractor to flow down these <br />
clauses and the included information <br />
security requirement to any <br />
subcontractor that will process, store, or <br />
transmit FCI or CUI, as applicable. <br />
Decisions regarding DoD’s information <br />
that must be shared to support <br />
completion of the contract tasks, <br />
including those performed by <br />
subcontractors, takes place between the <br />
prime contractor and their <br />
subcontractors. The DoD cannot dictate <br />
business practices between prime <br />
contractors and their subcontractors, <br />
who should work together to determine <br />
the necessary flow down of FCI and <br />
CUI, only as needed in performance of <br />
the contract, and ensuring compliance <br />
with the CMMC security requirements <br />
and in consideration of minimizing the <br />
burden. While DoD understands the <br />
burden on small business, it must <br />
enforce CMMC requirements uniformly <br />
across the Defense Industrial Base for all <br />
contractors who process, store, or <br />
transmit FCI and CUI. The requirements <br />
necessary to protect a single document <br />
are the same as to protect many <br />
documents.
 
Although CMMC compliance may add
 
to an organization’s cost, no member of <br />
the DIB can assume the status-quo in <br />
today’s ever-changing cybersecurity <br />
environment. Increasing costs to protect <br />
the nation’s data and industries from <br />
emerging threats is simply a component <br />
of doing business anywhere in the <br />
world. Processing, storing, or <br />
transmitting sensitive Government <br />
information comes with a handling cost <br />
that needs to be built into each <br />
organization’s business model. All <br />
contractors or sub-contractors with <br />
access to CUI need to be capable of <br />
protecting that information to the <br />
standards specified in 32 CFR part 2002. <br />
If a small business cannot comply with <br />
the requirements of DFARS clause <br />
252.204–7012 and NIST SP 800–171 R2, <br />
then that business should not receive <br />
CUI or process, store, or transmit CUI. <br />
If the DoD information flowed by the <br />
prime to a subcontractor is only FCI, <br />
then only a CMMC Level 1 self- <br />
assessment is required for the <br />
subcontractor prior to the flow of <br />
information under contract. DoD’s <br />
programs, technological superiority, and <br />
best interests are not served if FCI and <br />
CUI are not consistently and adequately
 
safeguarded by all who process, store, or <br />
transmit it.
 
2. ''Cost Benefit. ''Some commenters
 
suggested it would be more cost <br />
effective for DoD to provide an <br />
environment or a DoD managed portal <br />
for the handling of CUI. A significant <br />
concern expressed was that companies <br />
have delayed complying with DoD <br />
cybersecurity standards until the CMMC <br />
rule was released and they could <br />
understand what level of compliance <br />
they will require. Several commenters <br />
felt DoD underestimated the costs and <br />
should have include the <br />
implementation cost of the requirements <br />
in this rule as well. One commenter was <br />
confused about how the discount rates <br />
were applied. Another commenter <br />
suggested that DoD provide flexibility to <br />
allow small businesses to not meet all <br />
the requirements and still be allowed to <br />
handle CUI and another expressed <br />
concerns regarding the cost of <br />
compliance and the degradation of the <br />
DIB that will be unable to afford <br />
compliance.
 
''DoD Response: ''The DoD declined to
 
adopt the alternatives suggested in the <br />
comments, such as policy-based <br />
solutions that lack a rigorous assessment <br />
component or sharing CUI only through <br />
DoD-hosted secure platforms. The <br />
current DFARS clause 252.204–7012 <br />
requires protection of Security <br />
Protection Assets (SPA) and Security <br />
Protection Data (SPD). Section 1.1 of <br />
NIST SP 800–171 R2 states: ‘‘The <br />
requirements apply only to components <br />
of nonfederal systems that process, <br />
store, or transmit CUI, or that provide <br />
security protection for such <br />
components.’’ There is therefore no <br />
increase in the scope because of the <br />
CMMC Program as described in the rule.
 
SPD requires protection
 
commensurate with the CUI it protects <br />
and is based on how and where the SPD <br />
is stored. The FedRAMP requirements <br />
for handling SPD are therefore the same <br />
as that for handling CUI.
 
The CMMC rule made no change to
 
the FAR cost allowability or cost <br />
accounting standards. The 7% discount <br />
rate is not a discount for organizations; <br />
it is a part of a formula used in the <br />
regulatory impact analysis (RIA) <br />
calculations. When calculating 20 years <br />
in the future, a discount rate is used to <br />
determine the net present value of <br />
money. The cost estimate represents <br />
derived estimates based on internal <br />
expertise and public feedback in <br />
accordance with OMB Circular A–4: <br />
Regulatory Impact Analysis: A Primer. <br />
Step 7 in the manual explains discount <br />
rates.
 
As written, this rule amply provides
 
for the flexibility sought by the
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00107
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83198 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
commenter. Rule section § 170.21 <br />
specifically addresses the flexibility to <br />
have a Plan of Action and Milestones <br />
(POA&amp;M) to delay meeting certain <br />
requirements subject to CMMC <br />
assessment for up to 180 days.
 
In addition, DFARS clause 252.204–
 
7012 already permits contractors to <br />
request DoD CIO permission to utilize <br />
alternative security measures to those <br />
prescribed by NIST SP 800–171. If an <br />
OSC previously received a favorable <br />
adjudication from the DoD CIO for an <br />
alternative security measure, the DoD <br />
CIO adjudication must be included in <br />
the system security plan to receive <br />
consideration during an assessment. <br />
Implemented security measures <br />
adjudicated by the DoD CIO as equally <br />
effective are assessed as MET if there <br />
have been no changes in the <br />
environment.
 
3. ''CMMC Model. ''Some commenters
 
claimed that the requirement for all <br />
subcontractors of Level 3 prime <br />
contractors to be at least Level 2 <br />
certified, regardless of what work they <br />
do, will generate more demand for Level <br />
2 assessments than the Department is <br />
anticipating. Since much of DoD’s <br />
contract dollars flow through a <br />
relatively small number of companies, it <br />
is likely those companies will have at <br />
least one CMMC Level 3 project. The <br />
result would be Level 2 certification <br />
requirements being flowed down to <br />
nearly the entirety of the DIB. Some <br />
commenters believed this to be an <br />
unintended consequence of <br />
implementing the enhanced protection <br />
of CMMC Level 3.
 
''DoD Response: ''It is possible the
 
commenters misunderstood § 170.23 <br />
Application to subcontractors in the <br />
rule. § 170.23(a)(4) states: ‘‘If a <br />
subcontractor will process, store, or <br />
transmit CUI in performance of the <br />
subcontract and the associated prime <br />
contractor has a requirement for the <br />
CMMC Status of Level 3 (DIBCAC), then <br />
the CMMC Status of Level 2 (C3PAO) is <br />
the minimum requirement for the <br />
subcontractor.’’ The commenter’s phrase <br />
‘‘regardless of what work they do’’ does <br />
not acknowledge the fact that the Level <br />
2 certification assessment is required for <br />
subcontractors who process, store, or <br />
transmit CUI.
 
It is also possible that the commenter
 
interpreted that a Level 2 self- <br />
assessment is adequate for <br />
subcontractors working with a prime <br />
that has a contractual requirement for a <br />
Level 3 certification assessment. In this <br />
case, a CMMC Status of Final Level 2 <br />
(Self) is not adequate. A CMMC Status <br />
of Final Level 3 (DIBCAC) signifies that <br />
the prime first achieved a CMMC Status <br />
of Final Level 2 (C3PAO) as the risk to
 
their CUI was deemed high enough to <br />
require Level 2 certification assessment. <br />
Since this same information may be <br />
shared with subcontractors who <br />
process, store, or transmit CUI, the <br />
subcontractor must also achieve CMMC <br />
Status of Final Level 2 (C3PAO).
 
The decision to rely upon a CMMC
 
Level 2 self-assessment in lieu of a <br />
certification assessment is a <br />
Government risk-based decision based <br />
upon the nature of the effort to be <br />
performed and CUI to be shared. The <br />
size of the company with access to the <br />
CUI is not a basis for this determination. <br />
The value of information and impact of <br />
its loss does not diminish when the <br />
information moves to contractors of <br />
smaller size.
 
4. ''Assessment. ''Commenters
 
questioned whether CMMC will accept <br />
reciprocity with other compliance <br />
methodologies. Another questioned <br />
what would drive a company to seek a <br />
reassessment of their environment. <br />
Other commenters suggested that we <br />
allow small businesses 365 days to close <br />
their POA&amp;M requirements, as well as <br />
suggesting that pre-assessment materials <br />
do not need to be uploaded into eMASS, <br />
and that the hashing requirements <br />
should be simplified. Other suggestions <br />
made were to allow Program Managers <br />
to relax requirements based on a risk <br />
decision and allow assessors to make <br />
judgement calls on what evidence <br />
constitutes compliance with the <br />
requirement. One commenter requested <br />
the DoD publish an overview of the <br />
assessment methodology that includes <br />
the defined frequency guidelines. <br />
Additionally, one commenter requested <br />
that access to Procurement Integrated <br />
Enterprise Environment (PIEE) and <br />
Supplier Performance Risk System <br />
(SPRS) be made easier for small <br />
contractors.
 
''DoD Response: ''CMMC requirements
 
apply to DoD contracts, and not to <br />
contracts issued by other agencies. Flow <br />
down of CMMC requirements from a <br />
prime contractor to its subcontractors <br />
shall apply, as addressed in § 170.23(a) <br />
of this rule.
 
DoD intends to allow qualified
 
standards acceptance of a DIBCAC High <br />
Assessment using NIST SP 800–171 R2 <br />
for CMMC Status of Final Level 2 <br />
(C3PAO) as addressed in § 170.20.
 
CMMC Level 2 self-assessment, Level
 
2 certification assessment, and Level 3 <br />
certification assessment are valid for a <br />
defined CMMC Assessment Scope as <br />
outlined in § 170.19 CMMC Scoping. A <br />
new CMMC assessment may be required <br />
if significant architectural or boundary <br />
changes are made to the previous <br />
Assessment Scope. Examples include, <br />
but are not limited to, expansions of
 
networks or mergers and acquisitions. <br />
Operational changes within an <br />
Assessment Scope, such as adding or <br />
subtracting resources within the existing <br />
assessment boundary that follow the <br />
existing SSP do not require a new <br />
assessment, but rather are covered by <br />
the annual affirmations to the <br />
continuing compliance with <br />
requirements.
 
The DoD did not accept the
 
recommendation to change the criteria <br />
for POA&amp;Ms or the timeline allowed to <br />
remediate open POA&amp;M items. The 180- <br />
day timeline and the determination of <br />
the weighted practices that may be <br />
included in a POA&amp;M were risk-based <br />
decisions. The determination factored <br />
the relative risk DoD is willing to accept <br />
when a particular practice is Not Met <br />
and the amount of risk the DoD is <br />
willing to accept for those security <br />
practices that remain ‘‘NOT MET’’ for <br />
an extended period. Unlike the original <br />
CMMC Program, the revised CMMC <br />
Program accepts some risk with the use <br />
of limited POA&amp;Ms.
 
There is value to the DoD in having
 
the pre-assessment information in <br />
CMMC eMASS for overall program <br />
management and oversight. The <br />
information indicates that an <br />
assessment is either scheduled or in- <br />
process. The CMMC PMO seeks to track <br />
CMMC Program adoption, and the pre- <br />
assessment information allows reporting <br />
on upcoming assessments. Based on the <br />
DoD’s cost analysis, the cost to upload <br />
pre-assessment material is minimal. The <br />
rule and Hashing Guide have been <br />
updated to add clarity that only <br />
reporting a single hash is required, and <br />
the name of the hash algorithm used <br />
needs to be stored in CMMC eMASS. <br />
Each Assessment Objective in NIST SP <br />
800–171A Jun2018 must yield a finding <br />
of MET or NOT APPLICABLE for the <br />
overall security requirement to be <br />
scored as MET. Assessors exercise <br />
judgment in determining when <br />
sufficient and adequate evidence has <br />
been presented to make an assessment <br />
finding. This is consistent with current <br />
DIBCAC High Assessments and <br />
assessments conducted under the Joint <br />
Surveillance Voluntary Assessment <br />
(JSVA) program.
 
A security requirement can be
 
applicable, even with assessment <br />
objectives that are N/A. The security <br />
requirement is NOT MET when one or <br />
more applicable assessment objectives is <br />
NOT MET. The requirements of each <br />
Level of the CMMC Model are defined <br />
in sections §§ 170.15 through 170.18 <br />
and the scoring of assessments is <br />
described in § 170.24. The assessment <br />
frequency required is every year for a <br />
CMMC Status of Final Level 1 (Self),
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00108
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83199 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
and every 3 years for a CMMC Statuses <br />
of Final Level 2 (Self), Final Level 2 <br />
(C3PAO), and Final Level 3 (DIBCAC), <br />
or when changes within the CMMC <br />
Assessment Scope invalidate the <br />
assessment.
 
The phased implementation plan for
 
CMMC described in § 170.3(e) is <br />
intended to address ramp-up issues, <br />
provide time to train the necessary <br />
number of assessors, and allow <br />
companies the time needed to <br />
understand and implement CMMC <br />
requirements. The rule has been <br />
updated to add an additional six months <br />
to the Phase 1 timeline. Phase 2 will <br />
start one calendar year after the start of <br />
Phase 1.
 
5. ''Scoping. ''Commenters expressed
 
concerns about how External Service <br />
Providers (ESP) and SPA and SPD are <br />
handled with regard to certification. <br />
Another commenter expressed concern <br />
about the lack of FedRAMP Moderate <br />
certified capabilities in the market as <br />
well as requesting clarification on the <br />
definition of ‘‘Specialized Assets’’, <br />
specifically regarding equipment in <br />
manufacturing that may not fall under <br />
the conventional categories of IoT, IIoT, <br />
and OT. Another commenter expressed <br />
concerns about how Contractor Risk <br />
Managed Assets (CRMA) are handled, <br />
along with concerns about available <br />
FedRAMP certified capabilities. Other <br />
comments identified concerns with the <br />
responsibility of a company that adopts <br />
an ESP and their adherence to security <br />
requirements, and the lack of time given <br />
in Phase 2 of the CMMC roll-out to <br />
garner certification. A question was also <br />
asked regarding the Department’s <br />
assumptions on the rigor a Certifying <br />
Officer [Affirming Official in the rule] <br />
would require before signing an <br />
attestation and the methodology used to <br />
determine the resultant actions that <br />
must be taken. Another raised a concern <br />
regarding how sub-environments are <br />
handled as well as end-to-end <br />
encryption in handling CUI. Another <br />
expressed concern regarding the <br />
marking of data as CUI and the potential <br />
for overmarking. Some commenters <br />
made suggestions that all CUI be held in <br />
a special appendix for contracts and <br />
only be allowed to be accessed at the <br />
prime’s facility or through a government <br />
hosted secure portal. A commenter also <br />
suggested that small businesses should <br />
not be made to meet the CMMC Level <br />
3 requirements. Another commenter <br />
raised questions about the alternatives <br />
that the Department considered in <br />
developing the CMMC Program. <br />
Another suggestion was to provide <br />
uniform web-based training on <br />
cybersecurity and that the definition of <br />
CUI was unclear, and CUI should stay
 
under the control of the Federal <br />
Government and be maintained in a <br />
government owned secure portal. A <br />
suggestion was also made that DoD <br />
establish a Cyber Protection Program <br />
that monitors DIB companies and <br />
provides real time health reports on the <br />
DIB and dynamic intelligence security <br />
alerts and recommended actions. A <br />
suggestion that NIST establish a special <br />
standard for micro-organizations was <br />
also provided. Commenters also <br />
suggested that the rule was too <br />
stringent, and CUI was not marked well <br />
or flowed down to subcontractors <br />
appropriately.
 
''DoD Response: ''The Department is
 
committed to overseeing the CMMC <br />
Program and will take appropriate <br />
measures to ensure its efficient <br />
execution. Presently, the Department <br />
has no intention of mandating that <br />
contracting offices adopt presumptive <br />
measures that would reduce the number <br />
of small contracts subject to Level 2 <br />
certification assessment, nor does it <br />
plan to impose affirmative requirements <br />
on prime contracts to utilize enclaves.
 
Prior to conduct of an assessment, the
 
OSC engages with the C3PAO assessor. <br />
It is during this time that classification <br />
of assets should be established, and the <br />
results of these discussions documented <br />
in pre-planning materials. This is an <br />
example of the pre-assessment and <br />
planning material submitted by the <br />
C3PAO as required in § 170.9(b)(8) and <br />
the CMMC Assessment Scope submitted <br />
to eMASS as required in <br />
§ 170.17(a)(1)(i)(D). The DoD considered <br />
the NIST definitions for System <br />
Information and Security Relevant <br />
Information in the development of the <br />
CMMC definition for SPD. This rule <br />
does not regulate an OSA’s SPD, but <br />
instead implements existing regulatory <br />
requirements for the safeguarding of <br />
CUI, as defined in 32 CFR 2002.14(h)(2) <br />
and implemented by DFARS clause <br />
252.204–7012. The DFARS clause <br />
252.204–7012 requires protection of <br />
security protection assets and security <br />
protection data through its specification <br />
of NIST SP 800–171. Section 1.1 of <br />
NIST SP 800–171 R2 states: ‘‘The <br />
requirements apply only to components <br />
of nonfederal systems that process, <br />
store, or transmit CUI, or that provide <br />
security protection for such <br />
components.’’ There is therefore no <br />
increase in the scope as described in the <br />
rule, and no revisions to cost estimates <br />
are required.
 
The DoD received numerous
 
comments about the requirements for <br />
CMMC when an ESP is used. In <br />
response to these comments, the DoD <br />
revised the rule to reduce the <br />
assessment burden on External Service
 
Providers (ESPs) by updating the ESP <br />
assessment, certification, and <br />
authorization requirements in <br />
§§ 170.19(c)(2) and (d)(2).
 
The use of an ESP, its relationship to
 
the OSA, and the services provided <br />
need to be documented in the OSA’s <br />
System Security Plan and described in <br />
the ESP’s service description and <br />
customer responsibility matrix (CRM), <br />
which describes the responsibilities of <br />
the OSA and ESP with respect to the <br />
services provided.
 
An ESP is considered a Cloud Service
 
Provider (CSP) when it provides its own <br />
cloud services based on a model for <br />
enabling ubiquitous, convenient, on- <br />
demand network access to a shared pool <br />
of configurable computing that can be <br />
rapidly provisioned and released with <br />
minimal management effort or service <br />
provider interaction on the part of the <br />
OSA. ESPs that are CSPs, and process, <br />
store, or transmit CUI, must meet the <br />
FedRAMP requirements in DFARS <br />
clause 252.204–7012. ESPs that are <br />
CSPs and do ''not ''process, store, or <br />
transmit CUI, are not required to meet <br />
FedRAMP requirements in DFARS <br />
clause 252.204–7012.
 
An ESP that is not an CSP and
 
processes, stores, or transmits CUI, is <br />
considered an extension of the OSA’s <br />
environment and the ESP services used <br />
to meet OSA requirements are within <br />
the scope of the OSA’s CMMC <br />
assessment. As part of that environment, <br />
the ESP will be assessed against all <br />
applicable requirements and <br />
accountable for all users who have <br />
access to CUI as part of the ESP’s <br />
service, not just OSA employees. ESPs <br />
that are not CSPs and do NOT process, <br />
store, or transmit CUI, do not require <br />
CMMC assessment.
 
Nothing in the rule precludes an ESP,
 
that is not a CSP, from voluntarily <br />
requesting a C3PAO assessment, and a <br />
C3PAO from performing such an <br />
assessment, if the ESP makes that <br />
business decision. Similarly, the ESP <br />
can request a Level 3 certification <br />
assessment from the DCMA DIBCAC if <br />
they have successfully met all the <br />
requirements during a Level 2 <br />
certification assessment.
 
ESPs can be part of the same
 
corporate/organizational structure but <br />
still be external to the OSA such as a <br />
centralized SOC or NOC which supports <br />
multiple business units. An ESP that is <br />
used as staff augmentation and the OSA <br />
provides all processes, technology, and <br />
facilities does not need a CMMC <br />
assessment.
 
An ESP (not a CSP) that provides
 
technical support services to its clients <br />
would be considered an MSP, since it <br />
does not host its own cloud platform
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00109
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83200 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
offering. An ESP may utilize cloud <br />
offerings to deliver services to clients <br />
without being a CSP. An ESP that <br />
manages a third-party cloud service on <br />
behalf of an OSA would not be <br />
considered a CSP.
 
6. ''POA&amp;M. ''Commenters expressed
 
concern regarding the limited nature of <br />
POA&amp;Ms in CMMC as well as the <br />
timeline and lack of flexibility in <br />
remediating the POA&amp;Ms.
 
''DoD Response. ''The DoD did not
 
accept the recommendation to change <br />
the criteria in § 170.21 for POA&amp;M <br />
requirements or the timeline allowed to <br />
remediate open POA&amp;M items. The 180- <br />
day timeline and the determination of <br />
which weighted practices can be placed <br />
on a POA&amp;M were risk-based decisions. <br />
The determination factored into account <br />
for the relative risk DoD is willing to <br />
accept when a particular practice is not <br />
met and the amount of risk the DoD is <br />
willing to accept for those security <br />
practices that remain ‘‘NOT MET’’ for <br />
the extended period of time. The phased <br />
implementation plan in § 170.3(e) is <br />
intended to address ramp-up issues, <br />
provide time to train the necessary <br />
number of assessors, and allow <br />
companies the time needed to <br />
understand and implement CMMC <br />
requirements. DoD has updated the rule <br />
to add an additional six months to the <br />
Phase 1 timeline, now one year. Phase <br />
2 will start one calendar year after the <br />
start of Phase 1.
 
7. ''Incorporation by Reference. ''
 
Commenters expressed concern about <br />
the confusion between the NIST 800– <br />
171 R2 being included in the CMMC <br />
rule and not the recently published Rev <br />
3.
 
''DoD Response. ''The Office of the
 
Federal Register regulations (1 CFR part <br />
51) require the specification of a <br />
revision to a standard. Specifying a <br />
revision benefits the CMMC Ecosystem <br />
by ensuring it moves forward from one <br />
NIST standard to the next in an <br />
organized manner. The DoD cites NIST <br />
SP 800–171 R2 in this final rule for a <br />
variety of reasons, including the time <br />
needed for industry preparation to <br />
implement and time needed to prepare <br />
the CMMC Ecosystem to perform <br />
assessments against subsequent <br />
revisions. DoD is unable to incorporate <br />
suggestions that CMMC assessments be <br />
aligned to whichever NIST revision is <br />
current at the time of solicitation. <br />
Comments on the specifics on NIST SP <br />
800–171 Revision 3 should be directed <br />
to NIST.
 
8. ''Affirmation. ''Commenters expressed
 
confusion regarding the definition of the <br />
Affirming Official as well as how the <br />
affirmation process works ''i.e., ''is the <br />
affirmation for each company or the
 
whole supply chain. One commenter <br />
also expressed confusion regarding <br />
whether an affirmation was required at <br />
each certification level annually.
 
''DoD Response. ''The rule was modified
 
to include a definition for ''Affirming <br />
Official ''in § 170.4.
 
The DoD considered the
 
recommended text revisions and <br />
modified the text for added clarity about <br />
affirmations. DoD’s use of the term OSA <br />
within the affirmations section is <br />
deliberate and conveys that each <br />
organization is responsible for <br />
affirmations pertaining to their own <br />
assessments. To help clarify the point in <br />
question, § 170.22(a)(1) addresses <br />
Affirming Official and has been revised <br />
to clarify that CMMC affirmations shall <br />
be submitted by the OSA and apply <br />
only to the information systems of that <br />
organization.
 
The DoD deems that the requirement
 
to annually affirm continuing <br />
compliance with the CMMC <br />
requirements at the designated CMMC <br />
Level and following the procedures in <br />
§ 170.22 is not a significant additional <br />
burden. The requirement for annual <br />
affirmations takes the place of an annual <br />
recertification and ensures the <br />
Affirming Official responsible for <br />
CMMC requirements is monitoring <br />
compliance.
 
9. ''Alternatives. ''Several commenters
 
provided suggestions for alternative <br />
means to implement verification of <br />
compliance with cybersecurity <br />
standards. These suggestions included <br />
the following:
 
• Provide flexibility for the CMMC
 
AB to allow a C3PAO partial assessment <br />
of perspective Managed Service <br />
Providers.
 
• Allow small businesses to continue
 
performing self-assessments and self- <br />
certify along with increasing the support <br />
provided to small business from DC3 to <br />
expand paying for consultants to assist <br />
with compliance as well as paying for <br />
small businesses assessments,
 
• Integrate cybersecurity and
 
traditional counterintelligence <br />
measures, establishing a secure software <br />
development environment in a cloud <br />
that DoD hosts, as well as providing a <br />
secure environment in which small <br />
businesses could operate.
 
• Require Prime contractors to
 
assume the cost of CMMC for their <br />
supply chain.
 
• Only assess a sampling of the
 
Defense Industrial Base.
 
• Increase the Certification validity
 
time period from 3 to 10 years.
 
• Shift the requirement to post award.
 
• Re-evaluate the program to reduce
 
requirements to make it easier.
 
• Stay with only the DCMA DIBCAC
 
performing assessments on the DIB.
 
''DoD Response: ''DoD considered many
 
alternatives before deciding upon the <br />
current CMMC structure. To date, <br />
alternative methods of assessment have <br />
proven inadequate and necessitated the <br />
establishment of CMMC. The DoD <br />
determined the requirements for a <br />
CMMC Accreditation Body, and this <br />
accreditation body will administer the <br />
CMMC Ecosystem.
 
DoD must enforce CMMC
 
requirements uniformly across the DIB <br />
for all contractors and subcontractors <br />
who process, store, or transmit CUI. The <br />
value of information and the impact of <br />
its loss does not diminish when the <br />
information moves to contractors and <br />
subcontractors.
 
The DoD notes with interest the
 
commenter’s reference to initiatives in a <br />
report to Congress describing the <br />
breadth of cybersecurity related <br />
initiatives within the Department. While <br />
the CMMC Program is an important <br />
initiative, it is by no means the <br />
Department’s only effort to improve DIB <br />
cybersecurity. The CMMC Program <br />
addresses the adequate safeguarding of <br />
contractor owned information systems <br />
which process, store, or transmit FCI or <br />
CUI. Other DoD initiatives related to <br />
secure cloud or software development <br />
environments are beyond the scope of <br />
the CMMC Program.
 
The DoD declined to accept the
 
recommended alternative of relying <br />
exclusively on self-assessment with the <br />
potential to require a DIBCAC <br />
assessment for only a sampling of DoD <br />
contractors, which is essentially the <br />
status quo. Both GAO reporting and <br />
other DoD analysis have shown that the <br />
DIB has not consistently implemented <br />
the NIST SP 800–171 requirements <br />
needed to comply with DFARS clause <br />
252.204–7012, notwithstanding DoD’s <br />
stated objective in this clause is for <br />
compliance ‘‘as soon as practical, but <br />
not later than December 31, 2017.’’
 
The DoD declined to accept the risk
 
associated with implementing CMMC as <br />
a post-award requirement. When <br />
contracts require contractors to process, <br />
store, or transmit CUI, DoD requires that <br />
they be compliant with DFARS clause <br />
252.204–7012 and competent to <br />
adequately safeguard CUI from the <br />
beginning of the period of performance.
 
DoD declined the recommendation to
 
require primes to assume the cost of <br />
CMMC compliance for their <br />
subcontractors.
 
The aggregated SPRS reporting and
 
scoring is CUI. The DoD does not plan <br />
to make this information public at this <br />
time, as it may aid adversaries in <br />
coordinating their attacks.
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00110
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83201 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
The Department declined to adopt the
 
recommendation to allow DIB members <br />
to assist in designing the DoD’s <br />
mechanism for assessing DIB <br />
compliance with DoD’s contractual <br />
requirements. In developing the CMMC <br />
program, the DoD sought and <br />
considered DIB input.
 
DoD disagreed with the comment that
 
there is a lack of scalability in the <br />
CMMC Program. The phased <br />
implementation plan described in <br />
§ 170.3(e) is intended to address ramp- <br />
up issues within the CMMC Ecosystem, <br />
provide time to train the necessary <br />
number of assessors, and allow <br />
companies the time needed to <br />
understand and implement CMMC <br />
requirements.
 
The rule was updated to add an
 
additional six months to the Phase 1 <br />
timeline, now one year. Further <br />
extension of the implementation period <br />
or other solutions may be considered in <br />
the future to mitigate any C3PAO <br />
capacity issues, but the Department has <br />
no such plans at this time.
 
As with all DoD programs, the
 
Department intends to effectively <br />
oversee the CMMC Program and take the <br />
actions needed to manage its effective <br />
implementation. Although the full <br />
extent of DoD’s oversight process is <br />
beyond the scope of this rule, the rule <br />
text does address DoD’s authority to <br />
waive the application of CMMC <br />
requirements when warranted.
 
The DoD disagrees with commenters’
 
assertions about NIST SP 800–171 R2 <br />
and the available assessment methods. <br />
The NIST SP 800–171 R2 standard was <br />
chosen since it is enterprise focused and <br />
already required in DoD contracts when <br />
DFARS clause 252.204–7012 is <br />
applicable.
 
DCMA DIBCAC currently performs
 
assessments against NIST SP 800–171 <br />
R2, which identifies the target audience <br />
to include individuals with security <br />
assessment responsibilities, such as <br />
auditors, assessors, and ‘‘independent <br />
verifiers.’’
 
The Department does not have the
 
organic capacity to adequately assess <br />
the 220,000+ companies in the DIB. The <br />
DoD will not assume the workload of <br />
directly assessing every DIB contractor.
 
In this final rule, DoD established a
 
scalable way to verify, through <br />
assessment, that contractors have <br />
implemented required security <br />
measures necessary to safeguard DoD’s <br />
information.
 
It is important that contractors
 
maintain security compliance for <br />
systems that process, store, or transmit <br />
DoD CUI. Given the evolving <br />
cybersecurity threat, DoD’s best interests <br />
are served by ensuring that Level 2 self-
 
assessment and certification <br />
assessments remain valid for no longer <br />
than a 3-year period, regardless of who <br />
performs the assessment.
 
10. ''Applicability. ''Commenters
 
expressed frustration with exempting <br />
Commercial- Off-The-Shelf (COTS) <br />
products and procurements under the <br />
micro-purchase threshold from CMMC <br />
certification, and not providing <br />
exemptions for Native American, small, <br />
disadvantaged businesses, and Small <br />
Business Innovative Research contracts. <br />
They also expressed concerns about <br />
perceived threatened penalties and lack <br />
of recognition of recurring costs to Level <br />
1 assessments. A commenter also <br />
recommended reversing the phased <br />
approach to require Level 3 <br />
requirements be implemented first.
 
''DoD Response: ''Some comments
 
pertain to the 48 CFR part 204 CMMC <br />
Acquisition rule, including applicability <br />
of the CMMC clause to COTS <br />
procurements and those below the <br />
micro-purchase threshold. Such <br />
comments are not within the scope of <br />
this 32 CFR part 170 CMMC Program <br />
rule, which outlines program <br />
requirements rather than contracting <br />
procedures.
 
This rule has no disproportionate
 
impact on Native American owned <br />
businesses. Once identified as a <br />
requirement, the CMMC Program <br />
requirements will apply uniformly to all <br />
prospective contractors.
 
DoD must enforce safeguarding
 
requirements uniformly across the DIB <br />
for all contractors and subcontractors <br />
who process, store, or transmit CUI. The <br />
value of information and impact of its <br />
loss does not diminish when the <br />
information moves to DoD contractors <br />
and DoD subcontractors, regardless of <br />
their status as Native American or small <br />
disadvantaged businesses.
 
The purpose of the CMMC Program is
 
to ensure that DoD contracts that require <br />
contractors to safeguard FCI and CUI <br />
(''i.e., ''contracts that include FAR clause <br />
52.204–21 and DFARS clause 252.204– <br />
7012) will be awarded to contractors <br />
with the ability to protect that <br />
information appropriately. Accordingly, <br />
all contractor owned information <br />
systems that process, store, or transmit <br />
FCI or CUI in the performance of a <br />
contract are subject to the requirements <br />
of FAR clause 52.204–21 and NIST SP <br />
800–171 as implemented by DFARS <br />
clause 252.204–7012.
 
The CMMC Program rule does not
 
include ‘‘threatened penalties.’’ If a <br />
requirement of a DoD contract is not <br />
met, then standard contractual remedies <br />
applicable to that contract may apply.
 
The phased implementation plan
 
described in § 170.3(e) is intended to
 
address ramp-up issues, provide time to <br />
train the necessary number of assessors, <br />
and allow companies the time needed to <br />
understand and implement CMMC <br />
requirements.
 
The self-assessment requirements
 
build on the existing DFARS clause <br />
252.204–7020 requirement as part of <br />
basic safeguarding of CUI. CMMC Level <br />
3 requires advanced implementation, <br />
and the phase-in period provides <br />
additional time for an OSC to achieve <br />
the higher standard.
 
11. ''Flow down. ''Commenters
 
expressed concern that the CMMC rule <br />
language was not clear enough regarding <br />
when self-assessments are allowed. One <br />
commenter believed requiring prime <br />
contractors to validate the compliance <br />
of those they transmit CUI to was too <br />
onerous and that the rule language was <br />
not clear on how to determine what <br />
level of CUI is being passed.
 
''DoD Response: ''DoD policies guide
 
Program Managers to appropriately <br />
apply CMMC Status requirements in <br />
DoD solicitations and resulting <br />
contracts, to include when Level 2 self- <br />
assessment rather than Level 2 <br />
certification assessment is appropriate.
 
The commenter misinterprets the text
 
of § 170.23, which states: ''If ''a <br />
subcontractor will process, store, or <br />
transmit CUI in performance of the <br />
subcontract ''and ''the associated prime <br />
contractor has a requirement for a <br />
CMMC Status of Level 2 (C3PAO), ''then <br />
the ''CMMC Status of Level 2 (C3PAO) is <br />
the minimum requirement for the <br />
subcontractor.
 
CMMC flow down requirements are
 
designed to apply consistent assessment <br />
requirements to all contractors, whether <br />
prime or subcontractor and regardless of <br />
company size, who are required to <br />
adequately safeguard CUI. The DoD <br />
cannot dictate DIB business practices <br />
and encourages prime contractors to <br />
carefully consider the necessity of <br />
sharing CUI information and to work <br />
with its subcontractors to flow down <br />
CUI with the required security and the <br />
least burden.
 
Defense contractors may share
 
information about their CMMC Status <br />
with other DIB members to facilitate <br />
effective teaming arrangements when <br />
competing for DoD contract <br />
opportunities.
 
In addition, CMMC requirements
 
apply for prime contractors and their <br />
subcontractors as outlined in § 170.23. <br />
For additional information about flow <br />
down of contractual requirements, see <br />
the 48 CFR part 204 CMMC Acquisition <br />
rule, RIN 0750–AK81, Assessing <br />
Contractor Implementation of <br />
Cybersecurity Requirements (DFARS <br />
Case 2019–D041).
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00111
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83202 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
12. ''International. ''Commenters
 
expressed concern about international <br />
partners’ use of cloud services that do <br />
not have FedRAMP or GovCloud <br />
equivalency. Also concerns that the <br />
draft language [in the proposed rule] did <br />
not explain reciprocity of cybersecurity <br />
standards between the U.S. and <br />
International Partners. One commenter <br />
recommended exempting foreign <br />
businesses from assessment <br />
requirements.
 
''DoD Response: ''A domestic or
 
international business seeking a contract <br />
that includes DFARS clause 252.204– <br />
7012, and using a cloud service provider <br />
to process, store, or transmit covered <br />
defense information in performance of <br />
that DoD contract, must meet FedRAMP <br />
authorization or equivalency <br />
requirements. As the FedRAMP program <br />
and FedRAMP equivalency are available <br />
to international organizations, foreign <br />
partners do not need to develop their <br />
own FedRAMP program.
 
The DoD leverages FedRAMP to
 
provide the requirements for the <br />
adoption of secure cloud services across <br />
the Federal Government by providing a <br />
standardized approach to security and <br />
risk assessment for cloud technologies <br />
and Federal agencies.
 
The Implementation of CMMC
 
Program requirements described in <br />
§ 170.3(e) of the rule does not promote <br />
assessments of any contractors over any <br />
other contractors. All companies, <br />
regardless of size, location, or <br />
nationality, will have access to <br />
authorized C3PAOs for certification <br />
assessments. The rule does not preclude <br />
non-U.S. citizens or foreign-owned <br />
C3PAOs from operating in the U.S. <br />
Additionally, U.S.-owned C3PAOs may <br />
operate in a foreign nation.
 
Section 170.20 states that OSCs that
 
have completed a DCMA DIBCAC High <br />
Assessment aligned with CMMC Level 2 <br />
Scoping will be given the CMMC Status <br />
of Final Level 2 (C3PAO). International <br />
standards acceptance is not addressed <br />
in this rule.
 
Any consideration of reciprocity
 
between foreign partner protected <br />
information and CUI and FCI would <br />
require a formal government to <br />
government international arrangement <br />
or agreement and is outside the scope of <br />
this 32 CFR part 170 CMMC Program <br />
rule.
 
Any discussion of exemptions for
 
foreign businesses are outside the scope <br />
of the 32 CFR part 170 CMMC Program <br />
rule and may be addressed through <br />
government-to-government international <br />
arrangements or agreements.
 
The ''Discussion of Public Comments ''
 
''and Resulting Changes ''section in the <br />
preamble of the final rule addresses all
 
public comments received during the <br />
mandatory 60-day public comment <br />
period for the proposed rule and <br />
supporting documents.
 
Response to Comments From Chief <br />
Counsel for Advocacy of the SBA
 
On December 26, 2023, the
 
Department of Defense (DoD) published <br />
a proposed rule entitled Cybersecurity <br />
Maturity Model Certification (CMMC) <br />
Program, 88 CFR 89058. This proposed <br />
rule intends to create a mechanism by <br />
which the DoD can certify that <br />
contractors and subcontractors are in <br />
compliance with the stated <br />
cybersecurity guidelines. The SBA <br />
Office of Advocacy (SBA or Advocacy) <br />
submitted the following comments and <br />
concerns on the proposed rule in a letter <br />
addressed to the DoD CIO within the <br />
public comment period for the proposed <br />
32 CFR part 170 CMMC Program rule.
 
‘‘Advocacy is principally concerned
 
with the ability for small businesses to <br />
meet and comply with the standards <br />
and timelines set out in the CMMC <br />
Program without further clarification <br />
and guidance documents from the DoD. <br />
The current rule does not provide clear <br />
guidance on the process to create <br />
enclaves, which would allow more <br />
small business subcontractors to <br />
participate in DoD contracts without <br />
meeting the full requirements necessary <br />
for the prime contractor. Advocacy <br />
seeks clarification on the role of Third- <br />
Party Assessment Organizations <br />
(C3PAO) and the indemnification a <br />
C3PAO has if a contractor or <br />
subcontractor is out of compliance.’’
 
‘‘Advocacy concerns also include the
 
process of how and if more C3PAOs can <br />
be certified by the DoD to review the <br />
numerous contracts that will be subject <br />
to certifications. Advocacy urges the <br />
DoD to provide clarification about the <br />
enforcement mechanisms for breaches <br />
of cybersecurity.’’
 
‘‘Lastly, Advocacy reminds the DoD
 
that this rule will impose a high cost of <br />
compliance on small businesses and any <br />
means to reduce the burden on small <br />
businesses will increase the <br />
participation of these impacted <br />
businesses.’’
 
‘‘The proposed rule would give
 
contractual effect to NIST SP 800–171 <br />
and 172, requiring companies to meet <br />
the three levels of compliance if the <br />
contracts involve FCI or CUI. CMMC <br />
attempts to redesign previous iterations <br />
of cybersecurity models with a more <br />
streamlined process. This proposal <br />
would simplify previous systems to <br />
create a more streamlined certification <br />
system. This rule differs from previous <br />
iterations by allowing for businesses to <br />
create enclaves within their business
 
models, allowing the business to <br />
implement the CMMC standards while <br />
not drastically changing every aspect of <br />
their business process.’’
 
‘‘''SBA Comment 1: ''Under the
 
proposed rule, the CMMC Program will <br />
require all DoD contractors and <br />
subcontractors who handle Federal <br />
contract information (FCI) and <br />
Controlled Unclassified Information <br />
(CUI) to maintain cybersecurity <br />
protections of their systems. CMMC will <br />
create three levels of compliance, <br />
depending on the level of security <br />
necessary for which the contractor has <br />
access. Level 1 has 15 requirements <br />
focused on logging access to potential <br />
FCI. Level 2 includes minimum <br />
requirements for contractors handling <br />
CUI and adds 110 requirements. Level 3 <br />
addresses an additional 24 <br />
requirements. Each level will pose <br />
varying challenges for small businesses <br />
of every kind to comply with the <br />
progressing requirements. Advocacy has <br />
commented on previous proposals for <br />
CMMC concerning the significant <br />
impact this will have on small business <br />
contractors.’’
 
‘‘Advocacy held outreach meetings
 
with diverse small business <br />
stakeholders concerning this rule, both <br />
in-person and virtually.—Small <br />
businesses expressed concerns with <br />
how to compensate the increased costs <br />
due to implementing CMMC and asked <br />
for clarity on aspects of the proposed <br />
CMMC rule. Advocacy has four chief <br />
concerns with the proposed rule.’’
 
‘‘Advocacy requests clear and concise
 
guidance for small business contractors <br />
and subcontractors to create enclaves in <br />
order to lessen the burden of <br />
compliance on the businesses.’’
 
‘‘The proposed rule states that
 
different business segments or different <br />
enclaves of a business can be assessed <br />
or certified at different CMMC levels. <br />
Creating and implementing enclaves <br />
will be most effective when a large <br />
prime contractor creates these enclaves <br />
to ease the burden on small <br />
subcontractors. The rule mentions the <br />
use of enclaves but does not provide <br />
guidance on how to implement enclaves <br />
within a business.’’
 
''DoD Response: ''The Department
 
acknowledges the concerns articulated <br />
by the Small Business Administration <br />
(SBA) and commits to enhancing <br />
training provisions after the rule is final <br />
and effective. Moreover, the Department <br />
pledges to reinstate outreach endeavors <br />
targeting the broader industry and <br />
specifically small businesses to facilitate <br />
familiarity with CMMC requirements <br />
once the rule is final and effective. <br />
However, the Department does not <br />
intend to formulate specific directives
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00112
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83203 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
pertaining to the configuration and <br />
segregation of corporate information <br />
systems into enclaves. Such <br />
determinations must be tailored to <br />
individual companies, considering a <br />
multitude of unique factors.
 
External service providers (ESPs) will
 
be a driving force for small businesses’ <br />
compliance with CMMC requirements. <br />
ESPs are vendors that handle security <br />
related data or CUI on their own assets <br />
and software. The ability of ESPs to <br />
create effective and economically <br />
feasible services will allow businesses <br />
to enclave different operations more <br />
easily and avoid unduly costly <br />
compliance expenses.
 
‘‘''SBA Comment 2: ''Advocacy
 
recommends that the DoD create a <br />
presumption to reduce the number of <br />
small contracts that are subject to <br />
CMMC Level 2. This can be achieved <br />
through varying means, including a <br />
positive requirement for prime <br />
contractors or the ability for a prime <br />
contractor to engage in using enclaves as <br />
a positive value marker for their <br />
contracts. Further, the agency <br />
contracting officer could be required to <br />
engage in mitigating efforts if such <br />
CMMC related issues arise between a <br />
subcontractor and prime contractor.’’
 
''DoD Response: ''The Department is
 
committed to robustly supervising the <br />
CMMC Program and will take <br />
appropriate measures to ensure its <br />
efficient execution. Presently, the <br />
Department has no intention to mandate <br />
contracting offices adopt presumptive <br />
measures that would diminish the <br />
number of small contracts subject to <br />
CMMC Level 2 assessment, nor does it <br />
plan to impose affirmative requirements <br />
on prime contracts to utilize enclaves.
 
‘‘''SBA Comment 3: ''Advocacy seeks
 
clarity on the role of C3PAOs and the <br />
ability of C3PAOs to meet the demand <br />
for CMMC.
 
‘‘For CMMC Level 2 compliance, a
 
CMMC third-party assessor (C3PAO) <br />
will triennially inspect the businesses’ <br />
compliance with the 110 requirements <br />
of CMMC Level 2. Stakeholders raised <br />
concerns regarding the role C3PAOs <br />
will play in Level 2 certification and <br />
sought clarity on the indemnification of <br />
issues arising from a certification. <br />
Stakeholders raised concerns that if <br />
there are an insufficient number of <br />
C3PAOs to timely inspect every <br />
contractor before the rule is effective, <br />
then small businesses will be the last <br />
ones to be certified. Advocacy <br />
recommends creating a streamlined <br />
process to provide organizations with <br />
C3PAO certifications. This process <br />
would meet the immediate need of <br />
contractors to initially certify with a <br />
C3PAO that the business meets CMMC
 
Level 2 requirements. Particularly, there <br />
should be availability of C3PAOs for <br />
small businesses and ensure small <br />
business owners are not falling behind.’’
 
''DoD Response: ''In alignment with its
 
standard practice across all programs, <br />
the Department is committed to diligent <br />
oversight of the CMMC Program and <br />
will enact appropriate measures to <br />
ensure its successful execution. The <br />
phased implementation strategy <br />
outlined in § 170.3(e) in the rule is <br />
designed to tackle initial challenges, <br />
facilitate assessor training, and afford <br />
companies sufficient time to <br />
comprehend and integrate CMMC <br />
prerequisites.
 
While the Department remains open
 
to considering future adjustments, <br />
including potential extensions to the <br />
implementation timeline or alternative <br />
solutions to address any capacity <br />
constraints faced by C3PAOs, no such <br />
initiatives are currently under active <br />
consideration.
 
‘‘''SBA Comment 4: ''Advocacy asks the
 
DoD to clarify enforcement guidelines/ <br />
mechanisms.
 
As proposed, Level 1 contractors
 
would annually attest their compliance <br />
with the requirements. While at Level 2, <br />
there would be attestations with C3PAO <br />
certifications every three years. <br />
Stakeholders raised questions about the <br />
practical steps the DoD will take in <br />
enforcement actions for breaches. <br />
Further, stakeholders raised concerns <br />
regarding the availability of remediating <br />
steps in the instance of failure to meet <br />
a CMMC requirement. Advocacy <br />
recommends the agency create guidance <br />
documents for small business <br />
contractors to better understand the <br />
legal effects of the CMMC.’’
 
''DoD Response: ''Regarding
 
enforcement, as the CMMC is slated for <br />
implementation as a precondition for <br />
contract award consideration, non- <br />
compliance with CMMC requirements <br />
will result in disqualification from <br />
contract award; or post-award, could <br />
result in standard contractual and other <br />
remedies for failure to timely and <br />
satisfactorily address outstanding <br />
POA&amp;Ms to fully implement CMMC <br />
requirements and meet contractual <br />
obligations.
 
‘‘''SBA Comment 5: ''Advocacy
 
highlights the need for DoD to create <br />
rules that encourage and improve small <br />
business participation in contracting <br />
programs. Advocacy reiterates the <br />
importance of small businesses in <br />
Federal contracting. [Excerpt from <br />
footnote 21: ‘‘Small businesses make up <br />
99.9 percent of all U.S. businesses as <br />
well as 73 percent of companies in the <br />
defense industrial base, and last year <br />
small businesses were awarded over 25
 
percent of all DoD prime contracts. As <br />
the economic engine of our nation, <br />
small businesses create jobs, generate <br />
innovation, and are essential, daily <br />
contributors to national security and the <br />
defense mission.] Creating accessible, <br />
commercially viable, and secure cyber <br />
systems is critical for the future of <br />
national security. Small businesses wish <br />
to continue to be a powerful driver of <br />
national defense contracting. Advocacy <br />
heard small business stakeholders from <br />
across the country express their strong <br />
commitment to protecting our country <br />
from cyber-attacks and recognize the <br />
critical need for CMMC and other <br />
cybersecurity measures.
 
‘‘Small businesses urge DoD to create
 
flexibilities such as using Plan of Action <br />
and Milestones (POA&amp;Ms) when this <br />
rule goes into effect initially, allowing <br />
small businesses to ramp up to full <br />
compliance with their respective CMMC <br />
level.’’
 
''DoD Response: ''Department
 
acknowledges the concerns voiced by <br />
the SBA regarding the participation of <br />
small businesses in contracting <br />
programs and the importance of <br />
fostering their involvement in Federal <br />
contracting, particularly within the <br />
defense industrial base. Recognizing the <br />
significant role small businesses play in <br />
national security and defense missions, <br />
the Department is committed to <br />
diligently addressing these concerns.
 
While the Department values the
 
input provided by small business <br />
stakeholders and understands the desire <br />
for flexibilities, including the use of <br />
POA&amp;Ms during the initial <br />
implementation phase, it must carefully <br />
balance multiple factors to ensure the <br />
effectiveness and integrity of the CMMC <br />
Program.
 
‘‘''SBA Comment 6: ''Advocacy’s chief
 
concerns surround a lack of clarity on <br />
key aspects of the proposed rule. <br />
Advocacy requests clarification from <br />
DoD as to how to create enclaves within <br />
businesses. Encouraging the use of ESPs <br />
and incentivizing large prime <br />
contractors to keep all subcontractors <br />
from being subject to high levels of <br />
cybersecurity will be key in keeping <br />
small businesses engaged in DoD <br />
contracting. Guidance documents for <br />
small businesses (especially aimed at <br />
the smallest of small businesses) and <br />
ESPs will create an easier ramp for <br />
small business compliance. Advocacy <br />
requests clarity from DoD regarding the <br />
role of C3PAOs and encourages the DoD <br />
to ensure small businesses can obtain <br />
certification from C3PAOs in a timely <br />
manner. Further, the DoD should clarify <br />
the enforcement and procedural <br />
repercussions for a failure to meet <br />
various CMMC levels. Lastly, the DoD
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00113
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83204 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
62
 
DoD estimates of the hours, recurring and non-
 
recurring costs, and labor rates are based upon <br />
subject matter expertise from the DOD Chief <br />
Information Office, CMMC Program Office, and <br />
DoD/DIBCAC.
 
should set achievable goals as CMMC is <br />
implemented, ensuring that current <br />
small businesses contracting with the <br />
agency can continue work with the <br />
government while ensuring our nation’s <br />
defense.’’
 
''DoD Response: ''The DoD
 
acknowledges the SBA advocacy chief’s <br />
concerns and will make additional <br />
training resources available following <br />
finalization of this rule. The DoD deems <br />
that the level of detail on the topics <br />
identified is appropriate for codification <br />
in the 32 CFR part 170 CMMC Program <br />
rule. The DoD will resume outreach <br />
efforts with the aim of promoting <br />
CMMC familiarization among small <br />
businesses once the rule is final and <br />
effective and any constraints on such <br />
engagements no longer apply. However, <br />
DoD caveats that providing any specific <br />
instructions for configuring corporate <br />
information systems into enclaves is <br />
beyond the guidance that DoD intends <br />
to provide, as such decisions are unique <br />
to each company.
 
The role of C3PAOs is thoroughly
 
described in § 170.9 CMMC Third-Party <br />
Assessment Organizations (C3PAOs) <br />
and in the supplemental documents.
 
In terms of enforcement, since CMMC
 
will be implemented as a pre-award <br />
requirement, the repercussions of failure <br />
to meet CMMC requirements will <br />
include failure to be selected for <br />
contract award, or standard contractual <br />
and other remedies for failure to timely <br />
and satisfactorily close-out a POA&amp;M <br />
and meet or maintain the contractual <br />
CMMC requirements.
 
As with all of DoD programs, the
 
Department intends to effectively <br />
oversee the CMMC Program and take the <br />
appropriate actions needed to manage <br />
its effective implementation. The <br />
phased implementation plan described <br />
in § 170.3(e) was extended by six <br />
months and is intended to address <br />
ramp-up issues, provide time to train <br />
the necessary number of assessors, and <br />
allow companies the time needed to <br />
understand and implement CMMC <br />
requirements.
 
Small Business Entities Impacted
 
This rule will impact small businesses
 
that do business with the Department of <br />
Defense, except those competing on <br />
contracts or orders that are exclusively <br />
for COTS items or when receiving <br />
contracts or orders valued at or below <br />
the micro-purchase threshold. <br />
According to the Federal Procurement <br />
Data System (FPDS) there is an average <br />
of ''29,260 unique small business <br />
contractors: FY 2019 (31,189), FY 2020 <br />
(29,166) and FY 2021 (27,427). ''
 
Cost Assumptions and Analysis for <br />
CMMC
 
Complete details on CMMC
 
requirements and associated costs, <br />
savings, and benefits of this rule are <br />
provided in the Regulatory Impact <br />
Analysis referenced in the preamble. <br />
Key Components of the model are <br />
described in §§ 170.14 through 170.24.
 
(a) Assumptions for the updated CMMC <br />
Program Cost Analysis
 
In estimating the public cost for a
 
small DIB company to achieve CMMC <br />
compliance or certification at each <br />
CMMC level, DoD considered non- <br />
recurring engineering costs, recurring <br />
engineering costs, assessment costs, and <br />
affirmation costs for each CMMC <br />
Level.62 These costs include labor and <br />
consulting.
 
Estimates include size and complexity
 
assumptions to account for <br />
organizational differences and how it <br />
handles Information Technology (IT) <br />
and cybersecurity:
 
• small entities have a less complex,
 
less expansive operating environment <br />
and Information Technology (IT)/ <br />
Cybersecurity infrastructure compared <br />
to larger DIB companies.
 
• small entities outsource IT and
 
cybersecurity to an External Service <br />
Provider (ESP) entities (large or small) <br />
pursuing CMMC Level 2 self-assessment <br />
will seek consulting or
 
• implementation assistance from an <br />
ESP to either help them prepare for the <br />
assessment technically or participate in <br />
the assessment with the C3PAOs.
 
Estimates do not include
 
implementation (Non-recurring <br />
Engineering Costs (NRE)) or <br />
maintenance costs (Recurring <br />
Engineering (RE)) for requirements <br />
prescribed in current regulations.
 
For CMMC Levels 1 and 2, cost
 
estimates are based upon assessment, <br />
reporting and affirmation activities <br />
which a contractor will take to validate <br />
conformance with existing cybersecurity <br />
requirements from the FAR clause <br />
52.204–21 (effective June 15, 2016) to <br />
protect FCI, and the DFARS clause <br />
252.204–7012 which required contractor <br />
implementation of NIST SP 800–171 not <br />
later than December 31, 2017, to protect <br />
CUI. As such, costs estimates are not <br />
included for an entity to implement <br />
security requirements, maintain existing <br />
security requirements, or remediate a <br />
Plan of Action for unimplemented <br />
requirements.
 
For CMMC Level 3, the estimates
 
factor in the assessment, reporting and <br />
affirmation activities in addition to <br />
estimates for NRE and RE to implement <br />
and maintain CMMC Level 3 <br />
requirements. CMMC Level 3 <br />
requirements are a subset of NIST SP <br />
800–172 Feb2021 Enhanced Security <br />
Requirements as described in § 170.30 <br />
of the CMMC rule and are not currently <br />
required through other regulations. <br />
CMMC Level 3 is expected to apply only <br />
to a small subset of DIB contractors.
 
The Cost Categories used for each
 
CMMC Level are described below:
 
''1. Nonrecurring Engineering Costs: ''
 
Estimates consist of hardware, software, <br />
and the associated labor to implement <br />
the same. Costs associated with <br />
implementing the requirements defined <br />
in FAR clause 52.204–21 and NIST SP <br />
800–171 R2 are assumed to have been <br />
implemented and are therefore not <br />
accounted for in this cost estimate. As <br />
such, these costs only appear in CMMC <br />
Level 3. Where nonrecurring <br />
engineering costs are referenced, they <br />
are only accounted for as a one-time <br />
occurrence and are reflected in the year <br />
of the initial assessment.
 
''2. Recurring Engineering Costs: ''
 
Estimates consist of annually recurring <br />
fees and associated labor for technology <br />
refresh. Costs associated with <br />
implementing the requirements defined <br />
in FAR clause 52.204–21 and NIST SP <br />
800–171 R2 are assumed to have been <br />
implemented and are therefore not <br />
accounted for in this cost estimate. As <br />
such, these costs only appear in CMMC <br />
Level 3.
 
''Assessment Costs: ''Estimates consist
 
of activities for pre-assessment <br />
preparations (which includes gathering <br />
and/or developing evidence that the <br />
assessment objectives for each <br />
requirement have been satisfied), <br />
conducting and/or participating in the <br />
actual assessment, and completion of <br />
any post-assessment work. Assessment <br />
costs are represented by notional <br />
phases. Assessment costs assume the <br />
offeror/contractor passes the assessment <br />
on the first attempt (conditional—with <br />
an allowable POA&amp;M or final). Each <br />
phase includes an estimate of hours to <br />
conduct the assessment activities <br />
including:
 
(a) Labor hour estimates for a
 
company (and any ESP support) to <br />
prepare for and participate in the <br />
assessment.
 
(b) C3PAO cost estimates for
 
companies pursuing a certification. <br />
—Labor hour estimates for certified
 
assessors to work with the small <br />
business to conduct the actual <br />
assessment.
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00114
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83205 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
63
 
Again, it is assumed that that DIB contractors
 
and subcontractors have already implemented the <br />
15 basic safeguarding requirements in FAR clause <br />
52.204–21.
 
64
 
An external service provider is assumed to be
 
an ‘‘Information Assurance Specialist Level 7’’ with <br />
an hourly rate of $260.
 
65
 
A person needs to enter the information into
 
SPRS, which should only take five minutes.
 
(c) Assessment Costs broken down
 
into phases. <br />
—Phase 1: ''Planning and preparing for ''
 
''the assessment. ''
 
—Phase 2: ''Conducting the assessment ''
 
(self or C3PAO).
 
—Phase 3: ''Reporting of Assessment ''
 
''Results. ''
 
—Phase 4: ''POA&amp;M Closeout ''(for CMMC
 
Level 3 only, where allowed, if <br />
applicable). <br />
• CMMC allows a limited open Plan
 
of Action and Milestones (POA&amp;M) for <br />
a period of 180 days to remediate the <br />
POA&amp;M, see § 170.37.
 
''3. Affirmations: ''Estimates consist of
 
costs for a contractor to submit to SPRS <br />
an initial and affirmation of compliance <br />
that the covered contractor information <br />
system is compliant with and will <br />
maintain compliance with the <br />
requirements of the applicable CMMC <br />
Level. Where POA&amp;Ms are allowed, an <br />
affirmation must be submitted with the <br />
POA&amp;M closeout. Except for Small <br />
Entities for Level 1 and Level 2, it is <br />
assumed the task requires the same <br />
labor categories and estimated hours as <br />
the final reporting phase of the <br />
assessment.
 
(b) Comparison to the Initial CMMC <br />
Program Cost Analysis
 
Public comments on the initial CMMC
 
Program indicated that cost estimates <br />
were too low. Updated CMMC Program <br />
cost estimates account for that feedback <br />
with the following improvements:
 
• Allowance for outsourced IT
 
services.
 
• Increased total time for the
 
contractor to prepare for the assessment,
 
including limited time for learning the <br />
reporting and affirmation processes.
 
• Allowance for use of consulting
 
firms to assist with the assessment <br />
process.
 
• Time for a senior level manager to
 
review the assessment and affirmation <br />
before submitting the results into SPRS.
 
• Updated government and contractor
 
labor rates that include applicable <br />
burden costs.
 
As a result, some cost estimates for
 
the updated CMMC Program may be <br />
higher than those included in the initial <br />
CMMC Program.
 
(c) Cost Analysis/Estimates by CMMC <br />
Level
 
CMMC Level 1 Self-Assessment and <br />
Affirmation Costs for Small Business <br />
Entities
 
• ''Nonrecurring and recurring ''
 
''engineering costs: ''There are no <br />
nonrecurring or recurring engineering <br />
costs associated with CMMC Level 1 <br />
since it is assumed the contractor has <br />
implemented basic safeguarding <br />
requirements.63
 
• ''Self-Assessment Costs and Initial ''
 
''Affirmation Costs: ''It is estimated that <br />
the cost to support a CMMC Level 1 <br />
assessment and affirmation is * $5,977 <br />
(as summarized in table 1). A Level <br />
1self-assessment is conducted annually, <br />
and is based on the assumptions <br />
detailed below: <br />
—''Phase 1: Planning and preparing for ''
 
''the assessment: ''$1,803
 
• A director (MGMT5) for 4 hours
 
($190.52/hr
 
× 4hrs = $762)
 
• An external service provider
 
(ESP) 64 for 4 hours ($260.28
 
× 4hrs
 
= $1,041)
 
—''Phase 2: Conducting the self- ''
 
''assessment: ''$2,705
 
• A director (MGMT5) for 6 hours
 
($190.52/hr
 
× 6hrs = $1,143)
 
• An external service provider (ESP)
 
for 6 hours ($260.28
 
× 6hrs =
 
$1,562)
 
—''Phase 3: Reporting of Assessment ''
 
''Results into SPRS: ''$909
 
• A director (MGMT5) for 2 hours
 
($190.52/hr
 
× 2hrs = $381)
 
• An external service provider (ESP)
 
for 2 hours ($260.28/hr * 2hrs = <br />
$521)
 
• A staff IT specialist (IT4) for 0.08
 
hours 65 ($86.24/hr
 
× 0.08hrs = $7)
 
—''Affirmation: ''initial affirmation post
 
assessment: $560
 
• ''Reaffirmations: ''It is estimated that
 
the costs to reaffirm a CMMC Level I <br />
annually for a small entity is $560 <br />
—A director (MGMT5) for 2 hours
 
($190.52/hr
 
× 2hrs = $381)
 
—A staff IT specialist (IT4) for 2.08
 
hours ($86.24/hr
 
× 2.08hrs = $179)
 
• ''Summary: ''The following is the
 
annual small entities total cost summary <br />
for CMMC Level 1 self-assessments and <br />
affirmations over a ten-year period: <br />
(Example calculation, Year 1: *$5,977 <br />
per entity (detailed above)
 
× 699 entities
 
(cumulative) = $4,177,845)
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00115
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83206 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
CMMC Level 2 Self-Assessment and <br />
Affirmation Costs for Small Business <br />
Entities
 
The costs below account for a CMMC
 
Level 2 self-assessment of the applicable <br />
contractor information system(s) with <br />
NIST SP 800–171 R2 requirements <br />
based on assumptions defined above.
 
• ''Nonrecurring and recurring ''
 
''engineering costs: ''There are no <br />
nonrecurring or recurring engineering <br />
costs associated with CMMC Level 2 <br />
self-assessment since it is assumed the <br />
contractor has implemented NIST SP <br />
800–171 R2 requirements.
 
• ''Assessment Costs and Initial ''
 
''Affirmation Costs: ''It is estimated that <br />
the cost to support a CMMC Level 2 self- <br />
assessment and affirmation for a small <br />
entity is *$34,277. The three-year cost is <br />
$37,196 (as summarized in 4.1.2 above, <br />
table 2), which includes the triennial <br />
assessment + affirmation, plus two
 
additional annual affirmations ($34,277 <br />
+ $1,459 + $1,459). <br />
—''Phase 1: Planning and preparing for ''
 
''the self-assessment: ''$14,426
 
• A director (MGMT5) for 32 hours
 
($190.52/hr
 
×* 32hrs = $6,097)
 
• An external service provider (ESP)
 
for 32 hours ($260.28/hr
 
× 32hrs =
 
$8,329)
 
—''Phase 2: Conducting the self- ''
 
''assessment: ''$15,542
 
• A director (MGMT5) for 16 hours
 
($190.52/hr
 
× 16hrs = $3,048)
 
• An external service provider (ESP)
 
for 48 hours ($260.28/hr
 
× 48hrs =
 
$12,493)
 
—''Phase 3: Reporting of assessment ''
 
''results: ''$2,851
 
• A director (MGMT5) for 4 hours
 
($190.52/hr
 
× 4hrs = $762)
 
• An external service provider (ESP)
 
for 8 hours ($260.28/hr
 
× 8hrs =
 
$2,082)
 
• A staff IT specialist (IT4) for 0.08
 
hours ($86.24/hr
 
× 0.08hrs = $7)
 
—''Affirmation''—initial affirmation post
 
assessment: $1,459
 
• ''Reaffirmations: ''It is estimated that
 
the costs to reaffirm a CMMC Level 2 <br />
self-assessment annually is $1,459 <br />
(three-year costs to reaffirm a CMMC <br />
Level 2 self-assessment annually is <br />
$4,377, or $1,459
 
× 3):
 
—A director (MGMT5) for 4 hours
 
($190.52/hr
 
× 4hrs = $762)
 
—A staff IT specialist (IT4) for 8.08
 
hours ($86.24/hr
 
× 8.08hrs = $697)
 
• ''Summary: ''The following is the
 
annual small entities total cost summary <br />
for CMMC Level 2 self-assessments and <br />
Affirmations over a ten-year period: <br />
(Example calculation, Year 2: (*$34,277 <br />
self-assessment per entity
 
× 101 entities)
 
+ ($1,459 annual affirmation per entity
 
× 20 entities) = $3,491,193)
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00116
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.028&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83207 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
CMMC Level 2 Certification and <br />
Affirmation Costs for Small Business <br />
Entities
 
The costs below account for a CMMC
 
Level 2 Certification assessment and <br />
affirmation costs of the applicable <br />
contractor information system(s) with <br />
NIST SP 800–171 R2 requirements <br />
based on assumptions defined above. <br />
CMMC Level 2 certification assessments <br />
require hiring a C3PAO to perform the <br />
assessment.
 
• ''Nonrecurring or recurring ''
 
''engineering costs: ''There are no <br />
nonrecurring or recurring engineering <br />
costs associated with CMMC Level 2 <br />
C3PAO Certification since it is assumed <br />
the contractor has implemented NIST <br />
SP 800–171 R2 requirements.
 
• ''Assessment Costs and Initial ''
 
''Affirmation Costs: ''It is estimated that <br />
the cost to support a CMMC Level 2 <br />
C3PAO Certification and affirmation for <br />
a small entity is *$101,752. The three- <br />
year cost is $104,670 (as summarized in
 
section 3(b) above, table 1), and <br />
includes the triennial assessment + <br />
affirmation plus two additional annual <br />
affirmations ($101,752 + $1,459 + <br />
$1,459). <br />
—''Phase 1: Planning and preparing for ''
 
''the assessment: ''$20,699
 
• A director (MGMT5) for 54 hours
 
($190.52/hr
 
× 54hrs = $10,288)
 
• An external service provider (ESP)
 
for 40 hours ($260.28/hr
 
× 40hrs =
 
$10,411)
 
—''Phase 2: Conducting the C3PAO ''
 
''assessment: ''$45,509
 
• A director (MGMT5) for 64 hours
 
($190.52/hr x 64hrs = $12,193)
 
• An external service provider (ESP)
 
for 128 hours ($260.28/hr
 
× 128hrs =
 
$33,316) <br />
—''Phase 3: Reporting of C3PAO ''
 
''Assessment Results: ''$2,851
 
• A director (MGMT5) for 4 hours
 
($190.52/hr
 
× 4hrs = $762)
 
• An external service provider (ESP)
 
for 8 hours ($260.28/hr
 
× 8hrs =
 
$2,082)
 
• A staff IT specialist (IT4) for 0.08
 
hours ($86.24/hr
 
× 0.08hrs = $7)
 
—''Affirmation''—initial affirmation post
 
assessment: $1,459
 
—''C3PAO Costs: ''C3PAO engagement
 
inclusive of Phases 1, 2, and 3 (3- <br />
person team) for 120 hours <br />
($260.28/hr
 
× 120hrs = $31,234)
 
• ''Reaffirmations: ''It is estimated that
 
the costs to reaffirm a CMMC Level 2 <br />
C3PAO Assessment annually is $1,459 <br />
(three-year cost is $4,377, or $1,459
 
× 3)
 
—A director (MGMT5) for 4 hours
 
($190.52/hr
 
× 4hrs = $762)
 
—A staff IT specialist (IT4) for 8.08
 
hours ($86.24/hr
 
× 8.08hrs = $697)
 
• ''Summary: ''The following is the
 
annual small entities total cost summary <br />
for CMMC Level 2 Certifications and <br />
Affirmations over a ten-year period: <br />
(Example calculation, Year 2: <br />
(*$101,752 assessment per entity
 
×
 
1,926 entities) + ($1,459 annual <br />
affirmation per entity
 
× 382 entities) =
 
$196,531,451)
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00117
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.029&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83208 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
CMMC Level 3 Certification and <br />
Affirmation Costs for Small Business <br />
Entities
 
Contractors pursuing CMMC Level 3
 
certification assessment must have a <br />
current Final CMMC Level 2 <br />
certification assessment, and <br />
demonstrate compliance with CMMC <br />
Level 3, which is a subset of security <br />
requirements from NIST SP 800–172 <br />
Feb2021 that have DoD predefined <br />
selections and parameters. CMMC Level <br />
3 requires compliance with security <br />
requirements not required in prior rules. <br />
Therefore, Nonrecurring Engineering <br />
and Recurring Engineering cost <br />
estimates have been included for the <br />
initial implementation and maintenance <br />
of the required subset of NIST 800–172 <br />
Feb2021 requirements. The cost <br />
estimates below accounts for time for a <br />
contractor to implement the security <br />
requirements and prepare for, support, <br />
and participate in a CMMC Level 3 <br />
assessment conducted by DCMA <br />
DIBCAC. The contractor should <br />
therefore keep in mind that the cost of <br />
a Level 3 certification will also incur the <br />
cost of a CMMC Level 2 certification <br />
assessment by a C3PAO in addition to <br />
the costs to assess the requirements <br />
specific to Level 3. Inclusion of CMMC <br />
Level 3 certification is expected to affect
 
only a small subset of defense <br />
contractors or subcontractors in the DIB.
 
The estimated engineering costs per
 
small entity is associated with the <br />
CMMC Level 3.
 
• ''Nonrecurring Engineering Costs: ''
 
$2,700,000.
 
• ''Recurring Engineering Costs: ''
 
$490,000.
 
• ''Assessment Costs and Initial ''
 
''Affirmation Costs: ''It is estimated that <br />
the cost to support a CMMC Level 3 <br />
C3PAO Certification for a small entity is <br />
*$9,050 The three-year cost is $12,802 <br />
(summarized in 4.1.2 above, table 2), <br />
and includes the triennial assessment + <br />
affirmation, plus two additional annual <br />
affirmations ($9,050 + $1,876 + $1,876): <br />
—''Phase 1: Planning and preparing for ''
 
''the Level 3 assessment: ''$1,905
 
• A director (MGMT5) for 10 hours
 
($190.52/hr
 
× 10hrs = $1,905)
 
—''Phase 2: Conducting the Level 3 ''
 
''assessment: ''$1,524
 
• A director (MGMT5) for 8 hours
 
($190.52/hr
 
× 8hrs = $1,524)
 
—''Phase 3: Reporting of Level 3 ''
 
''assessment results: ''$1,876
 
• A director (MGMT5) for 8 hours
 
($190.52/hr
 
× 8hrs = $1,524)
 
• A staff IT specialist (IT4) for 4.08
 
hours ($86.24/hr
 
× 4.08hrs = $352)
 
—''Phase 4: Remediation (for CMMC ''
 
''Level 3 if necessary and allowed): <br />
''$1,869
 
• A director (MGMT5) for 8 hours
 
($190.52/hr
 
× 8hrs = $1,524)
 
• A staff IT specialist (IT4) for 48
 
hours ($86.24/hr
 
× 48hrs = $345)
 
• ''Affirmation''—initial affirmation
 
post assessment: $1,876
 
• ''Reaffirmations: ''It is estimated that
 
the costs to reaffirm a CMMC Level 3 <br />
Assessment annually is $1,876 (three- <br />
year cost is $5,628, or $1,876
 
× 3)
 
—A director (MGMT5) for 8 hours
 
($190.52/hr
 
× 8hrs = $1,524)
 
—A staff IT specialist (IT4) for 4.08
 
hours ($86.24/hr
 
× 4.08hrs = $352)
 
• ''Summary: ''The following is the
 
annual small entities total cost summary <br />
for CMMC Level 3 Certifications and <br />
Affirmations over a ten-year period. <br />
Example calculation, Year 2 (reference <br />
per entity amounts above): <br />
—*($9,050 Certification per entity
 
× 45
 
entities) + ($1,876 Annual Affirmation <br />
per entity
 
× 3 entities) = $412,897,
 
and
 
—$121,500,000 Nonrecurring
 
Engineering cost ($2,700,000 per <br />
entity
 
× 45 entities being certified),
 
and
 
—$23,520,000 Recurring Engineering
 
cost ($490,000 per entity
 
× 45 entities
 
being certified) + ($490,000 per entity
 
× 3 entities performing affirmations)
 
—$145,432,897 Total Cost =
 
Certification and Affirmation Cost
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00118
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.030&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83209 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
66
 
An Organization Seeking Certification (OSC) is
 
an entity seeking to contract, obtain, or maintain <br />
CMMC certification for a given information system <br />
at a particular CMMC Level. An OSC is also an <br />
OSA.
 
67
 
An Organization Seeking Assessment (OSA) is
 
an entity seeking to conduct, obtain, or maintain a <br />
CMMC assessment for a given information system <br />
at a particular CMMC Level. The term OSA <br />
includes all OSCs.
 
($412,897) + Nonrecurring <br />
Engineering cost ($121,500,000) +
 
Recurring Engineering cost <br />
($23,520,000), or $145,432,897.
 
Projected Reporting, Recordkeeping, <br />
and Compliance Requirements
 
The CMMC Program provides for the
 
assessment of contractor <br />
implementation of cybersecurity <br />
requirements to enhance confidence in <br />
contactor protection of unclassified <br />
information within the DoD supply <br />
chain. CMMC contractual requirements <br />
are implemented under the 48 CFR part <br />
204 CMMC Acquisition rule, with <br />
associated rulemaking for the CMMC <br />
Program requirements (''e.g., ''CMMC <br />
Scoring Methodology, certificate <br />
issuance, information accessibility) <br />
under the 32 CFR part 170 CMMC <br />
Program rule. The 32 CFR part 170 <br />
CMMC Program rule includes two <br />
separate information collection requests <br />
(ICR), one for the CMMC Program and <br />
one for CMMC eMASS.
 
This information collection is
 
necessary to support the <br />
implementation of the CMMC <br />
assessment process for Levels 2 and 3 <br />
certification assessment, as defined in <br />
§§ 170.17 and 170.18 respectively.
 
The CMMC Level 2 certification
 
assessment process is conducted by <br />
Certified Assessors, employed by <br />
CMMC Third-Party Assessment <br />
Organizations (C3PAOs). During the <br />
assessment process, Organizations <br />
Seeking Certification 66 (OSCs) hire
 
C3PAOs to conduct the third-party <br />
assessment required for certification.
 
The CMMC Level 3 certification
 
assessment process is conducted by the <br />
Defense Contract Management Agency <br />
(DCMA) Defense Industrial Base <br />
Cybersecurity Assessment Center <br />
(DIBCAC).
 
Use of the Information
 
Level 1 and Level 2 CMMC Self-
 
Assessments. Organizations Seeking <br />
Assessment 67 (OSAs) follow procedures <br />
as defined in §§ 170.15(a)(1) and <br />
170.16(a)(1) to conduct CMMC Level 1 <br />
and Level 2 self-assessments on their <br />
information systems to determine <br />
conformance with the information <br />
safeguarding requirements associated <br />
with the CMMC level requirements. The <br />
Level 1 and Level 2 self-assessment <br />
information collection reporting and <br />
recordkeeping requirements will be <br />
included in a modification of an <br />
existing Defense Federal Acquisition <br />
Regulation Supplement (DFARS) <br />
collection approved under OMB Control <br />
Number 0750–0004, Assessing <br />
Contractor Implementation of <br />
Cybersecurity Requirements. <br />
Modifications to this DFARS collection <br />
will be addressed as part of the 48 CFR <br />
part 204 CMMC Acquisition final rule.
 
CMMC Level 2 Certification Assessment
 
The Level 2 certification assessment
 
information collection burden for <br />
reporting and recordkeeping <br />
requirements are included in the 32 CFR <br />
part 170 CMMC Program rule. The <br />
information collection burden for the <br />
OSCs to upload affirmations in SPRS is <br />
included in the 48 CFR part 204 CMMC <br />
Acquisition final rule. Additionally, the <br />
information collection burden <br />
requirements for the CMMC <br />
instantiation of eMASS are addressed in <br />
a separate 32 CFR part 170 CMMC <br />
Program final rule information <br />
collection request (ICR).
 
OSCs follow procedures as defined in
 
§ 170.17 to prepare for CMMC Level 2 <br />
certification assessment.
 
Certified Assessors assigned by
 
C3PAOs follow requirements and <br />
procedures as defined in § 170.17 to <br />
conduct CMMC assessments on defense <br />
contractor information systems to <br />
determine conformance with the <br />
information safeguarding requirements <br />
associated with CMMC Level 2. This is <br />
an assessment to validate <br />
implementation of the 110 security <br />
requirements from NIST SP 800–171 R2.
 
Prospective C3PAOs must complete
 
and submit the Standard Form (SF) 328 <br />
Certificate Pertaining to Foreign <br />
Interests (OMB control number 0704– <br />
0579) upon request from Defense <br />
Counterintelligence and Security <br />
Agency (DCSA).
 
C3PAOs must generate and collect
 
pre-assessment and planning material <br />
(contact information for the OSC,
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00119
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.031&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83210 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
information about the C3PAO and <br />
assessors conducting the assessment, <br />
the level of assessment planned, the <br />
CMMC Model and Assessment Guide <br />
versions, and assessment approach), <br />
artifact information (list of artifacts, <br />
hash of artifacts, and hashing algorithm <br />
used), final assessment reports, <br />
appropriate CMMC certificates of <br />
assessment, and assessment appeal <br />
information. C3PAOs submit the data <br />
they generate and collect into the <br />
CMMC instantiation of eMASS, the <br />
information collection required for this <br />
submission is addressed in a separate <br />
CMMC eMASS ICR for the 32 CFR part <br />
170 CMMC Program rule. OSCs may <br />
have a POA&amp;M at CMMC Level 2 as <br />
addressed in § 170.21. C3PAOs perform <br />
a POA&amp;M closeout assessment. The <br />
C3PAO process to conduct a POA&amp;M <br />
Close-out Assessment, where <br />
applicable, is the same as the initial <br />
assessment with the same information <br />
collection requirements.
 
OSCs must retain artifacts used as
 
evidence for the assessment for the <br />
duration of the validity period of the <br />
certificate of assessment, and at <br />
minimum, for six years from the date of <br />
certification assessment as addressed in <br />
§ 170.17(c)(4). The OSC is responsible <br />
for compiling relevant artifacts as <br />
evidence and having knowledgeable <br />
personnel available during the <br />
assessment. The organizational artifacts <br />
are proprietary to the OSC and will not <br />
be retained by the assessment team <br />
unless expressly permitted by the OSC. <br />
To preserve the integrity of the artifacts <br />
reviewed, the OSC creates a hash of <br />
assessment evidence (to include a list of <br />
the artifact names, the return values of <br />
the hashing algorithm, and the hashing <br />
algorithm used) and retains the artifact <br />
information for six years. The <br />
information obtained from the artifacts <br />
is an information collection and is <br />
provided to the C3PAO for uploading <br />
into the CMMC instantiation of eMASS <br />
(addressed in a separate CMMC eMASS <br />
ICR for the 32 CFR part 170 CMMC <br />
Program final rule); the artifacts <br />
themselves are not an information <br />
collection. The OSC process to support <br />
a POA&amp;M Close-out Assessment, where <br />
applicable, is the same as the initial <br />
assessment with the same information <br />
collection requirements.
 
If an OSC does not agree with the
 
assessment results, it may formally <br />
dispute the assessment and initiate an <br />
Assessment Appeal process with the <br />
C3PAO who conducted the assessment. <br />
C3PAOs submit assessment appeals <br />
using eMASS (addressed in a separate <br />
CMMC eMASS ICR for the 32 CFR part <br />
170 CMMC Program final rule). Appeals <br />
are tracked in the CMMC instantiation
 
of eMASS and any resulting changes to <br />
the assessment results are uploaded into <br />
the CMMC instantiation of eMASS.
 
C3PAOs maintain records for a period
 
of six years of monitoring, education, <br />
training, technical knowledge, skills, <br />
experience, and authorization of each <br />
member of its personnel involved in <br />
inspection activities; contractual <br />
agreements with OSCs; any working <br />
papers generated from Level 2 <br />
certification assessments; and <br />
organizations for whom consulting <br />
services were provided as addressed in <br />
§ 170.9(b)(9). The Accreditation Body <br />
provides the CMMC PMO with current <br />
data on C3PAOs, including <br />
authorization and accreditation records <br />
and status using the CMMC <br />
instantiation of eMASS (addressed in a <br />
separate CMMC eMASS ICR for the 32 <br />
CFR part 170 CMMC Program final <br />
rule).
 
The Accreditation Body provides all
 
plans related to potential sources of <br />
revenue, to include but not limited to <br />
fees, licensing, processes, membership, <br />
and/or partnerships to the Government’s <br />
CMMC PMO as addressed in <br />
§ 170.8(b)(13).
 
CAICOs maintain records for a period
 
of six years of all procedures, processes, <br />
and actions related to fulfillment of the <br />
requirements set forth in § 170.10(b)(9).
 
CMMC Level 3 Certification Assessment
 
The Level 3 certification assessment
 
information collection burden for <br />
reporting and recordkeeping <br />
requirements are included in the 32 CFR <br />
part 170 CMMC Program final rule. The <br />
information collection burden for OSCs <br />
to upload affirmations in SPRS is <br />
included in the 48 CFR part 204 CMMC <br />
Acquisition final rule. Additionally, the <br />
information collection burden <br />
requirements for the CMMC <br />
instantiation of eMASS are addressed in <br />
a separate CMMC eMASS ICR for the 32 <br />
CFR part 170 CMMC Program final rule.
 
OSCs follow procedures as defined in
 
§ 170.18 to prepare for CMMC Level 3 <br />
certification assessment.
 
DCMA DIBCAC Assessors follow
 
requirements and procedures as defined <br />
in § 170.18 to conduct CMMC <br />
assessments on defense contractor <br />
information systems to determine <br />
conformance with the information <br />
safeguarding requirements associated <br />
with CMMC Level 3. This is an <br />
assessment to validation the <br />
implementation of the 24 selected <br />
security requirements from NIST SP <br />
800–172 Feb2021. Because DCMA <br />
DIBCAC is a government entity, there <br />
are no public information collection <br />
requirements.
 
DCMA DIBCAC must generate and
 
collect pre-assessment and planning <br />
material (contact information for the <br />
OSC, information about the assessors <br />
conducting the assessment, the level of <br />
assessment planned, the CMMC Model <br />
and Assessment Guide versions, and <br />
assessment approach), artifact <br />
information (list of artifacts, hash of <br />
artifacts, and hashing algorithm used), <br />
final assessment reports, appropriate <br />
CMMC certificates of assessment, and <br />
assessment appeal information. DCMA <br />
DIBCAC submits the data it generates <br />
and collects into the CMMC <br />
instantiation of eMASS (addressed in a <br />
separate CMMC eMASS ICR for the 32 <br />
CFR part 170 CMMC Program final <br />
rule).
 
OSCs may have a POA&amp;M at CMMC
 
Level 3 as addressed in § 170.21. DCMA <br />
DIBCAC performs a POA&amp;M closeout <br />
assessment. The DCMA DIBCAC process <br />
to conduct a POA&amp;M close-out <br />
assessment, where applicable, is the <br />
same as the initial assessment with the <br />
same information collection <br />
requirements.
 
OSCs must retain artifacts used as
 
evidence for the assessment for the <br />
duration of the validity period of the <br />
certificate of assessment, and at <br />
minimum, for six years from the date of <br />
certification assessment as addressed in <br />
§ 170.18(c)(4). The OSC is responsible <br />
for compiling relevant artifacts as <br />
evidence and having knowledgeable <br />
personnel available during the <br />
assessment. Assessors will not <br />
permanently retain assessment artifacts. <br />
To preserve the integrity of the artifacts <br />
reviewed during the assessment, the <br />
OSC creates a hash of assessment <br />
evidence (to include a list of the artifact <br />
names, the return values of the hashing <br />
algorithm, and the hashing algorithm <br />
used) and retains the artifact <br />
information for six years. The <br />
information obtained from the artifacts <br />
is an information collection and DCMA <br />
DIBCAC uploads the information into <br />
the CMMC instantiation of eMASS; the <br />
artifacts themselves are not an <br />
information collection. The OSC process <br />
to support a POA&amp;M close-out <br />
assessment, where applicable, is the <br />
same as the initial assessment with the <br />
same information collection <br />
requirements.
 
If an OSC does not agree with the
 
assessment results, it may formally <br />
dispute the assessment and initiate an <br />
Assessment Appeal process with DCMA <br />
DIBCAC. DCMA DIBCAC submits <br />
assessment appeals using eMASS. <br />
Appeals are tracked in the CMMC <br />
instantiation of eMASS and any <br />
resulting changes to the assessment
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00120
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83211 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
results are uploaded into CMMC <br />
eMASS.
 
DCMA DIBCAC maintains records for
 
a period of six years of monitoring, <br />
education, training, technical <br />
knowledge, skills, experience, and <br />
authorization of each member of its <br />
personnel involved in inspection <br />
activities and working papers generated <br />
from Level 3 Certification Assessments.
 
Use of Information Technology
 
CMMC assessment data and results
 
are collected using information <br />
technology. C3PAOs and DCMA <br />
DIBCAC electronically upload <br />
assessment data and results into the <br />
CMMC instantiation of eMASS <br />
(addressed in a separate CMMC eMASS <br />
ICR for the 32 CFR part 170 CMMC <br />
Program final rule). The CMMC <br />
instantiation of eMASS electronically <br />
transfers certification results to SPRS. <br />
For Level 1 and 2 self-assessments, <br />
OSAs upload their assessment data <br />
directly into SPRS.
 
Use of the CMMC instantiation of
 
eMASS provides DoD visibility into the <br />
cybersecurity posture of the defense <br />
contractor supply chain and is the <br />
mechanism to generate reports on the <br />
health of the CMMC Ecosystem. SPRS is <br />
DoD’s authoritative source for supplier <br />
and product performance information. <br />
Use of this electronic system to collect <br />
CMMC information eliminates the need <br />
for contractors to respond directly to <br />
multiple DoD requiring activities. SPRS <br />
serves as a single repository for <br />
Government access to CMMC <br />
assessment results. Modifications to <br />
information collections in SPRS will be <br />
addressed in the 48 CFR part 204 <br />
CMMC Acquisition final rule.
 
Non-Duplication
 
The information obtained through this
 
collection is unique and is not already <br />
available for use or adaptation from <br />
another cleared source.
 
Burden on Small Businesses
 
For Level 1 and 2 self-assessments,
 
OSAs must report annually and <br />
triennially, respectively. Level 2 and <br />
Level 3 certification assessments must <br />
be conducted every three years by a <br />
C3PAO or DCMA DIBCAC, respectively. <br />
At all levels, an annual affirmation is <br />
required. In all cases, the burden <br />
applied to small business is the <br />
minimum consistent with applicable <br />
laws, Executive orders, regulations, and <br />
prudent business practices.
 
A C3PAO, although not a defense
 
contractor, may also be a small business. <br />
Efforts to minimize the burden on <br />
C3PAOs include the electronic <br />
collection of data using the CMMC <br />
instantiation of eMASS and providing <br />
Microsoft Excel spreadsheet templates.
 
Less Frequent Collection
 
CMMC certifications last up to three
 
years. The assessment frequency for <br />
each level was determined by the DoD <br />
based on the sensitivity of information <br />
processed, stored, or transmitted by the <br />
OSA at each level.
 
DoD Program Managers use the
 
CMMC information in SPRS to confirm <br />
the validity status of an OSA’s CMMC <br />
self-assessment or certification <br />
assessment prior to contract award. <br />
Rather than taking a contract-by- <br />
contract approach to securing Federal <br />
Contract Information (FCI) and <br />
Controlled Unclassified Information <br />
(CUI), the OSA may obtain multiple
 
contracts with a single CMMC self- <br />
assessment or certification assessment, <br />
thereby reducing the cost to both DoD <br />
and industry.
 
Consultation and Public Comments
 
The Department consulted with
 
members of the DIB Sector Coordinating <br />
Council (SCC), and government <br />
organizations including the DCMA <br />
DIBCAC and the Missile Defense <br />
Agency in determining what data to <br />
collect in the CMMC instantiation of <br />
eMASS.
 
The 60-Day '''Federal Register '''notice
 
information is included in the preamble <br />
of the 32 CFR part 170 CMMC Program <br />
final rule for public comment.
 
The CMMC PMO is also working with
 
a records management point-of-contact <br />
to ensure records produced from this <br />
information collection are retained and <br />
disposed of according to a NARA- <br />
approved records retention and <br />
disposition schedule. Records will be <br />
treated as permanent until the <br />
appropriate schedule is identified or <br />
approved.
 
Part A &amp; B: Respondent Burden and Its <br />
Labor Costs
 
The Level 1 and Level 2 self-
 
assessment information collection <br />
reporting and recordkeeping <br />
requirements for the CMMC Program <br />
will be included in a modification of an <br />
existing DFARS collection approved <br />
under OMB Control Number 0750–0004, <br />
Assessing Contractor Implementation of <br />
Cybersecurity Requirements. <br />
Modifications to this DFARS collection <br />
will be addressed as part of the 48 part <br />
204 CMMC Acquisition final rule.
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00121
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83212 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
68
 
Respondent is equivalent to an entity; an entity
 
provides one response annually.
 
69
 
Hours per Response represents the estimated
 
burden hours to complete the indicated assessment.
 
70
 
Hourly Rate represents a composite hourly rate
 
derived from the detailed type of labor and <br />
associated rates estimated in the CMMC cost <br />
estimate model.
 
71
 
The entity type refers to the size of the OSC as
 
either Small or Other Than Small; the entity type <br />
does not refer to the size of the C3PAO.
 
The public burden costs associated
 
with Level 2 and Level 3 certification <br />
assessment information collection <br />
reporting and recordkeeping <br />
requirements for the CMMC Program are <br />
addressed here, except for the eMASS <br />
reporting requirements which will be <br />
addressed as part of a separate CMMC <br />
eMASS ICR for the 32 CFR part 170 <br />
CMMC Program final rule. Respondent <br />
burden and cost for these information <br />
collection reporting and recordkeeping <br />
requirements are as follows:
 
Respondent Costs Other Than Burden <br />
Hour Costs
 
Non-Recurring and Recurring
 
Engineering estimated costs are <br />
included for Level 3 certification <br />
assessments. Non-Recurring Engineering <br />
reflects a one-time cost consisting of <br />
hardware, software, and the associated <br />
labor to implement the same. Recurring <br />
Engineering reflects annually recurring <br />
fees and associated labor for technology <br />
refresh. The estimated amounts below <br />
are average annual amounts for all <br />
entities as indicated.
 
Travel costs for C3PAO assessors may
 
represent an additional cost for <br />
respondents.
 
Cost to the Federal Government
 
The government burden costs
 
associated with Level 3 certification <br />
assessment information collection <br />
reporting and recordkeeping <br />
requirements for the CMMC Program are <br />
addressed here, except for the eMASS <br />
reporting requirements which will be <br />
addressed as part of a separate CMMC <br />
eMASS ICR for the 32 CFR part 170 <br />
CMMC Program rule. Respondent <br />
burden and cost for these information <br />
collection reporting and recordkeeping <br />
requirements are as follows:
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00122
 
Fmt 4701
 
Sfmt 4725
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.032&lt;/GPH&gt;
 
ER15OC24.033&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83213 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
72
 
Respondent is equivalent to an entity; an entity
 
provides one response annually.
 
73
 
Hours per Response represents the estimated
 
Government burden hours to complete the <br />
indicated assessment.
 
74
 
The Hourly Rate represents a composite hourly
 
rate derived from the detailed type of Government <br />
labor and associated rates estimated in the CMMC <br />
cost estimate model.
 
75
 
The entity type refers to the size of the OSC as
 
either Small or Other Than Small; the entity type <br />
does not refer to the size of DCMA DIBCAC.
 
Steps Taken To Minimize Economic <br />
Impact
 
DoD took aggressive steps to minimize
 
the economic impact of this program by <br />
streamlining requirements to reduce the <br />
number of steps in the process and the <br />
number of requirements that needed to <br />
be met, and reduced the requirement of <br />
100% compliance, and the number of <br />
third-party assessments required.
 
To further elaborate the DoD
 
established a review body that evaluated <br />
the CMMC Program to ensure it was <br />
meeting the programmatic requirements <br />
to secure Controlled Unclassified <br />
Information within the non-Federal <br />
networks of the Defense Industrial Base. <br />
A special independent team was <br />
established to review and provide <br />
recommendations on improving the <br />
program.
 
The DoD determined that the CMMC
 
program should only employ the <br />
Cybersecurity Standards prescribed by <br />
the NIST SP 800–171 that had been <br />
required for defense contractors since <br />
2017 as implemented by the DFARS <br />
clause 252.204–7012, which resulted in <br />
the removal of 20 requirements aligned <br />
with cybersecurity maturity. The ESG <br />
also recommended simplifying the <br />
program structure to require only 3 <br />
levels of certification vice the original 5. <br />
The program further determined that <br />
certifications should not be required at <br />
CMMC Level 1 and that self-assessment <br />
with an annual affirmation was
 
sufficient for this level. Level 2 CMMC <br />
was further evaluated and determined <br />
that bifurcation of this level was <br />
appropriate, and some CUI would only <br />
require a Level 2 self-assessment with <br />
annual affirmation, which further <br />
reduced the costs for the program. <br />
Further the ESG recommended that <br />
Plans of Actions and Milestones <br />
(POA&amp;Ms) for lower-level requirements <br />
that were not met be allowed for a <br />
limited period of time. This rule was <br />
updated to allow POA&amp;Ms for no more <br />
than 180 days to give contractors the <br />
ability to achieve contract award <br />
without being fully compliant with all <br />
requirements of NIST SP 800–171 R2.
 
And, in another effort to minimize the
 
economic impact the program <br />
developed a Phase-in approach to <br />
incrementally implement CMMC in four <br />
phases over 4 years, with the first year <br />
being focused on Self-assessment and <br />
compliance with NIST SP 800–171 R2 <br />
giving contractors more time to <br />
implement the requirements already <br />
required in their contracts since 2017. A <br />
CMMC waiver process was also <br />
included in the program which allows <br />
DoD the discretion to waive CMMC <br />
Program requirements to a procurement <br />
or class of procurements in advance of <br />
the solicitation in accordance with all <br />
applicable policies, procedures, and <br />
approval requirements. This waiver <br />
would allow contract award and the <br />
contractor would be expected to achieve <br />
compliance and certification at a <br />
defined time post-award.
 
The DoD is employing a phased
 
approach to the CMMC rollout to reduce <br />
implementation risk. DoD expects that <br />
the public has utilized the lead-time <br />
prior to the publication of this rule to <br />
prepare for CMMC implementation. <br />
CMMC Program requirements make no <br />
changes to existing policies for
 
information security requirements <br />
implemented by the DoD.
 
The phased CMMC implementation
 
plan described in § 170.3(e) is intended <br />
to address CMMC ramp-up issues, <br />
provide time to train the necessary <br />
number of assessors, and allow <br />
companies the time needed to <br />
understand and implement CMMC <br />
requirements. DoD has updated the rule <br />
to add an additional six months to the <br />
Phase 1 timeline. Phase 2 will start one <br />
calendar year after the start of Phase 1, <br />
and Phase 3 will start one calendar year <br />
after the start of Phase 2. As with all <br />
DoD programs, the Department intends <br />
to effectively oversee CMMC, and take <br />
appropriate actions needed to manage <br />
its effective implementation.
 
Alternatives
 
DoD considered and adopted several
 
alternatives during the development of <br />
this rule that reduce the burden on <br />
defense contractors and still meet the <br />
objectives of the rule. These alternatives <br />
include:
 
Maintaining status quo and leveraging
 
only the current requirements <br />
implemented in DFARS provision <br />
252.204–7019 and DFARS clause <br />
252.204–7020 requiring defense <br />
contractors and offerors to self-assess <br />
compliance and utilizing the DoD <br />
Assessment Methodology and entering a <br />
Basic Summary Score in SPRS.
 
Revising CMMC to reduce the burden
 
for small businesses and contractors <br />
who do not process, store, or transmit <br />
CUI by eliminating the requirement to <br />
hire a C3PAO and instead allow self- <br />
assessment with affirmation to maintain <br />
compliance at CMMC Level 1, and <br />
allowing triennial self-assessment with <br />
an annual affirmation to maintain <br />
compliance for some CMMC Level 2 <br />
programs.
 
Exempting contracts and orders
 
exclusively for the acquisition of
 
VerDate Sep&lt;11&gt;2014
 
18:51 Oct 11, 2024
 
Jkt 265001
 
PO 00000
 
Frm 00123
 
Fmt 4701
 
Sfmt 4700
 
E:\FR\FM\15OCR2.SGM
 
15OCR2
 
ER15OC24.034&lt;/GPH&gt;
 
khammond on DSKJM1Z7X2PROD with RULES2
 
 
 
 
 
 
 
'''83214 '''
 
'''Federal Register '''/ Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations
 
commercially available off-the-shelf <br />
items; and,
 
Implementing a phased
 
implementation for CMMC.
 
In addition, the Department took into
 
consideration the timing of the <br />
requirement to achieve a specified <br />
CMMC level: (1) at time of proposal or <br />
offer submission, (2) after contract <br />
award, (3) at the time of contract award, <br />
or (4) permitting government Program <br />
Managers to seek approval to waive <br />
inclusion of CMMC requirements in <br />
solicitations and resulting contracts that <br />
involve disclosure or creation of FCI or <br />
CUI as part of the contract effort. Such <br />
waivers will be requested and approved <br />
by DoD in accordance with internal <br />
policies, procedures, and approval <br />
requirements.
 
The Department ultimately adopted
 
alternatives (3) and (4). The drawback of <br />
alternative 1 (at time of proposal or offer <br />
submission) is the increased risk for <br />
contractors since they may not have <br />
sufficient time to achieve the required <br />
CMMC level after the release of the <br />
solicitation and before contract award. <br />
The drawback of alternative 2 (after <br />
contract award) is the increased risk to <br />
the Department with respect to the <br />
costs, program schedule, and <br />
uncertainty in the event the contractor <br />
is unable to achieve the required CMMC <br />
level in a reasonable amount of time <br />
given its current cybersecurity posture. <br />
This potential delay would apply to the <br />
entire supply chain and prevent the <br />
appropriate flow of CUI and FCI.
 
CMMC does not require
 
implementation of any additional <br />
security protection requirements beyond <br />
those identified in current FAR clause <br />
52.204–21 and in NIST SP 800–171 R2 <br />
for CMMC Levels 1 and Level 2, <br />
respectively. CMMC Level 3 <br />
requirements are new and based upon <br />
NIST SP 800–172 Feb2021.
 
Steps Taken To Minimize Additional <br />
Cost of Credit
 
The DoD is not a ‘‘covered agency’’
 
under 5 U.S.C. 604.
 
''E. Public Law 96–511, ''‘‘''Paperwork <br />
Reduction Act''’’ ''(44 U.S.C. Chapter 35) ''
 
Sections of this rule contain
 
information collection requirements. As <br />
required by the Paperwork Reduction <br />
Act (44 U.S.C. Chapter 35), DoD has <br />
submitted information collection <br />
packages to the Office of Management <br />
and Budget for review and approval. <br />
The titles and proposed OMB control <br />
numbers are as follows.
 
• Cybersecurity Maturity Model
 
Certification (CMMC) Enterprise <br />
Mission Assurance Support-Service <br />
(eMASS) Instantiation Information
 
Collection (OMB control number 0704– <br />
0676).
 
• Cybersecurity Maturity Model
 
Certification (CMMC) Program <br />
Reporting and Recordkeeping <br />
Requirements Information Collection <br />
(OMB Control Number 0704–0677).
 
In the proposed rule, DoD invited
 
comments on these information <br />
collection requirements and the <br />
paperwork burden associated with this <br />
rule. Five comments were received on <br />
the information clearance packages that <br />
were not applicable to the information <br />
collection requirements; however, the <br />
comments were applicable to other <br />
aspects of the rule, and they are <br />
addressed in the comments section of <br />
this preamble. There were no changes to <br />
paperwork burden included in the <br />
proposed rule that published December <br />
26, 2023 (88 FR 89058) based on public <br />
comments received. To review these <br />
collections—including all background <br />
materials—please visit at [https://www.reginfo.gov/public/do/PRAMain ''https://<br />
www.reginfo.gov/public/do/PRAMain <br />
'']and use the search function to enter <br />
either the title of the collection or the <br />
OMB Control Number.
 
''F. Executive Order 13132, ''‘‘''Federalism''’’
 
Executive Order 13132 establishes
 
certain requirements that an agency <br />
must meet when it promulgates a final <br />
rule that imposes substantial direct <br />
requirement costs on state and local <br />
governments, preempts state law, or <br />
otherwise has federalism implications. <br />
This final rule will not have a <br />
substantial effect on State and local <br />
governments.
 
''G. Executive Order 13175, <br />
''‘‘''Consultation and Coordination With <br />
Indian Tribal Governments''’’
 
Executive Order 13175 establishes
 
certain requirements that an agency <br />
must meet when it promulgates a final <br />
rule that imposes substantial direct <br />
compliance costs on one or more Indian <br />
Tribes, preempts Tribal law, or effects <br />
the distribution of power and <br />
responsibilities between the Federal <br />
Government and Indian Tribes. This <br />
final rule will not have a substantial <br />
effect on Indian Tribal governments.
 
'''List of Subjects in 32 CFR Part 170 '''
 
Certification, CMMC, CMMC Levels,
 
CMMC Program, Contracts, Controlled <br />
unclassified information, Cybersecurity, <br />
Federal contract information, <br />
Government procurement, Incorporation <br />
by reference.
 
■
 
Accordingly, the Department of
 
Defense adds 32 CFR part 170 to read <br />
as follows:
 
'''PART 170—CYBERSECURITY <br />
MATURITY MODEL CERTIFICATION <br />
(CMMC) PROGRAM '''
 
'''Subpart A—General Information '''
 
Sec. <br />
170.1
 
Purpose.  
 
170.2
 
Incorporation by reference.  
 
170.3
 
Applicability.  
 
170.4
 
Acronyms and definitions.  
 
170.5
 
Policy.  


'''Subpart B—Government Roles and <br />
'''Subpart B—Government Roles and <br />

Revision as of 03:56, 24 February 2025

PART 170—CYBERSECURITY MATURITY MODEL CERTIFICATION (CMMC) PROGRAM

Subpart A—General Information

Sec. 170.1 Purpose. 170.2 Incorporation by reference. 170.3 Applicability. 170.4 Acronyms and definitions. 170.5 Policy.

Subpart B—Government Roles and
Responsibilities

170.6

CMMC PMO.

170.7

DCMA DIBCAC.

Subpart C—CMMC Assessment and
Certification Ecosystem

170.8

Accreditation Body.

170.9

CMMC Third-Party Assessment

Organizations (C3PAOs).

170.10

CMMC Assessor and Instructor

Certification Organization (CAICO).

170.11

CMMC Certified Assessor (CCA).

170.12

CMMC Instructor.

170.13

CMMC Certified Professional (CCP).

Subpart D—Key Elements of the CMMC
Program

170.14

CMMC Model.

170.15

CMMC Level 1 self-assessment and

affirmation requirements.

170.16

CMMC Level 2 self-assessment and

affirmation requirements.

170.17

CMMC Level 2 certification

assessment and affirmation
requirements.

170.18

CMMC Level 3 certification

assessment and affirmation
requirements.

170.19

CMMC scoping.

170.20

Standards acceptance.

170.21

Plan of Action and Milestones

requirements.

170.22

Affirmation.

170.23

Application to subcontractors.

170.24

CMMC Scoring Methodology.

Appendix A to Part 170—Guidance

Authority: 5 U.S.C. 301; Sec. 1648, Pub.

L. 116–92, 133 Stat. 1198.

Subpart A—General Information.

§ 170.1

Purpose.

(a) This part describes the

Cybersecurity Maturity Model
Certification (CMMC) Program of the
Department of Defense (DoD) and
establishes requirements for defense
contractors and subcontractors to
implement prescribed cybersecurity
standards for safeguarding Federal
Contract Information (FCI) and
Controlled Unclassified Information
(CUI). This part (the CMMC Program)
also establishes requirements for
conducting an assessment of
compliance with the applicable
prescribed cybersecurity standard for
contractor information systems that:
process, store, or transmit FCI or CUI;
provide security protections for systems
which process, store, or transmit CUI; or

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00124

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83215

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

are not logically or physically isolated
from systems which process, store, or
transmit CUI.

(b) The CMMC Program provides DoD

with a viable means of conducting the
volume of assessments necessary to
verify contractor and subcontractor
implementation of required
cybersecurity requirements.

(c) The CMMC Program is designed to

ensure defense contractors are properly
safeguarding FCI and CUI that is
processed, stored, or transmitted on
defense contractor information systems.
FCI and CUI must be protected to meet
evolving threats and safeguard
nonpublic, unclassified information that
supports and enables the warfighter.
The CMMC Program provides a
consistent methodology to assess a
defense contractor’s implementation of
required cybersecurity requirements.
The CMMC Program utilizes the
security standards set forth in the 48
CFR 52.204–21; National Institute of
Standards and Technology (NIST)
Special Publication (SP) 800–171, Basic
Safeguarding of Covered Contractor
Information Systems, Revision 2,
February 2020 (includes updates as of
January 28, 2021) (NIST SP 800–171
R2); and selected requirements from the
NIST SP 800–172, Enhanced Security
Requirements for Protecting Controlled
Unclassified Information: A Supplement
to NIST Special Publication 800–171,
February 2021 (NIST SP 800–172
Feb2021), as applicable (see table 1 to
§ 170.14(c)(4) for requirements, see
§ 170.2 for availability of NIST
publications).

(d) The CMMC Program balances the

need to safeguard FCI and CUI and the
requirement to share information
appropriately with defense contractors
in order to develop capabilities for the
DoD. The CMMC Program is designed to
ensure implementation of cybersecurity
practices for defense contractors and to
provide DoD with increased assurance
that FCI and CUI information will be
adequately safeguarded when residing
on or transiting contractor information
systems.

(e) The CMMC Program creates no

right or benefit, substantive or
procedural, enforceable by law or in
equity by any party against the United
States, its departments, agencies, or
entities, its officers, employees, or
agents, or any other person.

§ 170.2

Incorporation by reference.

Certain material is incorporated by

reference into this part with the
approval of the Director of the Federal
Register under 5 U.S.C. 552(a) and 1
CFR part 51. Material approved for
incorporation by reference (IBR) is

available for inspection at the
Department of Defense (DoD) and at the
National Archives and Records
Administration (NARA). Contact DoD
[https://DoDcio.defense.gov/CMMC/ online: https://DoDcio.defense.gov/
CMMC/; email: ][mailto:osd.mc-alex.DoD-cio.mbx.cmmc-rule@mail.mil osd.mc-alex.DoD-
cio.mbx.cmmc-rule@mail.mil; or phone:
](202) 770–9100. For information on the
availability of this material at NARA,
[http://www.archives.gov/federal-register/cfr/ibr-locations visit: www.archives.gov/federal-register/
cfr/ibr-locations ]or email: [mailto:fr.inspection@nara.gov fr.inspection@
nara.gov. The material may be obtained
]from the following sources:

(a) National Institute of Standards and

Technology, U.S. Department of
Commerce, 100 Bureau Drive,
Gaithersburg, MD 20899; phone: (301)
[https://csrc.nist.gov/publications/ 975–8443; website: https://csrc.nist.gov/
publications/. ]

(1) FIPS PUB 200, Minimum Security

Requirements for Federal Information
and Information Systems, March 2006
(FIPS PUB 200 Mar2006); IBR approved
for § 170.4(b).

(2) FIPS PUB 201–3, Personal Identity

Verification (PIV) of Federal Employees
and Contractors, January 2022 (FIPS
PUB 201–3 Jan2022); IBR approved for
§ 170.4(b).

(3) SP 800–37, Risk Management

Framework for Information Systems and
Organizations: A System Life Cycle
Approach for Security and Privacy,
Revision 2, December 2018 (NIST SP
800–37 R2); IBR approved for § 170.4(b).

(4) SP 800–39, Managing Information

Security Risk: Organization, Mission,
and Information System View, March
2011 (NIST SP 800–39 Mar2011); IBR
approved for § 170.4(b).

(5) SP 800–53, Security and Privacy

Controls for Information Systems and
Organizations, Revision 5, September
2020 (includes updates as of December
10, 2020) (NIST SP 800–53 R5); IBR
approved for § 170.4(b).

(6) SP 800–82r3, Guide to Operational

Technology (OT) Security, September
2023 (NIST SP 800–82r3); IBR approved
for § 170.4(b).

(7) SP 800–115, Technical Guide to

Information Security Testing and
Assessment, September 2008 (NIST SP
800–115 Sept2008); IBR approved for
§ 170.4(b).

(8) SP 800–160, Volume 2, Developing

Cyber-Resilient Systems: A Systems
Security Engineering Approach,
Revision 1, December 2021 (NIST SP
800–160 V2R1); IBR approved for
§ 170.4(b).

(9) SP 800–171, Protecting Controlled

Unclassified Information in Nonfederal
Systems and Organizations, Revision 2,
February 2020 (includes updates as of
January 28, 2021), (NIST SP 800–171
R2); IBR approved for §§ 170.4(b) and
170.14(a) through (c).

(10) SP 800–171A, Assessing Security

Requirements for Controlled
Unclassified Information, June 2018
(NIST SP 800–171A Jun2018); IBR
approved for §§ 170.11(a), 170.14(d),
170.15(c), 170.16(c), 170.17(c), and
170.18(c).

(11) SP 800–172, Enhanced Security

Requirements for Protecting Controlled
Unclassified Information: A Supplement
to NIST Special Publication 800–171,
February 2021 (NIST SP 800–172
Feb2021); IBR approved for §§ 170.4(b),
170.5(a), and 170.14(a) and (c).

(12) SP 800–172A, Assessing

Enhanced Security Requirements for
Controlled Unclassified Information,
March 2022 (NIST SP 800–172A
Mar2022); IBR approved for §§ 170.4(b),
170.14(d), and 170.18(c).

(b) International Organization for

Standardization (ISO) Chemin de
Blandonnet 8, CP 401—1214 Vernier,
Geneva, Switzerland; phone: +41 22 749
[http://www.iso.org/popular-standards.html 01 11; website: www.iso.org/popular-
standards.html. ]

(1) ISO/IEC 17011:2017(E),

Conformity assessment—Requirements
for accreditation bodies accrediting
conformity assessment bodies, Second
edition, November 2017 (ISO/IEC
17011:2017(E)); IBR approved for
§§ 170.8(b)(3), 170.9(b)(13), and
170.10(b)(4).

(2) ISO/IEC 17020:2012(E),

Conformity assessment—Requirement
for the operation of various types of
bodies performing inspection, Second
edition, March 1, 2012 (ISO/IEC
17020:2012(E)); IBR approved for
§§ 170.8(a), (b)(1), (b)(3) and 170.9(b)(2)
and (b)(13).

(3) ISO/IEC 17024:2012(E),

Conformity assessment—General
requirements for bodies operating
certification of persons, second edition,
July 1, 2012 (ISO/IEC 17024:2012(E));
IBR approved for §§ 170.8(b)(2) and
170.10(a) and (b)(4), (7), and (8).

Note 1 to paragraph (b): The ISO/IEC

standards incorporated by reference in this
part may be viewed at no cost in ‘‘read only’’
format at https://ibr.ansi.org.

§ 170.3

Applicability.

(a) The requirements of this part

apply to:

(1) All DoD contract and subcontract

awardees that will process, store, or
transmit information, in performance of
the DoD contract, that meets the
standards for FCI or CUI on contractor
information systems; and,

(2) Private-sector businesses or other

entities comprising the CMMC
Assessment and Certification
Ecosystem, as specified in subpart C of
this part.

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00125

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83216

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

(b) The requirements of this part do

not apply to Federal information
systems operated by contractors or
subcontractors on behalf of the
Government.

(c) CMMC Program requirements

apply to all DoD solicitations and
contracts pursuant to which a defense
contractor or subcontractor will process,
store, or transmit FCI or CUI on
unclassified contractor information
systems, including those for the
acquisition of commercial items (except
those exclusively for COTS items)
valued at greater than the micro-
purchase threshold except under the
following circumstances:

(1) The procurement occurs during

Implementation Phase 1, 2, or 3 as
described in paragraph (e) of this
section, in which case CMMC Program
requirements apply in accordance with
the requirements for the relevant phase-
in period; or

(2) Application of CMMC Program

requirements to a procurement or class
of procurements may be waived in
advance of the solicitation at the
discretion of DoD in accordance with all
applicable policies, procedures, and
approval requirements.

(d) DoD Program Managers or

requiring activities are responsible for
selecting the CMMC Status that will
apply for a particular procurement or
contract based upon the type of
information, FCI or CUI, that will be
processed on, stored on, or transmitted
through a contractor information
system. Application of the CMMC
Status for subcontractors will be
determined in accordance with § 170.23.

(e) DoD is utilizing a phased approach

for the inclusion of CMMC Program
requirements in solicitations and
contracts. Implementation of CMMC
Program requirements will occur over
four (4) phases:

(1) Phase 1. Begins on the effective

date of the complementary 48 CFR part
204 CMMC Acquisition final rule. DoD
intends to include the requirement for
CMMC Statuses of Level 1 (Self) or
Level 2 (Self) for all applicable DoD
solicitations and contracts as a
condition of contract award. DoD may,
at its discretion, include the
requirement for CMMC Status of Level
1 (Self) or Level 2 (Self) for applicable
DoD solicitations and contracts as a
condition to exercise an option period
on a contract awarded prior to the
effective date. DoD may also, at its
discretion, include the requirement for
CMMC Status of Level 2 (C3PAO) in
place of the Level 2 (Self) CMMC Status
for applicable DoD solicitations and
contracts.

(2) Phase 2. Begins one calendar year

following the start date of Phase 1. In
addition to Phase 1 requirements, DoD
intends to include the requirement for
CMMC Status of Level 2 (C3PAO) for
applicable DoD solicitations and
contracts as a condition of contract
award. DoD may, at its discretion, delay
the inclusion of requirement for CMMC
Status of Level 2 (C3PAO) to an option
period instead of as a condition of
contract award. DoD may also, at its
discretion, include the requirement for
CMMC Status of Level 3 (DIBCAC) for
applicable DoD solicitations and
contracts.

(3) Phase 3. Begins one calendar year

following the start date of Phase 2. In
addition to Phase 1 and 2 requirements,
DoD intends to include the requirement
for CMMC Status of Level 2 (C3PAO) for
all applicable DoD solicitations and
contracts as a condition of contract
award and as a condition to exercise an
option period on a contract awarded
after the effective date. DoD intends to
include the requirement for CMMC
Status of Level 3 (DIBCAC) for all
applicable DoD solicitations and
contracts as a condition of contract
award. DoD may, at its discretion, delay
the inclusion of requirement for CMMC
Status of Level 3 (DIBCAC) to an option
period instead of as a condition of
contract award.

(4) Phase 4, full implementation.

Begins one calendar year following the
start date of Phase 3. DoD will include
CMMC Program requirements in all
applicable DoD solicitations and
contracts including option periods on
contracts awarded prior to the beginning
of Phase 4.

§ 170.4

Acronyms and definitions.

(a) Acronyms. Unless otherwise

noted, the following acronyms and their
terms are for the purposes of this part.
AC—Access Control
APT—Advanced Persistent Threat
AT—Awareness and Training
C3PAO—CMMC Third-Party

Assessment Organization

CA—Security Assessment
CAICO—CMMC Assessors and

Instructors Certification Organization

CAGE—Commercial and Government

Entity

CCA—CMMC-Certified Assessor
CCI—CMMC-Certified Instructor
CCP—CMMC-Certified Professional
CFR—Code of Federal Regulations
CIO—Chief Information Officer
CM—Configuration Management
CMMC—Cybersecurity Maturity Model

Certification

CMMC PMO—CMMC Program

Management Office

CNC—Computerized Numerical Control

CoPC—Code of Professional Conduct
CSP—Cloud Service Provider
CUI—Controlled Unclassified

Information

DCMA—Defense Contract Management

Agency

DD—Represents any two-character

CMMC Domain acronym

DFARS—Defense Federal Acquisition

Regulation Supplement

DIB—Defense Industrial Base
DIBCAC—DCMA’s Defense Industrial

Base Cybersecurity Assessment Center

DoD—Department of Defense
DoDI—Department of Defense

Instruction

eMASS—Enterprise Mission Assurance

Support Service

ESP—External Service Provider
FAR—Federal Acquisition Regulation
FCI—Federal Contract Information
FedRAMP—Federal Risk and

Authorization Management Program

GFE—Government Furnished

Equipment

IA—Identification and Authentication
ICS—Industrial Control System
IIoT—Industrial Internet of Things
IoT—Internet of Things
IR—Incident Response
IS—Information System
IEC—International Electrotechnical

Commission

ISO/IEC—International Organization for

Standardization/International
Electrotechnical Commission

IT—Information Technology
L#—CMMC Level Number
MA—Maintenance
MP—Media Protection
MSSP—Managed Security Service

Provider

NARA—National Archives and Records

Administration

NAICS—North American Industry

Classification System

NIST—National Institute of Standards

and Technology

N/A—Not Applicable
ODP—Organization-Defined Parameter
OSA—Organization Seeking Assessment
OSC—Organization Seeking

Certification

OT—Operational Technology
PI—Provisional Instructor
PIEE—Procurement Integrated

Enterprise Environment

PII—Personally Identifiable Information
PLC—Programmable Logic Controller
POA&M—Plan of Action and Milestones
PRA—Paperwork Reduction Act
RM—Risk Management
SAM—System of Award Management
SC—System and Communications

Protection

SCADA—Supervisory Control and Data

Acquisition

SI—System and Information Integrity
SIEM—Security Information and Event

Management

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00126

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83217

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

SP—Special Publication
SPD—Security Protection Data
SPRS—Supplier Performance Risk

System

SSP—System Security Plan

(b) Definitions. Unless otherwise

noted, these terms and their definitions
are for the purposes of this part.

Access Control (AC) means the

process of granting or denying specific
requests to obtain and use information
and related information processing
services; and/or entry to specific
physical facilities (e.g., Federal
buildings, military establishments, or
border crossing entrances), as defined in
FIPS PUB 201–3 Jan2002 (incorporated
by reference, see § 170.2).

Accreditation means a status pursuant

to which a CMMC Assessment and
Certification Ecosystem member (person
or organization), having met all criteria
for the specific role they perform
including required ISO/IEC
accreditations, may act in that role as set
forth in § 170.8 for the Accreditation
Body and § 170.9 for C3PAOs. (CMMC-
custom term)

Accreditation Body is defined in

§ 170.8 and means the one organization
DoD contracts with to be responsible for
authorizing and accrediting members of
the CMMC Assessment and Certification
Ecosystem, as required. The
Accreditation Body must be approved
by DoD. At any given point in time,
there will be only one Accreditation
Body for the DoD CMMC Program.
(CMMC-custom term)

Advanced Persistent Threat (APT)

means an adversary that possesses
sophisticated levels of expertise and
significant resources that allow it to
create opportunities to achieve its
objectives by using multiple attack
vectors (e.g., cyber, physical, and
deception). These objectives typically
include establishing and extending
footholds within the information
technology infrastructure of the targeted
organizations for purposes of exfiltrating
information, undermining or impeding
critical aspects of a mission, program, or
organization; or positioning itself to
carry out these objectives in the future.
The advanced persistent threat pursues
its objectives repeatedly over an
extended period-of-time, adapts to
defenders’ efforts to resist it, and is
determined to maintain the level of
interaction needed to execute its
objectives, as is defined in NIST SP
800–39 Mar2011 (incorporated by
reference, see § 170.2).

Affirming Official means the senior

level representative from within each
Organization Seeking Assessment (OSA)
who is responsible for ensuring the

OSA’s compliance with the CMMC
Program requirements and has the
authority to affirm the OSA’s continuing
compliance with the specified security
requirements for their respective
organizations. (CMMC-custom term)

Assessment means the testing or

evaluation of security controls to
determine the extent to which the
controls are implemented correctly,
operating as intended, and producing
the desired outcome with respect to
meeting the security requirements for an
information system or organization, as
defined in §§ 170.15 through 170.18.
(CMMC-custom term)

(i) Level 1 self-assessment is the term

for the activity performed by an OSA to
evaluate its own information system
when seeking a CMMC Status of Level
1 (Self).

(ii) Level 2 self-assessment is the term

for the activity performed by an OSA to
evaluate its own information system
when seeking a CMMC Status of Level
2 (Self).

(iii) Level 2 certification assessment is

the term for the activity performed by a
C3PAO to evaluate the information
system of an OSC when seeking a
CMMC Status of Level 2 (C3PAO).

(iv) Level 3 certification assessment is

the term for the activity performed by
the DCMA DIBCAC to evaluate the
information system of an OSC when
seeking a CMMC Status of Level 3
(DIBCAC).

(v) POA&M closeout self-assessment

is the term for the activity performed by
an OSA to evaluate only the NOT MET
requirements that were identified with
POA&M during the initial assessment,
when seeking a CMMC Status of Final
Level 2 (Self).

(vi) POA&M closeout certification

assessment is the term for the activity
performed by a C3PAO or DCMA
DIBCAC to evaluate only the NOT MET
requirements that were identified with
POA&M during the initial assessment,
when seeking a CMMC Status of Final
Level 2 (C3PAO) or Final Level 3
(DIBCAC) respectively.

Assessment Findings Report means

the final written assessment results by
the third-party or government
assessment team. The Assessment
Findings Report is submitted to the OSC
and to the DoD via CMMC eMASS.
(CMMC-custom term)

Assessment objective means a set of

determination statements that, taken
together, expresses the desired outcome
for the assessment of a security
requirement. Successful implementation
of the corresponding CMMC security
requirement requires meeting all
applicable assessment objectives
defined in NIST SP 800–171A Jun2018

(incorporated by reference, see § 170.2)
or NIST SP 800–172A Mar2022
(incorporated by reference, see § 170.2).
(CMMC-custom term)

Assessment Team means participants

in the Level 2 certification assessment
(CMMC Certified Assessors and CMMC
Certified Professionals) or the Level 3
certification assessment (DCMA
DIBCAC assessors). This does not
include the OSC participants preparing
for or participating in the assessment.
(CMMC-custom term)

Asset means an item of value to

stakeholders. An asset may be tangible
(e.g., a physical item such as hardware,
firmware, computing platform, network
device, or other technology component)
or intangible (e.g., humans, data,
information, software, capability,
function, service, trademark, copyright,
patent, intellectual property, image, or
reputation). The value of an asset is
determined by stakeholders in
consideration of loss concerns across
the entire system life cycle. Such
concerns include but are not limited to
business or mission concerns, as
defined in NIST SP 800–160 V2R1
(incorporated by reference, see § 170.2).

Asset Categories means a grouping of

assets that process, store or transmit
information of similar designation, or
provide security protection to those
assets. (CMMC-custom term)

Authentication is defined in FIPS

PUB 200 Mar2006 (incorporated by
reference, see § 170.2).

Authorized means an interim status

during which a CMMC Ecosystem
member (person or organization), having
met all criteria for the specific role they
perform other than the required ISO/IEC
accreditations, may act in that role for
a specified time as set forth in § 170.8
for the Accreditation Body and § 170.9
for C3PAOs. (CMMC-custom term)

Capability means a combination of

mutually reinforcing controls
implemented by technical means,
physical means, and procedural means.
Such controls are typically selected to
achieve a common information security
or privacy purpose, as defined in NIST
SP 800–37 R2 (incorporated by
reference, see § 170.2).

Cloud Service Provider (CSP) means

an external company that provides
cloud services based on cloud
computing. Cloud computing is a model
for enabling ubiquitous, convenient, on-
demand network access to a shared pool
of configurable computing resources
(e.g., networks, servers, storage,
applications, and services) that can be
rapidly provisioned and released with
minimal management effort or service
provider interaction. This definition is
based on the definition for cloud

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00127

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83218

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

computing in NIST SP 800–145
Sept2011. (CMMC-custom term)

CMMC Assessment and Certification

Ecosystem means the people and
organizations described in subpart C of
this part. This term is sometimes
shortened to CMMC Ecosystem.
(CMMC-custom term)

CMMC Assessment Scope means the

set of all assets in the OSA’s
environment that will be assessed
against CMMC security requirements.
(CMMC-custom term)

CMMC Assessor and Instructor

Certification Organization (CAICO) is
defined in § 170.10 and means the
organization responsible for training,
testing, authorizing, certifying, and
recertifying CMMC certified assessors,
certified instructors, and certified
professionals. (CMMC-custom term)

CMMC Instantiation of eMASS means

a CMMC instance of the Enterprise
Mission Assurance Support Service
(eMASS), a government owned and
operated system. (CMMC-custom term)

CMMC Security Requirements means

the 15 Level 1 requirements listed in the
48 CFR 52.204–21(b)(1), the 110 Level 2
requirements from NIST SP 800–171 R2
(incorporated by reference, see § 170.2),
and the 24 Level 3 requirements
selected from NIST SP 800–172 Feb2021
(incorporated by reference, see § 170.2).

CMMC Status is the result of meeting

or exceeding the minimum required
score for the corresponding assessment.
The CMMC Status of an OSA
information system is officially stored in
SPRS and additionally presented on a
Certificate of CMMC Status, if the
assessment was conducted by a C3PAO
or DCMA DIBCAC. The potential CMMC
Statuses are outlined in the paragraphs
that follow. (CMMC-custom term)

(i) Final Level 1 (Self) is defined in

§ 170.15(a)(1) and (c)(1). (CMMC-custom
term)

(ii) Conditional Level 2 (Self) is

defined in § 170.16(a)(1)(ii). (CMMC-
custom term)

(iii) Final Level 2 (Self) is defined in

§ 170.16(a)(1)(iii). (CMMC-custom term)

(iv) Conditional Level 2 (C3PAO) is

defined in § 170.17(a)(1)(ii). (CMMC-
custom term)

(v) Final Level 2 (C3PAO) is defined

in § 170.17(a)(1)(iii). (CMMC-custom
term)

(vi) Conditional Level 3 (DIBCAC) is

defined in § 170.18(a)(1)(ii). (CMMC-
custom term)

(vii) Final Level 3 (DIBCAC) is defined

in § 170.18(a)(1)(iii). (CMMC-custom
term)

CMMC Status Date means the date

that the CMMC Status results are
submitted to SPRS or the CMMC
instantiation of eMASS, as appropriate.

The date of the Conditional CMMC
Status will remain as the CMMC Status
Date after a successful POA&M closeout.
A new date is not set for a Final that
follows a Conditional. (CMMC-custom
term)

CMMC Third-Party Assessment

Organization (C3PAO) means an
organization that has been authorized or
accredited by the Accreditation Body to
conduct Level 2 certification
assessments and has the roles and
responsibilities identified in § 170.9.
(CMMC-custom term)

Contractor is defined in 48 CFR

3.502–1.

Contractor Risk Managed Assets are

defined in table 3 to § 170.19(c)(1).
(CMMC-custom term)

Controlled Unclassified Information

(CUI) is defined in 32 CFR 2002.4(h).

Controlled Unclassified Information

(CUI) Assets means assets that can
process, store, or transmit CUI. (CMMC-
custom term)

DCMA DIBCAC High Assessment

means an assessment that is conducted
by Government personnel in accordance
with NIST SP 800–171A Jun2018 and
leveraging specific guidance in the DoD
Assessment Methodology that:

(i) Consists of:
(A) A review of a contractor’s Basic

Assessment;

(B) A thorough document review;
(C) Verification, examination, and

demonstration of a contractor’s system
security plan to validate that NIST SP
800–171 R2 security requirements have
been implemented as described in the
contractor’s system security plan; and

(D) Discussions with the contractor to

obtain additional information or
clarification, as needed; and

(ii) Results in a confidence level of

‘‘High’’ in the resulting score. (Source:
48 CFR 252.204–7020).

Defense Industrial Base (DIB) is

defined in 32 CFR 236.2.

DoD Assessment Methodology

(DoDAM) documents a standard
methodology that enables a strategic
assessment of a contractor’s
implementation of NIST SP 800–171 R2,
a requirement for compliance with 48
CFR 252.204–7012. (Source: DoDAM
Version 1.2.1)

Enduring Exception means a special

circumstance or system where
remediation and full compliance with
CMMC security requirements is not
feasible. Examples include systems
required to replicate the configuration of
‘fielded’ systems, medical devices, test
equipment, OT, and IoT. No operational
plan of action is required but the
circumstance must be documented
within a system security plan.
Specialized Assets and GFE may be

enduring exceptions. (CMMC-custom
term)

Enterprise means an organization

with a defined mission/goal and a
defined boundary, using information
systems to execute that mission, and
with responsibility for managing its own
risks and performance. An enterprise
may consist of all or some of the
following business aspects: acquisition,
program management, financial
management (e.g., budgets), human
resources, security, and information
systems, information and mission
management, as defined in NIST SP
800–53 R5 (incorporated by reference,
see § 170.2).

External Service Provider (ESP) means

external people, technology, or facilities
that an organization utilizes for
provision and management of IT and/or
cybersecurity services on behalf of the
organization. In the CMMC Program,
CUI or Security Protection Data (e.g., log
data, configuration data), must be
processed, stored, or transmitted on the
ESP assets to be considered an ESP.
(CMMC-custom term)

Federal Contract Information (FCI) is

defined in 48 CFR 4.1901.

Government Furnished Equipment

(GFE) has the same meaning as
‘‘government-furnished property’’ as
defined in 48 CFR 45.101.

Industrial Control Systems (ICS)

means a general term that encompasses
several types of control systems,
including supervisory control and data
acquisition (SCADA) systems,
distributed control systems (DCS), and
other control system configurations that
are often found in the industrial sectors
and critical infrastructures, such as
Programmable Logic Controllers (PLC).
An ICS consists of combinations of
control components (e.g., electrical,
mechanical, hydraulic, pneumatic) that
act together to achieve an industrial
objective (e.g., manufacturing,
transportation of matter or energy), as
defined in NIST SP 800–82r3
(incorporated by reference, see § 170.2).

Information System (IS) is defined in

NIST SP 800–171 R2 (incorporated by
reference, see § 170.2).

Internet of Things (IoT) means the

network of devices that contain the
hardware, software, firmware, and
actuators which allow the devices to
connect, interact, and freely exchange
data and information, as defined in
NIST SP 800–172A Mar2022
(incorporated by reference, see § 170.2).

Operational plan of action as used in

security requirement CA.L2–3.12.2,
means the formal artifact which
identifies temporary vulnerabilities and
temporary deficiencies (e.g., necessary
information system updates, patches, or

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00128

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83219

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

reconfiguration as threats evolve) in
implementation of requirements and
documents how they will be mitigated,
corrected, or eliminated. The OSA
defines the format (e.g., document,
spreadsheet, database) and specific
content of its operational plan of action.
An operational plan of action does not
identify a timeline for remediation and
is not the same as a POA&M, which is
associated with an assessment for
remediation of deficiencies that must be
completed within 180 days. (CMMC-
custom term)

Operational Technology (OT) means

programmable systems or devices that
interact with the physical environment
(or manage devices that interact with
the physical environment). These
systems or devices detect or cause a
direct change through the monitoring or
control of devices, processes, and
events. Examples include industrial
control systems, building management
systems, fire control systems, and
physical access control mechanisms, as
defined in NIST SP 800–160 V2R1
(incorporated by reference, see § 170.2).

Organization-defined means as

determined by the OSA except as
defined in the case of Organization-
Defined Parameter (ODP). (CMMC-
custom term)

Organization-Defined Parameters

(ODPs) means selected enhanced
security requirements contain selection
and assignment operations to give
organizations flexibility in defining
variable parts of those requirements, as
defined in NIST SP 800–172A Mar2022
(incorporated by reference, see § 170.2).

Note 1 to ODPs: The organization

defining the parameters is the DoD.

Organization Seeking Assessment

(OSA) means the entity seeking to
undergo a self-assessment or
certification assessment for a given
information system for the purposes of
achieving and maintaining any CMMC
Status. The term OSA includes all
Organizations Seeking Certification
(OSCs). (CMMC-custom term)

Organization Seeking Certification

(OSC) means the entity seeking to
undergo a certification assessment for a
given information system for the
purposes of achieving and maintaining
the CMMC Status of Level 2 (C3PAO) or
Level 3 (DIBCAC). An OSC is also an
OSA. (CMMC-custom term)

Out-of-Scope Assets means assets that

cannot process, store, or transmit CUI
because they are physically or logically
separated from information systems that
do process, store, or transmit CUI, or are
inherently unable to do so; except for
assets that provide security protection
for a CUI asset (see the definition for

Security Protection Assets). (CMMC-
custom term)

Periodically means occurring at a

regular interval as determined by the
OSA that may not exceed one year.
(CMMC-custom term)

Personally Identifiable Information

means information that can be used to
distinguish or trace an individual’s
identity, either alone or when combined
with other information that is linked or
linkable to a specific individual, as
defined in NIST SP 800–53 R5
(incorporated by reference, see § 170.2).

Plan of Action and Milestones

(POA&M) means a document that
identifies tasks needing to be
accomplished. It details resources
required to accomplish the elements of
the plan, any milestones in meeting the
tasks, and scheduled completion dates
for the milestones, as defined in NIST
SP 800–115 Sept2008 (incorporated by
reference, see § 170.2).

Prime Contractor is defined in 48 CFR

3.502–1.

Process, store, or transmit means data

can be used by an asset (e.g., accessed,
entered, edited, generated, manipulated,
or printed); data is inactive or at rest on
an asset (e.g., located on electronic
media, in system component memory,
or in physical format such as paper
documents); or data is being transferred
from one asset to another asset (e.g.,
data in transit using physical or digital
transport methods). (CMMC-custom
term)

Restricted Information Systems means

systems (and associated IT components
comprising the system) that are
configured based on government
requirements (e.g., connected to
something that was required to support
a functional requirement) and are used
to support a contract (e.g., fielded
systems, obsolete systems, and product
deliverable replicas). (CMMC-custom
term)

Risk means a measure of the extent to

which an entity is threatened by a
potential circumstance or event, and is
typically a function of:

(i) The adverse impacts that would

arise if the circumstance or event
occurs; and

(ii) The likelihood of occurrence, as

defined in NIST SP 800–53 R5
(incorporated by reference, see § 170.2).

Risk Assessment means the process of

identifying risks to organizational
operations (including mission,
functions, image, reputation),
organizational assets, individuals, other
organizations, and the Nation, resulting
from the operation of a system. Risk
Assessment is part of risk management,
incorporates threat and vulnerability
analyses, and considers mitigations

provided by security controls planned
or in place. Synonymous with risk
analysis, as defined in NIST SP 800–39
Mar2011 (incorporated by reference, see
§ 170.2).

Security Protection Assets (SPA)

means assets providing security
functions or capabilities for the OSA’s
CMMC Assessment Scope. (CMMC-
custom term)

Security Protection Data (SPD) means

data stored or processed by Security
Protection Assets (SPA) that are used to
protect an OSC’s assessed environment.
SPD is security relevant information and
includes but is not limited to:
configuration data required to operate
an SPA, log files generated by or
ingested by an SPA, data related to the
configuration or vulnerability status of
in-scope assets, and passwords that
grant access to the in-scope
environment. (CMMC-custom term)

Specialized Assets means types of

assets considered specialized assets for
CMMC: Government Furnished
Equipment, Internet of Things (IoT) or
Industrial Internet of Things (IIoT),
Operational Technology (OT), Restricted
Information Systems, and Test
Equipment. (CMMC-custom term)

Subcontractor is defined in 48 CFR

3.502–1.

Supervisory Control and Data

Acquisition (SCADA) means a generic
name for a computerized system that is
capable of gathering and processing data
and applying operational controls over
long distances. Typical uses include
power transmission and distribution
and pipeline systems. SCADA was
designed for the unique communication
challenges (e.g., delays, data integrity)
posed by the various media that must be
used, such as phone lines, microwave,
and satellite. Usually shared rather than
dedicated, as defined in NIST SP 800–
82r3 (incorporated by reference, see
§ 170.2).

System Security Plan (SSP) means the

formal document that provides an
overview of the security requirements
for an information system or an
information security program and
describes the security controls in place
or planned for meeting those
requirements. The system security plan
describes the system components that
are included within the system, the
environment in which the system
operates, how the security requirements
are implemented, and the relationships
with or connections to other systems, as
defined in NIST SP 800–53 R5
(incorporated by reference, see § 170.2).

Temporary deficiency means a

condition where remediation of a
discovered deficiency is feasible, and a
known fix is available or is in process.

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00129

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83220

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

The deficiency must be documented in
an operational plan of action. A
temporary deficiency is not based on an
‘in progress’ initial implementation of a
CMMC security requirement but arises
after implementation. A temporary
deficiency may apply during the initial
implementation of a security
requirement if, during roll-out, specific
issues with a very limited subset of
equipment is discovered that must be
separately addressed. There is no
standard duration for which a
temporary deficiency may be active. For
example, FIPS-validated cryptography
that requires a patch and the patched
version is no longer the validated
version may be a temporary deficiency.
(CMMC-custom term)

Test Equipment means hardware and/

or associated IT components used in the
testing of products, system components,
and contract deliverables. (CMMC-
custom term)

User means an individual, or (system)

process acting on behalf of an
individual, authorized to access a
system, as defined in NIST SP 800–53
R5 (incorporated by reference, see
§ 170.2).

§ 170.5

Policy.

(a) Protection of FCI and CUI on

contractor information systems is of
paramount importance to the DoD and
can directly impact its ability to
successfully conduct essential missions
and functions. It is DoD policy that
defense contractors and subcontractors
shall be required to safeguard FCI and
CUI that is processed, stored, or
transmitted on contractor information
systems by applying specified security
requirements. In addition, defense
contractors and subcontractors may be
required to implement additional
safeguards defined in NIST SP 800–172
Feb2021 (incorporated by reference, see
§ 170.2), implementing DoD specified
parameters to meet CMMC Level 3
security requirements (see table 1 to
§ 170.14(c)(4)). These additional
requirements are necessary to protect
CUI being processed, stored, or
transmitted in contractor information
systems, when designated by a
requirement for CMMC Status of Level
3 (DIBCAC) as defined by a DoD
program manager or requiring activity.
In general, the Department will identify
a requirement for a CMMC Status of
Level 3 (DIBCAC) for solicitations and
resulting contracts supporting its most
critical programs and technologies.

(b) Program managers and requiring

activities are responsible for identifying
the CMMC Status that will apply to a
procurement. Selection of the applicable

CMMC Status will be based on factors
including but not limited to:

(1) Criticality of the associated

mission capability;

(2) Type of acquisition program or

technology;

(3) Threat of loss of the FCI or CUI to

be shared or generated in relation to the
effort;

(4) Impacts from exploitation of

information security deficiencies; and

(5) Other relevant policies and factors,

including Milestone Decision Authority
guidance.

(c) In accordance with the

implementation plan described in
§ 170.3, CMMC Program requirements
will apply to new DoD solicitations and
contracts, and shall flow down to
subcontractors who will process, store,
or transmit FCI or CUI in performance
of the subcontract, as described in
§ 170.23.

(d) In very limited circumstances, and

in accordance with all applicable
policies, procedures, and requirements,
a Service Acquisition Executive or
Component Acquisition Executive in
the DoD, or as delegated, may elect to
waive inclusion of CMMC Program
requirements in a solicitation or
contract. In such cases, contractors and
subcontractors will remain obligated to
comply with all applicable
cybersecurity and information security
requirements.

(e) The CMMC Program does not alter

any separately applicable requirements
to protect FCI or CUI, including those
requirements in accordance with 48
CFR 52.204–21, Basic Safeguarding of
Covered Contractor Information
Systems, or covered defense information
in accordance with 48 CFR 252.204–
7012, Safeguarding Covered Defense
Information and Cyber Incident
Reporting, or any other applicable
information protection requirements.
The CMMC Program provides a means
of verifying implementation of the
security requirements set forth in 48
CFR 52.204–21, NIST SP 800–171 R2,
and NIST SP 800–172 Feb2021, as
applicable.

Subpart B—Government Roles and
Responsibilities.

§ 170.6

CMMC PMO.

(a) The Office of the Department of

Defense Chief Information Officer (DoD
CIO) Office of the Deputy CIO for
Cybersecurity (DoD CIO(CS)) provides
oversight of the CMMC Program and is
responsible for establishing CMMC
assessment, accreditation, and training
requirements as well as developing and
updating CMMC Program policies and
implementing guidance.

(b) The CMMC PMO is responsible for

monitoring the CMMC AB’s
performance of roles assigned in this
rule and acting as necessary to address
problems pertaining to effective
performance.

(c) The CMMC PMO retains, on behalf

of the DoD CIO(CS), the prerogative to
review decisions of the CMMC
Accreditation Body as part of its
oversight of the CMMC program and
evaluate any alleged conflicts of interest
purported to influence the CMMC
Accreditation Body’s objectivity.

(d) The CMMC PMO is responsible for

sponsoring necessary DCSA activities
including FOCI risk assessment and Tier
3 security background investigations for
the CMMC Ecosystem members as
specified in §§ 170.8(b)(4) and (5),
170.9(b)(3) through (5), 170.11(b)(3) and
(4), and 170.13(b)(3) and (4).

(e) The CMMC PMO is responsible for

investigating and acting upon
indications that an active CMMC Status
has been called into question.
Indications that may trigger
investigative evaluations include, but
are not limited to, reports from the
CMMC Accreditation Body, a C3PAO, or
anyone knowledgeable of the security
processes and activities of the OSA.
Investigative evaluations include, but
are not limited to, reviewing pertinent
assessment information, and exercising
the right to conduct a DCMA DIBCAC
assessment of the OSA, as provided for
under the 48 CFR 252.204–7020.

(f) If a subsequent DCMA DIBCAC

assessment shows that adherence to the
provisions of this rule and the required
CMMC Status have not been achieved or
maintained, the DIBCAC results will
take precedence over any pre-existing
CMMC Status recorded in SPRS, or its
successor capability. The DoD will
update SPRS to reflect that the OSA is
out of compliance and does not meet
DoD CMMC requirements. If the OSA is
working on an active contract requiring
CMMC compliance, then standard
contractual remedies will apply.

§ 170.7

DCMA DIBCAC.

(a) DCMA DIBCAC assessors in

support of the CMMC Program will:

(1) Complete CMMC Level 2 and

Level 3 training.

(2) Conduct Level 3 certification

assessments and upload assessment
results into the CMMC instantiation of
eMASS, or its successor capability.

(3) Issue Certificates of CMMC Status

resulting from Level 3 certification
assessments.

(4) Conduct Level 2 certification

assessments of the Accreditation Body
and prospective C3PAOs’ information

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00130

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83221

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

systems that process, store, and/or
transmit CUI.

(5) Create and maintain a process for

assessors to collect the list of assessment
artifacts to include artifact names, their
return value of the hashing algorithm,
the hashing algorithm used, and upload
that data into the CMMC instantiation of
eMASS.

(6) As authorized and in accordance

with all legal requirements, enter and
track, OSC appeals and updated results
arising from Level 3 certification
assessment activities into the CMMC
instantiation of eMASS.

(7) Retain all records in accordance

with DCMA–MAN 4501–04.

(8) Conduct an assessment of the

OSA, when requested by the CMMC
PMO per §§ 170.6(e) and (f), as provided
for under the 48 CFR 252.204–7019 and
48 CFR 252.204–7020.

(9) Identify assessments that meet the

criteria in § 170.20 and verify that SPRS
accurately reflects the CMMC Status.

(b) An OSC, the CMMC AB, or a

C3PAO may appeal the outcome of its
DCMA DIBCAC conducted assessment
within 21 days by submitting a written
basis for appeal with the requirements
in question for DCMA DIBCAC
consideration. Appeals may be
submitted for review by visiting
www.dcma.mil/DIBCAC for contact
information, and a DCMA DIBCAC
Quality Assurance Review Team will
provide a written response or request
additional supporting documentation.

Subpart C—CMMC Assessment and
Certification Ecosystem.

§ 170.8

Accreditation Body.

(a) Roles and responsibilities. The

Accreditation Body is responsible for
authorizing and ensuring the
accreditation of CMMC Third-Party
Assessment Organizations (C3PAOs) in
accordance with ISO/IEC 17020:2012(E)
(incorporated by reference, see § 170.2)
and all applicable authorization and
accreditation requirements set forth.
The Accreditation Body is responsible
for establishing the C3PAO
authorization requirements and the
C3PAO Accreditation Scheme and
submitting both for approval by the
CMMC PMO. At any given point in
time, there will be only one
Accreditation Body for the DoD CMMC
Program.

(b) Requirements. The CMMC

Accreditation Body shall:

(1) Be US-based and be and remain a

member in good standing of the Inter-
American Accreditation Cooperation
(IAAC) and become an International
Laboratory Accreditation Cooperation
(ILAC) Mutual Recognition

Arrangement (MRA) signatory, with a
signatory status scope of ISO/IEC
17020:2012(E) (incorporated by
reference, see § 170.2).

(2) Be and remain a member in good

standing of the International
Accreditation Forum (IAF) with mutual
recognition arrangement signatory status
scope of ISO/IEC 17024:2012(E)
(incorporated by reference, see § 170.2).

(3) Achieve and maintain full

compliance with ISO/IEC 17011:2017(E)
(incorporated by reference, see § 170.2)
and complete a peer assessment by
other ILAC signatories for competence
in accrediting conformity assessment
bodies to ISO/IEC 17020:2012(E)
(incorporated by reference, see § 170.2),
both within 24 months of DoD approval.

(i) Prior to achieving full compliance

as set forth in this paragraph (b)(3), the
Accreditation Body shall:

(A) Authorize C3PAOs who meet all

requirements set forth in § 170.9 as well
as administrative requirements as
determined by the Accreditation Body
to conduct Level 2 certification
assessments and issue Certificates of
CMMC Status to OSCs based on the
assessment results.

(B) Require all C3PAOs to achieve and

maintain the ISO/IEC 17020:2012(E)
(incorporated by reference, see § 170.2)
requirements within 27 months of
authorization.

(ii) The Accreditation Body shall

accredit C3PAOs, in accordance with
ISO/IEC 17020:2012(E) (incorporated by
reference, see § 170.2), who meet all
requirements set forth in § 170.9 to
conduct Level 2 certification
assessments and issue Certificates of
CMMC Status to OSCs based on the
results.

(4) Ensure that the Accreditation

Body’s Board of Directors, professional
staff, Information Technology (IT) staff,
accreditation staff, and independent
CMMC Certified Assessor staff complete
a Tier 3 background investigation
resulting in a determination of national
security eligibility. This Tier 3
background investigation will not result
in a security clearance and is not being
executed for the purpose of government
employment. The Tier 3 background
investigation is initiated using the
[http://www.gsa.gov/reference/forms/questionnaire-for-national-security-positions Standard Form (SF) 86 (www.gsa.gov/
reference/forms/questionnaire-for-
national-security-positions) and
]submitted by DoD CIO Security to
Washington Headquarters Services
(WHS) for coordination for processing
by the Defense Counterintelligence and
Security Agency (DCSA). These
positions are designated as non-critical
sensitive with a risk designation of
‘‘Moderate Risk’’ in accordance with 5
CFR 1400.201(b) and (d) and the

investigative requirements of 5 CFR
731.106(c)(2).

(5) Comply with Foreign Ownership,

Control or Influence (FOCI) by:

(i) Completing the Standard Form (SF)

[http://www.gsa.gov/reference/forms/certificate-pertaining-to-foreign-interests 328 (www.gsa.gov/reference/forms/
certificate-pertaining-to-foreign-
interests), ]Certificate Pertaining to
Foreign Interests, and submit it directly
to Defense Counterintelligence and
Security Agency (DCSA) and undergo a
National Security Review with regards
to the protection of controlled
unclassified information based on the
factors identified in 32 CFR 117.11(b)
using the procedures outlined in 32 CFR
117.11(c). The Accreditation Body must
receive a non-disqualifying eligibility
determination by the CMMC PMO to be
recognized by the Department of
Defense.

(ii) Reporting any change to the

information provided on its SF 328 by
resubmitting the SF 328 to DCSA within
15 business days of the change being
effective. A disqualifying eligibility
determination, based on the results of
the change, will result in the
Accreditation Body losing its
authorization or accreditation under the
CMMC Program.

(iii) Identifying all prospective

C3PAOs to the CMMC PMO. The CMMC
PMO will sponsor the prospective
C3PAO for a FOCI risk assessment
conducted by the DCSA using the SF
328 as part of the authorization and
accreditation processes.

(iv) Notifying prospective C3PAOs of

the CMMC PMO’s eligibility
determination resulting from the FOCI
risk assessment.

(6) Obtain a Level 2 certification

assessment in accordance with the
procedures specified in § 170.17(a)(1)
and (c). This assessment, conducted by
DCMA DIBCAC, shall meet all
requirements for a Final Level 2
(C3PAO) but will not result in a CMMC
Status of Level 2 (C3PAO). The Level 2
certification assessment process must be
performed every three years.

(7) Provide all documentation and

records in English.

(8) Establish, maintain, and manage

an up-to-date list of authorized and
accredited C3PAOs on a single publicly
accessible website and provide the list
of these entities and their status to the
DoD through submission in the CMMC
instantiation of eMASS.

(9) Provide the CMMC PMO with

current data on C3PAOs, including
authorization and accreditation records
and status in the CMMC instantiation of
eMASS. This data shall include the
dates associated with the authorization
and accreditation of each C3PAO.

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00131

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83222

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

(10) Provide the DoD with

information about aggregate statistics
pertaining to operations of the CMMC
Ecosystem to include the authorization
and accreditation status of C3PAOs or
other information as requested.

(11) Provide inputs for assessor

supplemental guidance to the CMMC
PMO. Participate and support
coordination of these and other inputs
through DoD-led Working Groups.

(12) Ensure that all information about

individuals is encrypted and protected
in all Accreditation Body information
systems and databases.

(13) Provide all plans that are related

to potential sources of revenue, to
include but not limited to: fees,
licensing, processes, membership, and/
or partnerships to the Department’s
CMMC PMO.

(14) Ensure that the CMMC Assessors

and Instructors Certification
Organization (CAICO) is compliant with
ISO/IEC 17024:2012(E)

(15) Ensure all training products,

instruction, and testing materials are of
high quality and subject to CAICO
quality control policies and procedures,
to include technical accuracy and
alignment with all applicable legal,
regulatory, and policy requirements.

(16) Develop and maintain an internal

appeals process, as required by ISO/IEC
17020:2017(E), and render a final
decision on all elevated appeals.

(17) Develop and maintain a

comprehensive plan and schedule to
comply with all ISO/IEC 17011:2017(E),
and DoD requirements for Conflict of
Interest, Code of Professional Conduct,
and Ethics policies as set forth in the
DoD contract. All policies shall apply to
the Accreditation Body, and other
individuals, entities, and groups within
the CMMC Ecosystem who provide
Level 2 certification assessments,
CMMC instruction, CMMC training
materials, or Certificates of CMMC
Status on behalf of the Accreditation
Body. All policies in this section must
be approved by the CMMC PMO prior
to effectivity in accordance with the
following requirements.

(i) Conflict of Interest (CoI) policy.

The CoI policy shall:

(A) Include a detailed risk mitigation

plan for all potential conflicts of interest
that may pose a risk to compliance with
ISO/IEC 17011:2017(E).

(B) Require employees, Board

directors, and members of any
accreditation committees or appeals
adjudication committees to disclose to
the CMMC PMO, in writing, as soon as
it is known or reasonably should be
known, any actual, potential, or
perceived conflict of interest with
sufficient detail to allow for assessment.

(C) Require employees, Board

directors, and members of any
accreditation committees or appeals
adjudication committees who leave the
board or organization to enter a ‘‘cooling
off period’’ of one (1) year whereby they
are prohibited from working with the
Accreditation Body or participating in
any and all CMMC activities described
in Subpart C.

(D) Require CMMC Ecosystem

members to actively avoid participating
in any activity, practice, or transaction
that could result in an actual or
perceived conflict of interest.

(E) Require CMMC Ecosystem

members to disclose to Accreditation
Body leadership, in writing, any actual
or potential conflict of interest as soon
as it is known, or reasonably should be
known.

(ii) Code of Professional Conduct

(CoPC) policy. The CoPC policy shall:

(A) Describe the performance

standards by which the members of the
CMMC Ecosystem will be held
accountable and the procedures for
addressing violations of those
performance standards.

(B) Require the Accreditation Body to

investigate and resolve any potential
violations that are reported or are
identified by the DoD.

(C) Require the Accreditation Body to

inform the DoD in writing of new
investigations within 72 hours.

(D) Require the Accreditation Body to

report to the DoD in writing the
outcome of completed investigations
within 15 business days.

(E) Require CMMC Ecosystem

members to represent themselves and
their companies accurately; to include
not misrepresenting any professional
credentials or status, including CMMC
authorization or CMMC Status, nor
exaggerating the services that they or
their company are capable or authorized
to deliver.

(F) Require CMMC Ecosystem

members to be honest and factual in all
CMMC-related activities with
colleagues, clients, trainees, and others
with whom they interact.

(G) Prohibit CMMC Ecosystem

members from participating in the Level
2 certification assessment process for an
assessment in which they previously
served as a consultant to prepare the
organization for any CMMC assessment
within 3 years.

(H) Require CMMC Ecosystem

members to maintain the confidentiality
of customer and government data to
preclude unauthorized disclosure.

(I) Require CMMC Ecosystem

members to report results and data from
Level 2 certification assessments and

training objectively, completely, clearly,
and accurately.

(J) Prohibit CMMC Ecosystem

members from cheating, assisting
another in cheating, or allowing
cheating on CMMC examinations.

(K) Require CMMC Ecosystem

members to utilize official training
content developed by a CMMC training
organization approved by the CAICO in
all CMMC certification courses.

(iii) Ethics policy. The Ethics policy

shall:

(A) Require CMMC Ecosystem

members to report to the Accreditation
Body within 30 days of convictions,
guilty pleas, or no contest pleas to
crimes of fraud, larceny, embezzlement,
misappropriation of funds,
misrepresentation, perjury, false
swearing, conspiracy to conceal, or a
similar offense in any legal proceeding,
civil or criminal, whether or not in
connection with activities that relate to
carrying out their role in the CMMC
Ecosystem.

(B) Prohibit harassment or

discrimination by CMMC Ecosystem
members in all interactions with
individuals whom they encounter in
connection with their roles in the
CMMC Ecosystem.

(C) Require CMMC Ecosystem

members to have and maintain a
satisfactory record of integrity and
business ethics.

§ 170.9

CMMC Third-Party Assessment

Organizations (C3PAOs).

(a) Roles and responsibilities. C3PAOs

are organizations that are responsible for
conducting Level 2 certification
assessments and issuing Certificates of
CMMC Status to OSCs based on the
results. C3PAOs must be accredited or
authorized by the Accreditation Body in
accordance with the requirements set
forth.

(b) Requirements. C3PAOs shall:
(1) Obtain authorization or

accreditation from the Accreditation
Body in accordance with § 170.8(b)(3)(i)
and (ii).

(2) Comply with the Accreditation

Body policies for Conflict of Interest,
Code of Professional Conduct, and
Ethics set forth in § 170.8(b)(17); and
achieve and maintain compliance with
ISO/IEC 17020:2012(E) (incorporated by
reference, see § 170.2) within 27 months
of authorization.

(3) Require all C3PAO company

personnel participating in the Level 2
certification assessment process to
complete a Tier 3 background
investigation resulting in a
determination of national security
eligibility. This includes the CMMC
Assessment Team and the quality

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00132

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83223

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

assurance individual. This Tier 3
background investigation will not result
in a security clearance and is not being
executed for the purpose of government
employment. The Tier 3 background
investigation is initiated using the
Standard Form (SF) 86 ([http://www.gsa.gov/reference/forms/questionnaire-for-national-security-positions www.gsa.gov/
reference/forms/questionnaire-for-
national-security-positions). These
]positions are designated as non-critical
sensitive with a risk designation of
‘‘Moderate Risk’’ in accordance with 5
CFR 1400.201(b) and (d) and the
investigative requirements of 5 CFR
731.106(c)(2).

(4) Require all C3PAO company

personnel participating in the Level 2
certification assessment process who are
not eligible to obtain a Tier 3
background investigation to meet the
equivalent of a favorably adjudicated
Tier 3 background investigation. DoD
will determine the Tier 3 background
investigation equivalence for use with
the CMMC Program only.

(5) Comply with Foreign Ownership,

Control or Influence (FOCI) by:

(i) Completing and submitting

[http://www.gsa.gov/reference/forms/certificate-pertaining-to-foreign-interests Standard Form (SF) 328 (www.gsa.gov/
reference/forms/certificate-pertaining-
to-foreign-interests), Certificate
]Pertaining to Foreign Interests, upon
request from DCSA and undergo a
National Security Review with regards
to the protection of controlled
unclassified information based on the
factors identified in 32 CFR 117.11(b)
using the procedures outlined in 32 CFR
117.11(c).

(ii) Receiving a non-disqualifying

eligibility determination from the
CMMC PMO resulting from the FOCI
risk assessment in order to proceed to a
DCMA DIBCAC CMMC Level 2
assessment, as part of the authorization
and accreditation process set forth in
paragraph (b)(6) of this section.

(iii) Reporting any change to the

information provided on its SF 328 by
resubmitting the SF 328 to DCSA within
15 business days of the change being
effective. A disqualifying eligibility
determination, based on the results of
the change, will result in the C3PAO
losing its authorization or accreditation.

(6) Undergo a Level 2 certification

assessment meeting all requirements for
a Final Level 2 (C3PAO) in accordance
with the procedures specified in
§ 170.17(a)(1) and (c), with the following
exceptions:

(i) The assessment will be conducted

by DCMA DIBCAC.

(ii) The assessment will not result in

a CMMC Status of Level 2 (C3PAO) nor
receive a Certificate of CMMC Status.

(7) Provide all documentation and

records in English.

(8) Submit pre-assessment and

planning material, final assessment
reports, and CMMC certificates of
assessment into the CMMC instantiation
of eMASS.

(9) Unless disposition is otherwise

authorized by the CMMC PMO,
maintain all assessment related records
for a period of six (6) years. Such
records include any materials generated
by the C3PAO in the course of an
assessment, any working papers
generated from Level 2 certification
assessments; and materials relating to
monitoring, education, training,
technical knowledge, skills, experience,
and authorization of all personnel
involved in assessment activities;
contractual agreements with OSCs; and
organizations for whom consulting
services were provided.

(10) Provide any requested audit

information, including any out-of-cycle
from ISO/IEC 17020:2012(E)
requirements, to the Accreditation
Body.

(11) Ensure that all personally

identifiable information (PII) is
encrypted and protected in all C3PAO
information systems and databases.

(12) Meet the requirements for

Assessment Team composition. An
Assessment Team must include at least
two people: a Lead CCA, as defined in
§ 170.11(b)(10), and at least one other
CCA. Additional CCAs and CCPs may
also participate on an Assessment Team.

(13) Implement a quality assurance

function that ensures the accuracy and
completeness of assessment data prior
to upload into the CMMC instantiation
of eMASS. Any individual fulfilling the
quality assurance function must be a
CCA and cannot be a member of an
Assessment Team for which they are
performing a quality assurance role. A
quality assurance individual shall
manage the C3PAO’s quality assurance
reviews as defined in paragraph (b)(14)
of this section and the appeals process
as required by paragraphs (b)(19) and
(20) of this section and in accordance
with ISO/IEC 17020:2012(E)
(incorporated by reference, see § 170.2)
and ISO/IEC 17011:2017(E)
(incorporated by reference, see § 170.2).

(14) Conduct quality assurance

reviews for each assessment, including
observations of the Assessment Team’s
conduct and management of CMMC
assessment processes.

(15) Ensure that all Level 2

certification assessment activities are
performed on the information system
within the CMMC Assessment Scope.

(16) Maintain all facilities, personnel,

and equipment involved in CMMC
activities that are in scope of their Level
2 certification assessment and comply

with all security requirements and
procedures as prescribed by the
Accreditation Body.

(17) Ensure that all assessment data

and information uploaded into the
CMMC instantiation of eMASS
assessment data is compliant with the
CMMC assessment data standard as set
forth in eMASS CMMC Assessment
Import Templates on the CMMC eMASS
[https://cmmc.emass.apps.mil website: https://cmmc.emass.apps.mil.
]This system is accessible only to
authorized users.

(18) Issue Certificates of CMMC Status

to OSCs in accordance with the Level 2
certification assessment requirements
set forth in § 170.17, that include, at a
minimum, all industry CAGE codes
associated with the information systems
addressed by the CMMC Assessment
Scope, the C3PAO name, assessment
unique identifier, the OSC name, and
the CMMC Status date and level.

(19) Address all OSC appeals arising

from Level 2 certification assessment
activities. If the OSC or C3PAO is not
satisfied with the result of the appeal
either the OSC or the C3PAO can
elevate the matter to the Accreditation
Body for final determination.

(20) Submit assessment appeals,

review records, and decision results of
assessment appeals to DoD using the
CMMC instantiation of eMASS.

§ 170.10

CMMC Assessor and Instructor

Certification Organization (CAICO).

(a) Roles and responsibilities. The

CAICO is responsible for training,
testing, authorizing, certifying, and
recertifying CMMC assessors,
instructors, and related professionals.
Only the CAICO may make decisions
relating to examination certifications,
including the granting, maintaining,
recertifying, expanding, and reducing
the scope of certification, and
suspending or withdrawing certification
in accordance with current ISO/IEC
17024:2012(E) (incorporated by
reference, see § 170.2). At any given
point in time, there will be only one
CAICO for the DoD CMMC Program.

(b) Requirements. The CAICO shall:
(1) Comply with the Accreditation

Body policies for Conflict of Interest,
Code of Professional Conduct, and
Ethics set forth in § 170.8(b)(17); and
achieve and maintain ISO/IEC 17024(E)
accreditation within 12 months of
December 16, 2024.

(2) Provide all documentation and

records in English.

(3) Train, test, and designate PIs in

accordance with the requirements of
this section. Train, test, certify, and
recertify CCPs, CCAs, and CCIs in
accordance with the requirements of
this section.

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00133

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83224

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

(4) Ensure the instructor and assessor

certification examinations are certified
under ISO/IEC 17024:2012(E)
(incorporated by reference, see § 170.2),
by a recognized US-based accreditor
who is not a member of the CMMC
Accreditation Body. The US-based
accreditor must be a signatory to
International Laboratory Accreditation
Cooperation (ILAC) or relevant
International Accreditation Forum (IAF)
Mutual Recognition Arrangement
(MRA) and must operate in accordance
with ISO/IEC 17011:2017(E)
(incorporated by reference, see § 170.2).

(5) Establish quality control policies

and procedures for the generation of
training products, instruction, and
testing materials.

(6) Oversee development,

administration, and management
pertaining to the quality of training and
examination materials for CMMC
assessor and instructor certification and
recertification.

(7) Establish and publish an

authorization and certification appeals
process to receive, evaluate, and make
decisions on complaints and appeals in
accordance with ISO/IEC 17024:2012(E)
(incorporated by reference, see § 170.2).

(8) Address all appeals arising from

the CCA, CCI, and CCP authorizations
and certifications process through use of
internal processes in accordance with
ISO/IEC 17024:2012(E) (incorporated by
reference, see § 170.2).

(9) Maintain records for a period of

six (6) years of all procedures,
processes, and actions related to
fulfillment of the requirements set forth
in this section and provide the
Accreditation Body access to those
records.

(10) Provide the Accreditation Body

information about the authorization and
accreditation status of assessors,
instructors, training community, and
publishing partners.

(11) Ensure separation of duties

between individuals involved in testing
activities, training activities, and
certification activities.

(12) Safeguard and require any CAICO

training support service providers, as
applicable, to safeguard the
confidentiality of applicant, candidate,
and certificate-holder information and
ensure the overall security of the
certification process.

(13) Ensure that all PII is encrypted

and protected in all CAICO information
systems and databases and those of any
CAICO training support service
providers.

(14) Ensure the security of assessor

and instructor examinations and the fair
and credible administration of
examinations.

(15) Neither disclose nor allow any

CAICO training support service
providers, as applicable, to disclose
CMMC data or metrics related to
authorization or certification activities
to any entity other than the
Accreditation Body and DoD, except as
required by law.

(16) Require retraining and

redesignation of PIs upon significant
change to DoD’s CMMC Program
requirements. Require retraining and
recertification of CCPs, CCAs, and CCIs
upon significant change to DoD’s CMMC
Program requirements, as determined by
the DoD or the CAICO.

(17) Require CMMC Ecosystem

members to report to the CAICO within
30 days of convictions, guilty pleas, or
no contest pleas to crimes of fraud,
larceny, embezzlement,
misappropriation of funds,
misrepresentation, perjury, false
swearing, conspiracy to conceal, or a
similar offense in any legal proceeding,
civil or criminal, whether or not in
connection with activities that relate to
carrying out their role in the CMMC
Ecosystem.

§ 170.11

CMMC Certified Assessor (CCA).

(a) Roles and responsibilities. CCAs,

in support of a C3PAO, conduct Level
2 certification assessments of OSCs in
accordance with NIST SP 800–171A
Jun2018 (incorporated by reference, see
§ 170.2), the assessment processes
defined in § 170.17, and the scoping
requirements defined in § 170.19(c).
CCAs must meet all of the requirements
set forth in paragraph (b) of this section.
A CCA may conduct Level 2
certification assessments and participate
on a C3PAO Assessment Team.

(b) Requirements. CCAs shall:
(1) Obtain and maintain certification

from the CAICO in accordance with the
requirements set forth in § 170.10.
Certification is valid for 3 years from the
date of issuance.

(2) Comply with the Accreditation

Body policies for Conflict of Interest,
Code of Professional Conduct, and
Ethics set forth in § 170.8(b)(17).

(3) Complete a Tier 3 background

investigation resulting in a
determination of national security
eligibility. This Tier 3 background
investigation will not result in a security
clearance and is not being executed for
the purpose of government employment.
The Tier 3 background investigation is
initiated using the Standard Form (SF)
[http://www.gsa.gov/reference/forms/questionnaire-for-national-security-positions 86 (www.gsa.gov/reference/forms/
questionnaire-for-national-security-
positions). These positions are
]designated as non-critical sensitive with
a risk designation of ‘‘Moderate Risk’’ in
accordance with 5 CFR 1400.201(b) and

(d) and the investigative requirements of
5 CFR 731.106(c)(2).

(4) Meet the equivalent of a favorably

adjudicated Tier 3 background
investigation when not eligible for a
Tier 3 background investigation. DoD
will determine the Tier 3 background
investigation equivalence for use with
the CMMC Program only.

(5) Provide all documentation and

records in English.

(6) Be a CCP who has at least 3 years

of cybersecurity experience, at least 1
year of assessment or audit experience,
and at least one foundational
qualification, aligned to at least the
Intermediate Proficiency Level of the
DoD Cyberspace Workforce
Framework’s Security Control Assessor
(612) Work Role, from DoD Manual
8140.03, Cyberspace Workforce
Qualification and Management Program
[https://dodcio.defense.gov/Portals/0/Documents/Library/DoDM-8140-03.pdf (https://dodcio.defense.gov/Portals/0/
Documents/Library/DoDM-8140-03.pdf).
]Information on the Work Role 612 can
[https://public.cyber.mil/dcwf-work-role/security-control-assessor/ be found at https://public.cyber.mil/
dcwf-work-role/security-control-
assessor/. ]

(7) Only use IT, cloud, cybersecurity

services, and end-point devices
provided by the authorized/accredited
C3PAO that has been engaged to
perform that OSA’s Level 2 certification
assessment and which has undergone a
Level 2 certification assessment by
DCMA DIBCAC (or higher) for all
assessment activities. Individual
assessors are prohibited from using any
other IT, including IT that is personally
owned, to include internal and external
cloud services and end-point devices, to
process, store, or transmit CMMC
assessment reports or any other CMMC
assessment-related information. The
evaluation of assessment evidence
within the OSC environment, using OSC
tools, is permitted.

(8) Immediately notify the responsible

C3PAO of any breach or potential
breach of security to any CMMC-related
assessment materials under the
assessors’ purview.

(9) Not share any information about

an OSC obtained during CMMC pre-
assessment and assessment activities
with any person not involved with that
specific assessment, except as otherwise
required by law.

(10) Qualify as a Lead CCA by having

at least 5 years of cybersecurity
experience, 5 years of management
experience, 3 years of assessment or
audit experience, and at least one
foundational qualification aligned to
Advanced Proficiency Level of the DoD
Cyberspace Workforce Framework’s
Security Control Assessor (612) Work
Role, from DoD Manual 8140.03,
Cyberspace Workforce Qualification and

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00134

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83225

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

Management Program [https://dodcio.defense.gov/Portals/0/Documents/Library/DoDM-8140-03.pdf (https://
 dodcio.defense.gov/Portals/0/
Documents/Library/DoDM-8140-03.pdf).
]Information on the Work Role 612 can
[https://public.cyber.mil/dcwf-work-role/security-control-assessor/ be found at https://public.cyber.mil/
dcwf-work-role/security-control-
assessor/. ]

§ 170.12

CMMC Instructor.

(a) CMMC Provisional Instructor (PI)

roles and responsibilities. A CMMC
Provisional Instructor (PI) teaches CCA
and CCP candidates during the
transitional period that ends 18 months
after December 16, 2024. A PI is trained,
tested, and designated to perform
CMMC instructional duties by the
CAICO to teach CCP and CCA
candidates. PIs are designated by the
CAICO after successful completion of
the PI training and testing requirements
set forth by the CAICO. A PI with a
valid CCP certification may instruct CCP
candidates, while a PI with a valid CCA
certification may instruct CCP and CCA
candidates. PIs are required to meet
requirements in (c) of this section.

(b) CMMC Certified Instructor (CCI)

roles and responsibilities. A CMMC
Certified Instructor (CCI) teaches CCP,
CCA, and CCI candidates and performs
CMMC instructional duties. Candidate
CCIs are certified by the CAICO after
successful completion of the CCI
training and testing requirements. A CCI
is required to obtain and maintain
assessor and instructor certifications
from the CAICO in accordance with the
requirements set forth in § 170.10 and in
paragraph (c) of this section. A CCI with
a valid CCP certification may instruct
CCP candidates, while a CCI with a
valid CCA certification may instruct
CCP, CCA, and CCI candidates.
Certifications are valid for 3 years from
the date of issuance. CCIs are required
to meet requirements in paragraph (c) of
this section.

(c) Requirements. CMMC Instructors

shall:

(1) Obtain and maintain instructor

designation or certification, as
appropriate, from the CAICO in
accordance with the requirements set
forth in § 170.10.

(2) Obtain and maintain CCP or CCA

certification to deliver CCP training.

(3) Obtain and maintain a CCA

certification to deliver CCA training.

(4) Comply with the Accreditation

Body policies for Conflict of Interest,
Code of Professional Conduct, and
Ethics set forth in § 170.8(b)(17).

(5) Provide all documentation and

records in English.

(6) Provide the Accreditation Body

and the CAICO annually with accurate
information detailing their
qualifications, training experience,

professional affiliations, and
certifications, and, upon reasonable
request, submit documentation verifying
this information.

(7) Not provide CMMC consulting

services while serving as a CMMC
instructor; however, subject to the Code
of Professional Conduct and Conflict of
Interest policies, can serve on an
assessment team.

(8) Not participate in the development

of exam objectives and/or exam content
or act as an exam proctor while at the
same time serving as a CCI.

(9) Keep confidential all information

obtained or created during the
performance of CMMC training
activities, including trainee records,
except as required by law.

(10) Not disclose any CMMC-related

data or metrics that is PII, FCI, or CUI
to anyone without prior coordination
with and approval from DoD.

(11) Notify the Accreditation Body or

the CAICO if required by law or
authorized by contractual commitments
to release confidential information.

(12) Not share with anyone any

CMMC training-related information not
previously publicly disclosed.

§ 170.13

CMMC Certified Professional

(CCP).

(a) Roles and responsibilities. A

CMMC Certified Professional (CCP)
completes rigorous training on CMMC
and the assessment process to provide
advice, consulting, and
recommendations to their OSA clients.
Candidate CCPs are certified by the
CAICO after successful completion of
the CCP training and testing
requirements set forth in paragraph (b)
of this section. CCPs are eligible to
become CMMC Certified Assessors and
can participate as a CCP on Level 2
certification assessments with CCA
oversight where the CCA makes all final
determinations.

(b) Requirements. CCPs shall:
(1) Obtain and maintain certification

from the CAICO in accordance with the
requirements set forth in § 170.10.
Certification is valid for 3 years from the
date of issuance.

(2) Comply with the Accreditation

Body policies for Conflict of Interest,
Code of Professional Conduct, and
Ethics as set forth in § 170.8(b)(17).

(3) Complete a Tier 3 background

investigation resulting in a
determination of national security
eligibility. This Tier 3 background
investigation will not result in a security
clearance and is not being executed for
the purpose of government employment.
The Tier 3 background investigation is
initiated using the Standard Form (SF)
86 (www.gsa.gov/reference/forms/

[http://www.gsa.gov/reference/forms/questionnaire-for-national-security-positions questionnaire-for-national-security-
positions). These positions are
]designated as non-critical sensitive with
a risk designation of ‘‘Moderate Risk’’ in
accordance with 5 CFR 1400.201(b) and
(d) and the investigative requirements of
5 CFR 731.106(c)(2).

(4) Meet the equivalent of a favorably

adjudicated Tier 3 background
investigation when not eligible to obtain
a Tier 3 background investigation. DoD
will determine the Tier 3 background
investigation equivalence for use with
the CMMC Program only.

(5) Provide all documentation and

records in English.

(6) Not share any information about

an OSC obtained during CMMC pre-
assessment and assessment activities
with any person not involved with that
specific assessment, except as otherwise
required by law.

Subpart D—Key Elements of the
CMMC Program

§ 170.14

CMMC Model.

(a) Overview. The CMMC Model

incorporates the security requirements
from:

(1) 48 CFR 52.204–21, Basic

Safeguarding of Covered Contractor
Information Systems;

(2) NIST SP 800–171 R2, Protecting

Controlled Unclassified Information in
Nonfederal Systems and Organizations
(incorporated by reference, see § 170.2);
and

(3) Selected security requirements

from NIST SP 800–172 Feb2021,
Enhanced Security Requirements for
Protecting Controlled Unclassified
Information: A Supplement to NIST
Special Publication 800–171
(incorporated by reference, see § 170.2).

(b) CMMC domains. The CMMC

Model consists of domains that map to
the Security Requirement Families
defined in NIST SP 800–171 R2
(incorporated by reference, see § 170.2).

(c) CMMC level requirements. CMMC

Levels 1–3 utilize the safeguarding
requirements and security requirements
specified in 48 CFR 52.204–21 (for Level
1), NIST SP 800–171 R2 (incorporated
by reference, see § 170.2) (for Level 2),
and selected security requirements from
NIST SP 800–172 Feb2021
(incorporated by reference, see § 170.2)
(for Level 3). This paragraph discusses
the numbering scheme and the security
requirements for each level.

(1) Numbering. Each security

requirement has an identification
number in the format—DD.L#-REQ—
where:

(i) DD is the two-letter domain

abbreviation;

(ii) L# is the CMMC level number; and

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00135

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83226

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

(iii) REQ is the 48 CFR 52.204–21

paragraph number, NIST SP 800–171 R2
requirement number, or NIST SP 800–
172 Feb2021 requirement number.

(2) CMMC Level 1 security

requirements. The security requirements
in CMMC Level 1 are those set forth in
48 CFR 52.204–21(b)(1)(i) through (xv).

(3) CMMC Level 2 security

requirements. The security requirements
in CMMC Level 2 are identical to the
requirements in NIST SP 800–171 R2.

(4) CMMC Level 3 security

requirements. The security requirements
in CMMC Level 3 are selected from
NIST SP 800–172 Feb2021, and where

applicable, Organization-Defined
Parameters (ODPs) are assigned. Table 1
to this paragraph identifies the selected
requirements and applicable ODPs that
represent the CMMC Level 3 security
requirements. ODPs for the NIST SP
800–172 Feb2021 requirements are
italicized, where applicable:

TABLE 1 TO § 170.14(c)(4)

Security requirement No.*

CMMC Level 3 security requirements

(selected NIST SP 800–172 Feb2021 security requirement with DoD ODPs italicized)

(i) AC.L3–3.1.2e .......................

Restrict access to systems and system components to only those information resources that are owned,

provisioned, or issued by the organization.

(ii) AC.L3–3.1.3e ......................

Employ secure information transfer solutions to control information flows between security domains on con-

nected systems.

(iii) AT.L3–3.2.1e .....................

Provide awareness training upon initial hire, following a significant cyber event, and at least annually, focused

on recognizing and responding to threats from social engineering, advanced persistent threat actors,
breaches, and suspicious behaviors; update the training at least annually or when there are significant
changes to the threat.

(iv) AT.L3–3.2.2e .....................

Include practical exercises in awareness training for all users, tailored by roles, to include general users, users

with specialized roles, and privileged users, that are aligned with current threat scenarios and provide feed-
back to individuals involved in the training and their supervisors.

(v) CM.L3–3.4.1e .....................

Establish and maintain an authoritative source and repository to provide a trusted source and accountability for

approved and implemented system components.

(vi) CM.L3–3.4.2e ....................

Employ automated mechanisms to detect misconfigured or unauthorized system components; after detection,

remove the components or place the components in a quarantine or remediation network to facilitate
patching, re-configuration, or other mitigations.

(vii) CM.L3–3.4.3e ...................

Employ automated discovery and management tools to maintain an up-to-date, complete, accurate, and readily

available inventory of system components.

(viii) IA.L3–3.5.1e .....................

Identify and authenticate systems and system components, where possible, before establishing a network con-

nection using bidirectional authentication that is cryptographically based and replay resistant.

(ix) IA.L3–3.5.3e ......................

Employ automated or manual/procedural mechanisms to prohibit system components from connecting to orga-

nizational systems unless the components are known, authenticated, in a properly configured state, or in a
trust profile.

(x) IR.L3–3.6.1e .......................

Establish and maintain a security operations center capability that operates 24/7, with allowance for remote/on-

call staff.

(xi) IR.L3–3.6.2e ......................

Establish and maintain a cyber-incident response team that can be deployed by the organization within 24

hours.

(xii) PS.L3–3.9.2e ....................

Ensure that organizational systems are protected if adverse information develops or is obtained about individ-

uals with access to CUI.

(xiii) RA.L3–3.11.1e .................

Employ threat intelligence, at a minimum from open or commercial sources, and any DoD-provided sources, as

part of a risk assessment to guide and inform the development of organizational systems, security architec-
tures, selection of security solutions, monitoring, threat hunting, and response and recovery activities.

(xiv) RA.L3–3.11.2e .................

Conduct cyber threat hunting activities on an on-going aperiodic basis or when indications warrant, to search

for indicators of compromise in organizational systems and detect, track, and disrupt threats that evade exist-
ing controls.

(xv) RA.L3–3.11.3e ..................

Employ advanced automation and analytics capabilities in support of analysts to predict and identify risks to or-

ganizations, systems, and system components.

(xvi) RA.L3–3.11.4e .................

Document or reference in the system security plan the security solution selected, the rationale for the security

solution, and the risk determination.

(xvii) RA.L3–3.11.5e ................

Assess the effectiveness of security solutions at least annually or upon receipt of relevant cyber threat informa-

tion, or in response to a relevant cyber incident, to address anticipated risk to organizational systems and the
organization based on current and accumulated threat intelligence.

(xviii) RA.L3–3.11.6e ...............

Assess, respond to, and monitor supply chain risks associated with organizational systems and system compo-

nents.

(xix) RA.L3–3.11.7e .................

Develop a plan for managing supply chain risks associated with organizational systems and system compo-

nents; update the plan at least annually, and upon receipt of relevant cyber threat information, or in response
to a relevant cyber incident.

(xx) CA.L3–3.12.1e ..................

Conduct penetration testing at least annually or when significant security changes are made to the system,

leveraging automated scanning tools and ad hoc tests using subject matter experts.

(xxi) SC.L3–3.13.4e .................

Employ physical isolation techniques or logical isolation techniques or both in organizational systems and sys-

tem components.

(xxii) SI.L3–3.14.1e ..................

Verify the integrity of security critical and essential software using root of trust mechanisms or cryptographic

signatures.

(xxiii) SI.L3–3.14.3e .................

Ensure that specialized assets including IoT, IIoT, OT, GFE, Restricted Information Systems, and test equip-

ment are included in the scope of the specified enhanced security requirements or are segregated in pur-
pose-specific networks.

(xxiv) SI.L3–3.14.6e .................

Use threat indicator information and effective mitigations obtained from, at a minimum, open or commercial

sources, and any DoD-provided sources, to guide and inform intrusion detection and threat hunting.

  • Roman numerals in parentheses before the Security Requirement are for numbering purposes only. The numerals are not part of the naming

convention for the requirement.

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00136

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83227

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

(d) Implementation. Assessment of

security requirements is prescribed by
NIST SP 800–171A Jun2018
(incorporated by reference, see § 170.2)
and NIST SP 800–172A Mar2022
(incorporated by reference, see § 170.2).
Descriptive text in these documents
support OSA implementation of the
security requirements and use the terms
organization-defined and periodically.
Except where referring to Organization-
Defined Parameters (ODPs),
organization-defined means as
determined by the OSA. Periodically
means occurring at regular intervals. As
used in many requirements within
CMMC, the interval length is
organization-defined to provided
contractor flexibility, with an interval
length of no more than one year.

§ 170.15

CMMC Level 1 self-assessment

and affirmation requirements.

(a) Level 1 self-assessment. To comply

with CMMC Level 1 self-assessment
requirements, the OSA must meet the
requirements detailed in paragraphs
(a)(1) and (2) of this section. An OSA
conducts a Level 1 self-assessment as
detailed in paragraph (c) of this section
to achieve a CMMC Status of Final Level
1 (Self).

(1) Level 1 self-assessment

requirements. The OSA must complete

and achieve a MET result for all security
requirements specified in § 170.14(c)(2)
to achieve the CMMC Status of Final
Level 1 (Self). No POA&Ms are
permitted for CMMC Level 1. The OSA
must conduct a self-assessment in
accordance with the procedures set
forth in § 170.15(c)(1) and submit
assessment results in SPRS. To maintain
compliance with the requirements for
the CMMC Status of Final Level 1 (Self),
the OSA must conduct a Level 1 self-
assessment on an annual basis and
submit the results in SPRS, or its
successor capability.

(i) Inputs to SPRS. The Level 1 self-

assessment results in the Supplier
Performance Risk System (SPRS) shall
include, at minimum, the following
items:

(A) CMMC Level.
(B) CMMC Status Date.
(C) CMMC Assessment Scope.
(D) All industry CAGE code(s)

associated with the information
system(s) addressed by the CMMC
Assessment Scope.

(E) Compliance result.
(ii) [Reserved]
(2) Affirmation. Affirmation of the

Level 1 (Self) CMMC Status is required
for all Level 1 self-assessments.
Affirmation procedures are set forth in
§ 170.22.

(b) Contract eligibility. Prior to award

of any contract or subcontract with a
requirement for the CMMC Status of
Level 1 (Self), OSAs must both achieve
a CMMC Status of Level 1 (Self) and
have submitted an affirmation of
compliance into SPRS for all
information systems within the CMMC
Assessment Scope.

(c) Procedures—(1) Level 1 self-

assessment. The OSA must conduct a
Level 1 self-assessment scored in
accordance with the CMMC Scoring
Methodology described in § 170.24. The
Level 1 self-assessment must be
performed in accordance with the
CMMC Level 1 scope requirements set
forth in § 170.19(a) and (b) and the
following:

(i) The Level 1 self-assessment must

be performed using the objectives
defined in NIST SP 800–171A Jun2018
(incorporated by reference, see § 170.2)
for the security requirement that maps
to the CMMC Level 1 security
requirement as specified in table 1 to
paragraph (c)(1)(ii) of this section. In
any case where an objective addresses
CUI, FCI should be substituted for CUI
in the objective.

(ii) Mapping table for CMMC Level 1

security requirements to the NIST SP
800–171A Jun2018 objectives.

TABLE 2 TO § 170.15(c)(1)(ii)—CMMC LEVEL 1 SECURITY REQUIREMENTS MAPPED TO NIST SP 800–171A JUN2018

CMMC Level 1 security requirements as set forth in § 170.14(c)(2)

NIST SP 800–171A Jun2018

AC.L1–b.1.i ..................................................................................................................................................................

3.1.1

AC.L1–b.1.ii .................................................................................................................................................................

3.1.2

AC.L1–b.1.iii .................................................................................................................................................................

3.1.20

AC.L1–b.1.iv ................................................................................................................................................................

3.1.22

IA.L1–b.1.v ...................................................................................................................................................................

3.5.1

IA.L1–b.1.vi ..................................................................................................................................................................

3.5.2

MP.L1–b.1.vii ...............................................................................................................................................................

3.8.3

PE.L1–b.1.viii ...............................................................................................................................................................

3.10.1

First phrase of PE.L1–b.1.ix (FAR b.1.ix *) .................................................................................................................

3.10.3

Second phrase of PE.L1–b.1.ix (FAR b.1.ix *) ............................................................................................................

3.10.4

Third phrase of PE.L1–b.1.ix (FAR b.1.ix *) ................................................................................................................

3.10.5

SC.L1–b.1.x .................................................................................................................................................................

3.13.1

SC.L1–b.1.xi ................................................................................................................................................................

3.13.5

SI.L1–b.1.xii .................................................................................................................................................................

3.14.1

SI.L1–b.1.xiii ................................................................................................................................................................

3.14.2

SI.L1–b.1.xiv ................................................................................................................................................................

3.14.4

SI.L1–b.1.xv .................................................................................................................................................................

3.14.5

  • Three of the 48 CFR 52.204–21 requirements were broken apart by ‘‘phrase’’ when NIST SP 800–171 R2 was developed.

(iii) Additional guidance can be found

in the guidance document listed in
paragraph (b) of appendix A to this part.

(2) Artifact retention. The artifacts

used as evidence for the assessment
must be retained by the OSA for six (6)
years from the CMMC Status Date.

§ 170.16

CMMC Level 2 self-assessment

and affirmation requirements.

(a) Level 2 self-assessment. To comply

with Level 2 self-assessment

requirements, the OSA must meet the
requirements detailed in paragraphs
(a)(1) and (2) of this section. An OSA
conducts a Level 2 self-assessment as
detailed in paragraph (c) of this section
to achieve a CMMC Status of either
Conditional or Final Level 2 (Self).
Achieving a CMMC Status of Level 2
(Self) also satisfies the requirements for
a CMMC Status of Level 1 (Self) detailed

in § 170.15 for the same CMMC
Assessment Scope.

(1) Level 2 self-assessment

requirements. The OSA must complete
and achieve a MET result for all security
requirements specified in § 170.14(c)(3)
to achieve the CMMC Status of Level 2
(Self). The OSA must conduct a self-
assessment in accordance with the
procedures set forth in paragraph (c)(1)
of this section and submit assessment

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00137

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83228

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

results in Supplier Performance Risk
System (SPRS). To maintain compliance
with the requirements for a CMMC
Status of Level 2 (Self), the OSA must
conduct a Level 2 self-assessment every
three years and submit the results in
SPRS, within three years of the CMMC
Status Date associated with the
Conditional Level 2 (Self).

(i) Inputs to SPRS. The Level 2 self-

assessment results in the SPRS shall
include, at minimum, the following
information:

(A) CMMC Level.
(B) CMMC Status Date.
(C) CMMC Assessment Scope.
(D) All industry CAGE code(s)

associated with the information
system(s) addressed by the CMMC
Assessment Scope.

(E) Overall Level 2 self-assessment

score (e.g., 105 out of 110).

(F) POA&M usage and compliance

status, if applicable.

(ii) Conditional Level 2 (Self). The

OSA has achieved the CMMC Status of
Conditional Level 2 (Self) if the Level 2
self-assessment results in a POA&M and
the POA&M meets all the CMMC Level
2 POA&M requirements listed in
§ 170.21(a)(2).

(A) Plan of Action and Milestones. A

Level 2 POA&M is allowed only in
accordance with the CMMC POA&M
requirements listed in § 170.21.

(B) POA&M closeout. The OSA must

remediate any NOT MET requirements,
must perform a POA&M closeout self-
assessment, and must post compliance
results to SPRS within 180 days of the
CMMC Status Date associated with the
Conditional Level 2 (Self). If the
POA&M is not successfully closed out
within the 180-day timeframe, the
Conditional Level 2 (Self) CMMC Status
for the information system will expire.
If Conditional Level 2 (Self) CMMC
Status expires within the period of
performance of a contract, standard
contractual remedies will apply, and the
OSA will be ineligible for additional
awards with a requirement for the
CMMC Status of Level 2 (Self), or higher
requirement, for the information system
within the CMMC Assessment Scope
until such time as a new CMMC Status
is achieved.

(iii) Final Level 2 (Self). The OSA has

achieved the CMMC Status of Final
Level 2 (Self) if the Level 2 self-
assessment results in a passing score as
defined in § 170.24. This score may be
achieved upon initial self-assessment or
as the result of a POA&M closeout self-
assessment, as applicable.

(iv) CMMC Status investigation. The

DoD reserves the right to conduct a
DCMA DIBCAC assessment of the OSA,
as provided for under the 48 CFR

252.204–7020. If the investigative
results of a subsequent DCMA DIBCAC
assessment show that adherence to the
provisions of this part have not been
achieved or maintained, these DCMA
DIBCAC results will take precedence
over any pre-existing CMMC Status. At
that time, standard contractual remedies
will be available and the OSA will be
ineligible for additional awards with
CMMC Status requirement of Level 2
(Self), or higher requirement, for the
information system within the CMMC
Assessment Scope until such time as a
new CMMC Status is achieved.

(2) Affirmation. Affirmation of the

Level 2 (Self) CMMC Status is required
for all Level 2 self-assessments at the
time of each assessment, and annually
thereafter. Affirmation procedures are
set forth in § 170.22.

(b) Contract eligibility. Prior to award

of any contract or subcontract with
requirement for CMMC Status of Level
2 (Self), the following two requirements
must be met:

(1) The OSA must achieve, as

specified in paragraph (a)(1) of this
section, a CMMC Status of either
Conditional Level 2 (Self) or Final Level
2 (Self).

(2) The OSA must submit an

affirmation of compliance into SPRS, as
specified in paragraph (a)(2) of this
section.

(c) Procedures—(1) Level 2 self-

assessment of the OSA. The OSA must
conduct a Level 2 self-assessment in
accordance with NIST SP 800–171A
Jun2018 (incorporated by reference, see
§ 170.2) and the CMMC Level 2 scoping
requirements set forth in §§ 170.19(a)
and (c) for the information systems
within the CMMC Assessment Scope.
The Level 2 self-assessment must be
scored in accordance with the CMMC
Scoring Methodology described in
§ 170.24 and the OSA must upload the
results into SPRS. If a POA&M exists, a
POA&M closeout self-assessment must
be performed by the OSA when all NOT
MET requirements have been
remediated. The POA&M closeout self-
assessment must be performed within
180-days of the Conditional CMMC
Status Date. Additional guidance can be
found in the guidance document listed
in paragraph (c) of appendix A to this
part.

(2) Level 2 self-assessment with the

use of Cloud Service Provider (CSP). An
OSA may use a cloud environment to
process, store, or transmit CUI in
performance of a contract or subcontract
with a requirement for the CMMC Status
of Level 2 (Self) under the following
circumstances:

(i) The CSP product or service offering

is FedRAMP Authorized at the

FedRAMP Moderate (or higher) baseline
in accordance with the FedRAMP
Marketplace; or

(ii) The CSP product or service

offering is not FedRAMP Authorized at
the FedRAMP Moderate (or higher)
baseline but meets security
requirements equivalent to those
established by the FedRAMP Moderate
(or higher) baseline. FedRAMP
Moderate or FedRAMP Moderate
equivalent is in accordance with DoD
Policy.

(iii) In accordance with § 170.19(c)(2),

the OSA’s on-premises infrastructure
connecting to the CSP’s product or
service offering is part of the CMMC
Assessment Scope, which will also be
assessed. As such, the security
requirements from the Customer
Responsibility Matrix (CRM) must be
documented or referred to in the OSA’s
System Security Plan (SSP).

(3) Level 2 self-assessment with the

use of an External Service Provider
(ESP), not a CSP. An OSA may use an
ESP that is not a CSP to process, store,
or transmit CUI in performance of a
contract or subcontract with a
requirement for the CMMC Status of
Level 2 (Self) under the following
circumstances:

(i) The use of the ESP, its relationship

to the OSA, and the services provided
are documented in the OSA’s SSP and
described in the ESP’s service
description and CRM.

(ii) The ESP services used to meet

OSA requirements are assessed within
the scope of the OSA’s assessment
against all Level 2 security
requirements.

(iii) In accordance with § 170.19(c)(2),

the OSA’s on-premises infrastructure
connecting to the ESP’s product or
service offering is part of the CMMC
Assessment Scope, which will also be
assessed. As such, the security
requirements from the CRM must be
documented or referred to in the OSA’s
SSP.

(4) Artifact retention. The artifacts

used as evidence for the assessment
must be retained by the OSA for six (6)
years from the CMMC Status Date.

§ 170.17

CMMC Level 2 certification

assessment and affirmation requirements.

(a) Level 2 certification assessment.

To comply with Level 2 certification
assessment requirements, the OSC must
meet the requirements set forth in
paragraphs (a)(1) and (2) of this section.
An OSC undergoes a Level 2
certification assessment as detailed in
paragraph (c) of this section to achieve
a CMMC Status of either Conditional or
Final Level 2 (C3PAO). Achieving a
CMMC Status of Level 2 (C3PAO) also

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00138

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83229

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

satisfies the requirements for a CMMC
Statuses of Level 1 (Self) and Level 2
(Self) set forth in §§ 170.15 and 170.16
respectively for the same CMMC
Assessment Scope.

(1) Level 2 certification assessment

requirements. The OSC must complete
and achieve a MET result for all security
requirements specified in § 170.14(c)(3)
to achieve the CMMC Status of Level 2
(C3PAO). The OSC must obtain a Level
2 certification assessment from an
authorized or accredited C3PAO
following the procedures outlined in
paragraph (c) of this section. The
C3PAO must submit the Level 2
certification assessment results into the
CMMC instantiation of eMASS, which
then provides automated transmission
to SPRS. To maintain compliance with
the requirements for a CMMC Status of
Level 2 (C3PAO), the Level 2
certification assessment must be
completed within three years of the
CMMC Status Date associated with the
Conditional Level 2 (C3PAO).

(i) Inputs into the CMMC instantiation

of eMASS. The Level 2 certification
assessment results input into the CMMC
instantiation of eMASS shall include, at
minimum, the following information:

(A) Date and level of the assessment.
(B) C3PAO name.
(C) Assessment unique identifier.
(D) For each Assessor conducting the

assessment, name and business contact
information.

(E) All industry CAGE codes

associated with the information systems
addressed by the CMMC Assessment
Scope.

(F) The name, date, and version of the

SSP.

(G) CMMC Status Date.
(H) Assessment result for each

requirement objective.

(I) POA&M usage and compliance, as

applicable.

(J) List of the artifact names, the

return value of the hashing algorithm,
and the hashing algorithm used.

(ii) Conditional Level 2 (C3PAO). The

OSC has achieved the CMMC Status of
Conditional Level 2 (C3PAO) if the
Level 2 certification assessment results
in a POA&M and the POA&M meets all
CMMC Level 2 POA&M requirements
listed in § 170.21(a)(2).

(A) Plan of Action and Milestones. A

Level 2 POA&M is allowed only in
accordance with the CMMC POA&M
requirements listed in § 170.21.

(B) POA&M closeout. The OSC must

remediate any NOT MET requirements,
must undergo a POA&M closeout
certification assessment from a C3PAO,
and the C3PAO must post compliance
results into the CMMC instantiation of
eMASS within 180 days of the CMMC

Status Date associated with the
Conditional Level 2 (C3PAO). If the
POA&M is not successfully closed out
within the 180-day timeframe, the
Conditional Level 2 (C3PAO) CMMC
Status for the information system will
expire. If Conditional Level 2 (C3PAO)
CMMC Status expires within the period
of performance of a contract, standard
contractual remedies will apply, and the
OSC will be ineligible for additional
awards with a requirement for the
CMMC Status of Level 2 (C3PAO), or
higher requirement, for the information
system within the CMMC Assessment
Scope until such time as a new CMMC
Status is achieved.

(iii) Final Level 2 (C3PAO). The OSC

has achieved the CMMC Status of Final
Level 2 (C3PAO) if the Level 2
certification assessment results in a
passing score as defined in § 170.24.
This score may be achieved upon initial
certification assessment or as the result
of a POA&M closeout certification
assessment, as applicable.

(iv) CMMC Status investigation. The

DoD reserves the right to conduct a
DCMA DIBCAC assessment of the OSC,
as provided for under the 48 CFR
252.204–7020. If the investigative
results of a subsequent DCMA DIBCAC
assessment show that adherence to the
provisions of this part have not been
achieved or maintained, these DCMA
DIBCAC results will take precedence
over any pre-existing CMMC Status. At
that time, standard contractual remedies
will be available and the OSC will be
ineligible for additional awards with
CMMC Status requirement of Level 2
(C3PAO), or higher requirement, for the
information system within the CMMC
Assessment Scope until such time as a
new CMMC Status is achieved.

(2) Affirmation. Affirmation of the

Level 2 (C3PAO) CMMC Status is
required for all Level 2 certification
assessments at the time of each
assessment, and annually thereafter.
Affirmation procedures are provided in
§ 170.22.

(b) Contract eligibility. Prior to award

of any contract or subcontract with a
requirement for the CMMC Status of
Level 2 (C3PAO), the following two
requirements must be met:

(1) The OSC must achieve, as

specified in paragraph (a)(1) of this
section, a CMMC Status of either
Conditional Level 2 (C3PAO) or Final
Level 2 (C3PAO).

(2) The OSC must submit an

affirmation of compliance into SPRS, as
specified in paragraph (a)(2) of this
section.

(c) Procedures—(1) Level 2

certification assessment of the OSC. An
authorized or accredited C3PAO must

perform a Level 2 certification
assessment in accordance with NIST SP
800–171A Jun2018 (incorporated by
reference, see § 170.2) and the CMMC
Level 2 scoping requirements set forth
in § 170.19(a) and (c) for the information
systems within the CMMC Assessment
Scope. The Level 2 certification
assessment must be scored in
accordance with the CMMC Scoring
Methodology described in § 170.24 and
the C3PAO must upload the results into
the CMMC instantiation of eMASS.
Final results are communicated to the
OSC through a CMMC Assessment
Findings Report.

(2) Security requirement re-

evaluation. A security requirement that
is NOT MET (as defined in § 170.24)
may be re-evaluated during the course
of the Level 2 certification assessment
and for 10 business days following the
active assessment period if all of the
following conditions exist:

(i) Additional evidence is available to

demonstrate the security requirement
has been MET;

(ii) Cannot change or limit the

effectiveness of other requirements that
have been scored MET; and

(iii) The CMMC Assessment Findings

Report has not been delivered.

(3) POA&M. If a POA&M exists, a

POA&M closeout certification
assessment must be performed by a
C3PAO within 180-days of the
Conditional CMMC Status Date.
Additional guidance can be found in
§ 170.21 and in the guidance document
listed in paragraph (c) of appendix A to
this part.

(4) Artifact retention and integrity.

The hashed artifacts used as evidence
for the assessment must be retained by
the OSC for six (6) years from the
CMMC Status Date. To ensure that the
artifacts have not been altered, the OSC
must hash the artifact files using a
NIST-approved hashing algorithm. The
OSC must provide the C3PAO with a
list of the artifact names, the return
value of the hashing algorithm, and the
hashing algorithm for upload into the
CMMC instantiation of eMASS.
Additional guidance for hashing
artifacts can be found in the guidance
document listed in paragraph (h) of
appendix A to this part.

(5) Level 2 certification assessment

with the use of Cloud Service Provider
(CSP). An OSC may use a cloud
environment to process, store, or
transmit CUI in performance of a
contract or subcontract with a
requirement for the CMMC Status of
Level 2 (C3PAO) under the following
circumstances:

(i) The CSP product or service offering

is FedRAMP Authorized at the

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00139

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83230

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

FedRAMP Moderate (or higher) baseline
in accordance with the FedRAMP
Marketplace; or

(ii) The CSP product or service

offering is not FedRAMP Authorized at
the FedRAMP Moderate (or higher)
baseline but meets security
requirements equivalent to those
established by the FedRAMP Moderate
(or higher) baseline. FedRAMP
Moderate or FedRAMP Moderate
equivalent is in accordance with DoD
Policy.

(iii) In accordance with § 170.19(c)(2),

the OSC’s on-premises infrastructure
connecting to the CSP’s product or
service offering is part of the CMMC
Assessment Scope. As such, the security
requirements from the CRM must be
documented or referred to in the OSC’s
SSP.

(6) Level 2 certification assessment

with the use of an External Service
Provider (ESP), not a CSP. An OSA may
use an ESP that is not a CSP to process,
store, or transmit CUI in performance of
a contract or subcontract with a
requirement for the CMMC Status of
Level 2 (C3PAO) under the following
circumstances:

(i) The use of the ESP, its relationship

to the OSA, and the services provided
are documented in the OSA’s SSP and
described in the ESP’s service
description and customer responsibility
matrix.

(ii) The ESP services used to meet

OSA requirements are assessed within
the scope of the OSA’s assessment
against all Level 2 security
requirements.

(iii) In accordance with § 170.19(c)(2),

the OSA’s on-premises infrastructure
connecting to the ESP’s product or
service offering is part of the CMMC
Assessment Scope, which will also be
assessed. As such, the security
requirements from the CRM must be
documented or referred to in the OSA’s
SSP.

§ 170.18

CMMC Level 3 certification

assessment and affirmation requirements.

(a) Level 3 certification assessment.

To comply with Level 3 certification
assessment requirements, the OSC must
meet the requirements set forth in
paragraphs (a)(1) and (2) of this section.
An OSC undergoes a Level 3
certification assessment as detailed in
paragraph (c) of this section to achieve
a CMMC Status of either Conditional or
Final Level 3 (DIBCAC). A CMMC
Status of Final Level 2 (C3PAO) for
information systems within the Level 3
CMMC Assessment Scope is a
prerequisite to undergo a Level 3
certification assessment. CMMC Level 3
recertification also has a prerequisite for

a new CMMC Level 2 assessment.
Achieving a CMMC Status of Level 3
(DIBCAC) also satisfies the requirements
for CMMC Statuses of Level 1 (Self),
Level 2 (Self), and Level 2 (C3PAO) set
forth in §§ 170.15 through 170.17
respectively for the same CMMC
Assessment Scope.

(1) Level 3 certification assessment

requirements. The OSC must achieve a
CMMC Status of Final Level 2 (C3PAO)
on the Level 3 CMMC Assessment
Scope, as defined in § 170.19(d), prior to
initiating a Level 3 certification
assessment, which will be performed by
DCMA DIBCAC ([http://www.dcma.mil/DIBCAC www.dcma.mil/
DIBCAC) on behalf of the DoD. The OSC
]must complete and achieve a MET
result for all security requirements
specified in table 1 to § 170.14(c)(4) to
achieve the CMMC Status of Level 3
(DIBCAC). DCMA DIBCAC will submit
the Level 3 certification assessment
results into the CMMC instantiation of
eMASS, which then provides automated
transmission to SPRS. To maintain
compliance with the requirements for a
CMMC Status of Level 3 (DIBCAC), the
Level 3 certification assessment must be
performed every three years for all
information systems within the Level 3
CMMC Assessment Scope. In addition,
given that compliance with Level 2
requirements is a prerequisite for
applying for CMMC Level 3, a Level 2
(C3PAO) certification assessment must
also be conducted every three years to
maintain CMMC Level 3 (DIBCAC)
status. Level 3 certification assessment
must be completed within three years of
the CMMC Status Date associated with
the Final Level 3 (DIBCAC) or, if there
was a POA&M, then within three years
of the CMMC Status Date associated
with the Conditional Level 3 (DIBCAC).

(i) Inputs into the CMMC instantiation

of eMASS. The Level 3 certification
assessment results input into the CMMC
instantiation of eMASS shall include, at
minimum, the following items:

(A) Date and level of the assessment.
(B) For each Assessor(s) conducting

the assessment, name and government
organization information.

(C) All industry CAGE code(s)

associated with the information
system(s) addressed by the CMMC
Assessment Scope.

(D) The name, date, and version of the

system security plan(s) (SSP).

(E) CMMC Status Date.
(F) Result for each security

requirement objective.

(G) POA&M usage and compliance, as

applicable.

(H) List of the artifact names, the

return value of the hashing algorithm,
and the hashing algorithm used.

(ii) Conditional Level 3 (DIBCAC). The

OSC has achieved the CMMC Status of
Conditional Level 3 (DIBCAC) if the
Level 3 certification assessment results
in a POA&M and the POA&M meets all
CMMC Level 3 POA&M requirements
listed in § 170.21(a)(3).

(A) Plan of Action and Milestones. A

Level 3 POA&M is allowed only in
accordance with the CMMC POA&M
requirements listed in § 170.21.

(B) POA&M closeout. The OSC must

remediate any NOT MET requirements,
must undergo a POA&M closeout
certification assessment from DCMA
DIBCAC, and DCMA DIBCAC must post
compliance results into the CMMC
instantiation of eMASS within 180 days
of the CMMC Status Date associated
with the Conditional Level 3 (DIBCAC).
If the POA&M is not successfully closed
out within the 180-day timeframe, the
Conditional Level 3 (DIBAC) CMMC
Status for the information system will
expire. If Conditional Level 3 (DIBCAC)
CMMC Status expires within the period
of performance of a contract, standard
contractual remedies will apply, and the
OSC will be ineligible for additional
awards with a requirement for the
CMMC Status of Level 3 (DIBCAC) for
the information system within the
CMMC Assessment Scope until such
time as a new CMMC Status is achieved.

(iii) Final Level 3 (DIBCAC). The OSC

has achieved the CMMC Status of Final
Level 3 (DIBCAC) if the Level 3
certification assessment results in a
passing score as defined in § 170.24.
This score may be achieved upon initial
certification assessment or as the result
of a POA&M closeout certification
assessment, as applicable.

(iv) CMMC Status investigation. The

DoD reserves the right to conduct a
DCMA DIBCAC assessment of the OSC,
as provided for under the 48 CFR
252.204–7020. If the investigative
results of a subsequent DCMA DIBCAC
assessment show that adherence to the
provisions of this part have not been
achieved or maintained, these DCMA
DIBCAC results will take precedence
over any pre-existing CMMC Status. At
that time, standard contractual remedies
will be available and the OSC will be
ineligible for additional awards with
CMMC Status requirement of Level 3
(DIBCAC) for the information system
within the CMMC Assessment Scope
until such time as a new CMMC Status
is achieved.

(2) Affirmation. Affirmation of the

Level 3 (DIBCAC) CMMC Status is
required for all Level 3 certification
assessments at the time of each
assessment, and annually thereafter.
Affirmation procedures are provided in
§ 170.22.

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00140

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83231

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

(b) Contract eligibility. Prior to award

of any contract or subcontract with
requirement for CMMC Status of Level
3 (DIBCAC), the following two
requirements must be met:

(1) The OSC must achieve, as

specified in paragraph (a)(1) of this
section, a CMMC Status of either
Conditional Level 3 (DIBCAC) or Final
Level 3 (DIBCAC).

(2) The OSC must submit an

affirmation of compliance into SPRS, as
specified in paragraph (a)(2) of this
section.

(c) Procedures—(1) Level 3

certification assessment of the OSC. The
CMMC Level 3 certification assessment
process includes:

(i) Final Level 2 (C3PAO). The OSC

must achieve a CMMC Status of Final
Level 2 (C3PAO) for information
systems within the Level 3 CMMC
Assessment Scope prior to the CMMC
Level 3 certification assessment. The
CMMC Assessment Scope for the Level
3 certification assessment must be equal
to, or a subset of, the CMMC Assessment
Scope associated with the OSC’s Final
Level 2 (C3PAO). Asset requirements
differ for each CMMC Level. Scoping
differences are set forth in § 170.19.

(ii) Initiating the Final Level 3

(DIBCAC). The OSC (including ESPs
that voluntarily elect to undergo a Level
3 certification assessment) initiates a
Level 3 certification assessment by
emailing a request to DCMA DIBCAC
point of contact found at
[http://www.dcma.mil/DIBCAC www.dcma.mil/DIBCAC. The request
]must include the Level 2 certification
assessment unique identifier. DCMA
DIBCAC will validate the OSC has
achieved a CMMC Status of Level 2
(C3PAO) and will contact the OSC to
schedule their Level 3 certification
assessment.

(iii) Conducting the Final Level 3

(DIBCAC). DCMA DIBCAC will perform
a Level 3 certification assessment in
accordance with NIST SP 800–171A
Jun2018 (incorporated by reference, see
§ 170.2) and NIST SP 800–172A
Mar2022 (incorporated by reference, see
§ 170.2) and the CMMC Level 3 scoping
requirements set forth in § 170.19(d) for
the information systems within the
CMMC Assessment Scope. The Level 3
certification assessment will be scored
in accordance with the CMMC Scoring
Methodology set forth in § 170.24 and
DCMA DIBCAC will upload the results
into the CMMC instantiation of eMASS.
Final results are communicated to the
OSC through a CMMC Assessment
Findings Report. For assets that changed
asset category (i.e., CRMA to CUI Asset)
or assessment requirements (i.e.,
Specialized Assets) between the Level 2
and Level 3 certification assessments,

DCMA DIBCAC will perform limited
checks of Level 2 security requirements.
If the OSC had these upgraded asset
categories included in their Level 2
certification assessment, then DCMA
DIBCAC may still perform limited
checks for compliance. If DCMA
DIBCAC identifies that a Level 2
security requirement is NOT MET, the
Level 3 assessment process may be
paused to allow for remediation, placed
on hold, or immediately terminated.

(2) Security requirement re-

evaluation. A security requirement that
is NOT MET (as defined in § 170.24)
may be re-evaluated during the course
of the Level 3 certification assessment
and for 10 business days following the
active assessment period if all of the
following conditions exist:

(i) Additional evidence is available to

demonstrate the security requirement
has been MET;

(ii) The additional evidence does not

materially impact previously assessed
security requirements; and

(iii) The CMMC Assessment Findings

Report has not been delivered.

(3) POA&M. If a POA&M exists, a

POA&M closeout certification
assessment will be performed by DCMA
DIBCAC within 180-days of the
Conditional CMMC Status Date.
Additional guidance is located in
§ 170.21 and in the guidance document
listed in paragraph (d) of appendix A to
this part.

(4) Artifact retention and integrity.

The hashed artifacts used as evidence
for the assessment must be retained by
the OSC for six (6) years from the
CMMC Status Date. The hashed artifacts
used as evidence for the assessment
must be retained by the OSC for six (6)
years from the CMMC Status Date. To
ensure that the artifacts have not been
altered, the OSC must hash the artifact
files using a NIST-approved hashing
algorithm. Assessors will collect the list
of the artifact names, the return value of
the hashing algorithm, and the hashing
algorithm used and upload that data
into the CMMC instantiation of eMASS.
Additional guidance for hashing
artifacts can be found in the guidance
document listed in paragraph (h) of
appendix A to this part.

(5) Level 3 certification assessment

with the use of Cloud Service Provider
(CSP). An OSC may use a cloud
environment to process, store, or
transmit CUI in performance of a
contract or subcontract with a
requirement for the CMMC Status of
Level 3 (DIBCAC) under the following
circumstances:

(i) The OSC may utilize a CSP product

or service offering that meets the
FedRAMP Moderate (or higher)

baseline. If the CSP’s product or service
offering is not FedRAMP Authorized at
the FedRAMP Moderate (or higher)
baseline, the product or service offering
must meet security requirements
equivalent to those established by the
FedRAMP Moderate (or higher) baseline
in accordance with DoD Policy.

(ii) Use of a CSP does not relieve an

OSC of its obligation to implement the
24 Level 3 security requirements. These
24 requirements apply to every
environment where the CUI data is
processed, stored, or transmitted, when
Level 3 (DIBCAC) is the designated
CMMC Status. If any of these 24
requirements are inherited from a CSP,
the OSC must demonstrate that
protection during a Level 3 certification
assessment via a Customer
Implementation Summary/Customer
Responsibility Matrix (CIS/CRM) and
associated Body of Evidence (BOE). The
BOE must clearly indicate whether the
OSC or the CSP is responsible for
meeting each requirement and which
requirements are implemented by the
OSC versus inherited from the CSP.

(iii) In accordance with § 170.19(d)(2),

the OSC’s on-premises infrastructure
connecting to the CSP’s product or
service offering is part of the CMMC
Assessment Scope. As such, the security
requirements from the CRM must be
documented or referred to in the OSC’s
SSP.

(6) Level 3 certification assessment

with the use of an ESP, not a CSP. An
OSC may use an ESP that is not a CSP
to process, store, or transmit CUI in
performance of a contract or subcontract
with a requirement for the CMMC Status
of Level 3 (DIBCAC) under the following
circumstances:

(i) The use of the ESP, its relationship

to the OSC, and the services provided
are documented in the OSC’s SSP and
described in the ESP’s service
description and customer responsibility
matrix.

(ii) The ESP services used to meet

OSC requirements are assessed within
the scope of the OSC’s assessment
against all Level 2 and Level 3 security
requirements.

(iii) In accordance with § 170.19(d)(2),

the OSC’s on-premises infrastructure
connecting to the ESP’s product or
service offering is part of the CMMC
Assessment Scope, which will also be
assessed. As such, the security
requirements from the CRM must be
documented or referred to in the OSC’s
SSP.

§ 170.19

CMMC scoping.

(a) Scoping requirement. (1) The

CMMC Assessment Scope must be
specified prior to assessment in

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00141

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83232

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

accordance with the requirements of
this section. The CMMC Assessment
Scope is the set of all assets in the
OSA’s environment that will be
assessed against CMMC security
requirements.

(2) The requirements for defining the

CMMC Assessment Scope for CMMC
Levels 1, 2, and 3 are set forth in this
section. Additional guidance regarding
scoping can be found in the guidance
documents listed in paragraphs (e)
through (g) of appendix A to this part.

(b) CMMC Level 1 scoping. Prior to

performing a Level 1 self-assessment,
the OSA must specify the CMMC
Assessment Scope.

(1) Assets in scope for Level 1 self-

assessment. OSA information systems
which process, store, or transmit FCI are
in scope for CMMC Level 1 and must be
self-assessed against applicable CMMC
security requirements.

(2) Assets not in scope for Level 1 self-

assessment—(i) Out-of-Scope Assets.
OSA information systems which do not
process, store, or transmit FCI are
outside the scope for CMMC Level 1. An
endpoint hosting a VDI client
configured to not allow any processing,
storage, or transmission of FCI beyond
the Keyboard/Video/Mouse sent to the
VDI client is considered out-of-scope.
There are no documentation
requirements for out-of-scope assets.

(ii) Specialized Assets. Specialized

Assets are those assets that can process,
store, or transmit FCI but are unable to
be fully secured, including: Internet of
Things (IoT) devices, Industrial Internet
of Things (IIoT) devices, Operational
Technology (OT), Government
Furnished Equipment (GFE), Restricted
Information Systems, and Test
Equipment. Specialized Assets are not
part of the Level 1 CMMC Assessment

Scope and are not assessed against
CMMC security requirements.

(3) Level 1 self-assessment scoping

considerations. To scope a Level 1 self-
assessment, OSAs should consider the
people, technology, facilities, and
External Service Providers (ESP) within
its environment that process, store, or
transmit FCI.

(c) CMMC Level 2 Scoping. Prior to

performing a Level 2 self-assessment or
Level 2 certification assessment, the
OSA must specify the CMMC
Assessment Scope.

(1) The CMMC Assessment Scope for

CMMC Level 2 is based on the
specification of asset categories and
their respective requirements as defined
in table 3 to this paragraph (c)(1).
Additional information is available in
the guidance document listed in
paragraph (f) of appendix A to this part.

TABLE 3 TO § 170.19(c)(1)—CMMC LEVEL 2 ASSET CATEGORIES AND ASSOCIATED REQUIREMENTS

Asset category

Asset description

OSA requirements

CMMC assessment requirements

Assets that are in the Level 2 CMMC Assessment Scope

Controlled Unclassified Informa-

tion (CUI) Assets.

• Assets that process, store, or transmit

CUI.

• Document in the asset inventory ...........

• Document asset treatment in the Sys-

tem Security Plan (SSP).

• Document in the network diagram of

the CMMC Assessment Scope.

• Prepare to be assessed against CMMC

Level 2 security requirements.

• Assess against all Level 2 security re-

quirements.

Security Protection Assets ........

• Assets that provide security functions

or capabilities to the OSA’s CMMC As-
sessment Scope.

• Document in the asset inventory ...........

• Document asset treatment in SSP.

• Document in the network diagram of

the CMMC Assessment Scope.

• Prepare to be assessed against CMMC

Level 2 security requirements.

• Assess against Level 2 security re-

quirements that are relevant to the ca-
pabilities provided.

Contractor Risk Managed As-

sets.

• Assets that can, but are not intended

to, process, store, or transmit CUI be-
cause of security policy, procedures,
and practices in place.

• Assets are not required to be physically

or logically separated from CUI assets.

• Document in the asset inventory ...........

• Document asset treatment in the SSP.

• Document in the network diagram of

the CMMC Assessment Scope.

• Prepare to be assessed against CMMC

Level 2 security requirements.

• Review the SSP:

• If sufficiently documented, do not

assess against other CMMC secu-
rity requirements, except as noted.

• If OSA’s risk-based security poli-

cies, procedures, and practices
documentation or other findings
raise questions about these assets,
the assessor can conduct a limited
check to identify deficiencies.

• The limited check(s) shall not ma-

terially increase the assessment
duration nor the assessment cost.

• The limited check(s) will be as-

sessed against CMMC security re-
quirements.

Specialized Assets ....................

• Assets that can process, store, or

transmit CUI but are unable to be fully
secured, including: Internet of Things
(IoT) devices, Industrial Internet of
Things (IIoT) devices, Operational
Technology (OT), Government Fur-
nished Equipment (GFE), Restricted In-
formation Systems, and Test Equip-
ment.

• Document in the asset inventory ...........

• Document asset treatment in the SSP.

• Show these assets are managed using

the contractor’s risk-based security poli-
cies, procedures, and practices.

• Document in the network diagram of

the CMMC Assessment Scope.

• Review the SSP.

• Do not assess against other CMMC se-

curity requirements.

Assets that are not in the Level 2 CMMC Assessment Scope

Out-of-Scope Assets .................

• Assets that cannot process, store, or

transmit CUI; and do not provide secu-
rity protections for CUI Assets.

• Prepare to justify the inability of an Out-

of-Scope Asset to process, store, or
transmit CUI.

• None.

• Assets that are physically or logically

separated from CUI assets.

• Assets that fall into any in-scope asset

category cannot be considered an Out-
of-Scope Asset.

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00142

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83233

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

TABLE 3 TO § 170.19(c)(1)—CMMC LEVEL 2 ASSET CATEGORIES AND ASSOCIATED REQUIREMENTS—Continued

Asset category

Asset description

OSA requirements

CMMC assessment requirements

• An endpoint hosting a VDI client config-

ured to not allow any processing, stor-
age, or transmission of CUI beyond the
Keyboard/Video/Mouse sent to the VDI
client is considered an Out-of-Scope
Asset.

(2)(i) Table 4 to this paragraph (c)(2)(i)

defines the requirements to be met
when utilizing an External Service

Provider (ESP). The OSA must consider
whether the ESP is a Cloud Service
Provider (CSP) and whether the ESP

processes, stores, or transmits CUI and/
or Security Protection Data (SPD).

TABLE 4 TO § 170.19(c)(2)(i)—ESP SCOPING REQUIREMENTS

When the ESP processes,
stores, or transmits:

When utilizing an ESP that is:

A CSP

Not a CSP

CUI (with or without SPD) ..

The CSP shall meet the FedRAMP requirements in 48

CFR 252.204–7012.

The services provided by the ESP are in the OSA’s as-

sessment scope and shall be assessed as part of the
OSA’s assessment.

SPD (without CUI) ..............

The services provided by the CSP are in the OSA’s as-

sessment scope and shall be assessed as Security
Protection Assets.

The services provided by the ESP are in the OSA’s as-

sessment scope and shall be assessed as Security
Protection Assets.

Neither CUI nor SPD ..........

A service provider that does not process CUI or SPD

does not meet the CMMC definition of an ESP.

A service provider that does not process CUI or SPD

does not meet the CMMC definition of an ESP.

(ii) The use of an ESP, its relationship

to the OSA, and the services provided
need to be documented in the OSA’s
SSP and described in the ESP’s service
description and customer responsibility
matrix (CRM), which describes the
responsibilities of the OSA and ESP
with respect to the services provided.
Note that the ESP may voluntarily

undergo a CMMC certification
assessment to reduce the ESP’s effort
required during the OSA’s assessment.
The minimum assessment type for the
ESP is dictated by the OSA’s DoD
contract requirement.

(d) CMMC Level 3 scoping. Prior to

performing a Level 3 certification
assessment, the CMMC Assessment
Scope must be specified.

(1) The CMMC Assessment Scope for

Level 3 is based on the specification of
asset categories and their respective
requirements as set forth in table 5 to
this paragraph (d)(1). Additional
information is available in the guidance
document listed in paragraph (g) of
appendix A to this part.

TABLE 5 TO § 170.19(d)(1)—CMMC LEVEL 3 ASSET CATEGORIES AND ASSOCIATED REQUIREMENTS

Asset category

Asset description

OSC requirements

CMMC assessment requirements

Assets that are in the Level 3 CMMC Assessment Scope

Controlled Unclassified Informa-

tion (CUI) Assets.

• Assets that process, store, or transmit

CUI.

• Assets that can, but are not intended

to, process, store, or transmit CUI (de-
fined as Contractor Risk Managed As-
sets in table 1 to paragraph (c)(1) of
this section CMMC Scoping).

• Document in the asset inventory ...........

• Document asset treatment in the Sys-

tem Security Plan (SSP).

• Document in the network diagram of

the CMMC Assessment Scope.

• Prepare to be assessed against CMMC

Level 2 and Level 3 security require-
ments.

• Limited check against Level 2 and as-

sess against all Level 3 CMMC security
requirements.

Security Protection Assets ........

• Assets that provide security functions

or capabilities to the OSC’s CMMC As-
sessment Scope, irrespective of wheth-
er or not these assets process, store,
or transmit CUI.

• Document in the asset inventory ...........

• Document asset treatment in the SSP.

• Document in the network diagram of

the CMMC Assessment Scope.

• Prepare to be assessed against CMMC

Level 2 and Level 3 security require-
ments.

• Limited check against Level 2 and as-

sess against all Level 3 CMMC security
requirements that are relevant to the
capabilities provided.

Specialized Assets ....................

• Assets that can process, store, or

transmit CUI but are unable to be fully
secured, including: Internet of Things
(IoT) devices, Industrial Internet of
Things (IIoT) devices, Operational
Technology (OT), Government Fur-
nished Equipment (GFE), Restricted In-
formation Systems, and Test Equip-
ment.

• Document in the asset inventory ...........

• Document asset treatment in the SSP.

• Document in the network diagram of

the CMMC Assessment Scope.

• Prepare to be assessed against CMMC

Level 2 and Level 3 security require-
ments.

• Limited check against Level 2 and as-

sess against all Level 3 CMMC security
requirements.

• Intermediary devices are permitted to

provide the capability for the special-
ized asset to meet one or more CMMC
security requirements.

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00143

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83234

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

TABLE 5 TO § 170.19(d)(1)—CMMC LEVEL 3 ASSET CATEGORIES AND ASSOCIATED REQUIREMENTS—Continued

Asset category

Asset description

OSC requirements

CMMC assessment requirements

Assets that are not in the Level 3 CMMC Assessment Scope

Out-of-Scope Assets .................

• Assets that cannot process, store, or

transmit CUI; and do not provide secu-
rity protections for CUI Assets.

• Prepare to justify the inability of an Out-

of-Scope Asset to process, store, or
transmit CUI.

• None.

• Assets that are physically or logically

separated from CUI assets.

• Assets that fall into any in-scope asset

category cannot be considered an Out-
of-Scope Asset.

• An endpoint hosting a VDI client config-

ured to not allow any processing, stor-
age, or transmission of CUI beyond the
Keyboard/Video/Mouse sent to the VDI
client is considered an Out-of-Scope
Asset.

(2)(i) Table 6 to this paragraph

(d)(2)(i) defines the requirements to be
met when utilizing an External Service

Provider (ESP). The OSA must consider
whether the ESP is a Cloud Service
Provider (CSP) and whether the ESP

processes, stores, or transmits CUI and/
or Security Protection Data (SPD).

TABLE 6 TO § 170.19(d)(2)(i)—ESP SCOPING REQUIREMENTS

When the ESP processes,
stores, or transmits:

When utilizing an ESP that is:

A CSP

Not a CSP

CUI (with or without SPD) ..

The CSP shall meet the FedRAMP requirements in 48

CFR 252.204–7012.

The services provided by the ESP are in the OSA’s as-

sessment scope and shall be assessed as part of the
OSA’s assessment.

SPD (without CUI) ..............

The services provided by the CSP are in the OSA’s as-

sessment scope and shall be assessed as Security
Protection Assets.

The services provided by the ESP are in the OSA’s as-

sessment scope and shall be assessed as Security
Protection Assets.

Neither CUI nor SPD ..........

A service provider that does not process CUI or SPD

does not meet the CMMC definition of an ESP.

A service provider that does not process CUI or SPD

does not meet the CMMC definition of an ESP.

(ii) The use of an ESP, its relationship

to the OSC, and the services provided
need to be documented in the OSC’s
SSP and described in the ESP’s service
description and customer responsibility
matrix (CRM), which describes the
responsibilities of the OSC and ESP
with respect to the services provided.
Note that the ESP may voluntarily
undergo a CMMC certification
assessment to reduce the ESP’s effort
required during the OSA’s assessment.
The minimum. The minimum
assessment type for the ESP is dictated
by the OSC’s DoD contract requirement.

(e) Relationship between Level 2 and

Level 3 CMMC Assessment Scope. The
Level 3 CMMC Assessment Scope must
be equal to or a subset of the Level 2
CMMC Assessment Scope in accordance
with § 170.18(a) (e.g., a Level 3 data
enclave with greater restrictions and
protections within a Level 2 data
enclave). Any Level 2 POA&M items
must be closed prior to the initiation of
the Level 3 certification assessment.
DCMA DIBCAC may check any Level 2
security requirement of any in-scope
asset. If DCMA DIBCAC identifies that
a Level 2 security requirement is NOT
MET, the Level 3 assessment process

may be paused to allow for remediation,
placed on hold, or immediately
terminated. For further information
regarding scoping of CMMC Level 3
assessments please contact DCMA
DIBCAC at www.dcma.mil/DIBCAC/.

§ 170.20

Standards acceptance.

(a) NIST SP 800–171 R2 DoD

assessments. In order to avoid
duplication of efforts, thereby reducing
the aggregate cost to industry and the
Department, OSCs that have completed
a DCMA DIBCAC High Assessment
aligned with CMMC Level 2 Scoping
will be given the CMMC Status of Final
Level 2 (C3PAO) under the following
conditions:

(1) DCMA DIBCAC High Assessment.

An OSC that achieved a perfect score
with no open POA&M from a DCMA
DIBCAC High Assessment conducted
prior to the effective date of this rule,
will be given a CMMC Status of Level
2 Final (C3PAO) with a validity period
of three (3) years from the date of the
original DCMA DIBCAC High
Assessment. DCMA DIBCAC will
identify assessments that meet these
criteria and verify that SPRS accurately
reflects the CMMC Status. Eligible

DCMA DIBCAC High Assessments
include ones conducted with Joint
Surveillance in accordance with the
DCMA Manual 2302–01 Surveillance.
The scope of the Level 2 certification
assessment is identical to the scope of
the DCMA DIBCAC High Assessment. In
accordance with § 170.17(a)(2), the OSC
must also submit an affirmation in SPRS
and annually thereafter to achieve
contractual eligibility.

(2) [Reserved].
(b) [Reserved].

§ 170.21

Plan of Action and Milestones

requirements.

(a) POA&M. For purposes of achieving

a Conditional CMMC Status, an OSA is
only permitted to have a POA&M for
select requirements scored as NOT MET
during the CMMC assessment and only
under the following conditions:

(1) Level 1 self-assessment. A POA&M

is not permitted at any time for Level 1
self-assessments.

(2) Level 2 self-assessment and Level

2 certification assessment. An OSA is
only permitted to achieve the CMMC
Status of Conditional Level 2 (Self) or
Conditional Level 2 (C3PAO), as
appropriate, if all the following
conditions are met:

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00144

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83235

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

(i) The assessment score divided by

the total number of CMMC Level 2
security requirements is greater than or
equal to 0.8;

(ii) None of the security requirements

included in the POA&M have a point
value of greater than 1 as specified in
the CMMC Scoring Methodology set
forth in § 170.24, except SC.L2–3.13.11
CUI Encryption may be included on a
POA&M if encryption is employed but
it is not FIPS-validated, which would
result in a point value of 3; and

(iii) None of the following security

requirements are included in the
POA&M:

(A) AC.L2–3.1.20 External

Connections (CUI Data).

(B) AC.L2–3.1.22 Control Public

Information (CUI Data).

(C) CA.L2–3.12.4 System Security

Plan.

(D) PE.L2–3.10.3 Escort Visitors (CUI

Data).

(E) PE.L2–3.10.4 Physical Access Logs

(CUI Data).

(F) PE.L2–3.10.5 Manage Physical

Access (CUI Data).

(3) Level 3 certification assessment.

An OSC is only permitted to achieve the
CMMC Status of Conditional Level 3
(DIBCAC) if all the following conditions
are met:

(i) The assessment score divided by

the total number of CMMC Level 3
security requirements is greater than or
equal to 0.8; and

(ii) The POA&M does not include any

of following security requirements:

(A) IR.L3–3.6.1e Security Operations

Center.

(B) IR.L3–3.6.2e Cyber Incident

Response Team.

(C) RA.L3–3.11.1e Threat-Informed

Risk Assessment.

(D) RA.L3–3.11.6e Supply Chain Risk

Response.

(E) RA.L3–3.11.7e Supply Chain Risk

Plan.

(F) RA.L3–3.11.4e Security Solution

Rationale.

(G) SI.L3–3.14.3e Specialized Asset

Security.

(b) POA&M closeout assessment. A

POA&M closeout assessment is a CMMC
assessment that assesses only the NOT
MET requirements that were identified
with POA&M in the initial assessment.
The closing of a POA&M must be
confirmed by a POA&M closeout
assessment within 180-days of the
Conditional CMMC Status Date. If the
POA&M is not successfully closed out
within the 180-day timeframe, the
Conditional CMMC Status for the
information system will expire.

(1) Level 2 self-assessment. For a

Level 2 self-assessment, the POA&M
closeout self-assessment shall be

performed by the OSA in the same
manner as the initial self-assessment.

(2) Level 2 certification assessment.

For Level 2 certification assessment, the
POA&M closeout certification
assessment must be performed by an
authorized or accredited C3PAO.

(3) Level 3 certification assessment.

For Level 3 certification assessment,
DCMA DIBCAC will perform the
POA&M closeout certification
assessment.

§ 170.22

Affirmation.

(a) General. The OSA must affirm

continuing compliance with the
appropriate level self-assessment or
certification assessment. An Affirming
Official from each OSA, whether a
prime or subcontractor, must affirm the
continuing compliance of their
respective organizations with the
specified security requirement after
every assessment, including POA&M
closeout, and annually thereafter.
Affirmations are entered electronically
in SPRS. The affirmation shall be
submitted in accordance with the
following requirements:

(1) Affirming Official. The Affirming

Official is the senior level representative
from within each Organization Seeking
Assessment (OSA) who is responsible
for ensuring the OSA’s compliance with
the CMMC Program requirements and
has the authority to affirm the OSA’s
continuing compliance with the
specified security requirements for their
respective organizations.

(2) Affirmation content. Each CMMC

affirmation shall include the following
information:

(i) Name, title, and contact

information for the Affirming Official;
and

(ii) Affirmation statement attesting

that the OSA has implemented and will
maintain implementation of all
applicable CMMC security requirements
to their CMMC Status for all information
systems within the relevant CMMC
Assessment Scope.

(3) Affirmation submission. The

Affirming Official shall submit a CMMC
affirmation in the following instances:

(i) Upon achievement of a Conditional

CMMC Status, as applicable;

(ii) Upon achievement of a Final

CMMC Status;

(iii) Annually following a Final

CMMC Status Date; and

(iv) Following a POA&M closeout

assessment, as applicable.

(b) Submission procedures. All

affirmations shall be completed in
SPRS. The Department will verify
submission of the affirmation in SPRS to
ensure compliance with CMMC
solicitation or contract requirements.

(1) Level 1 self-assessment. At the

completion of a Level 1 self-assessment
and annually thereafter, the Affirming
Official shall submit a CMMC
affirmation attesting to continuing
compliance with all requirements of the
CMMC Status Level 1 (Self).

(2) Level 2 self-assessment. At the

completion of a Level 2 self-assessment
and annually following a Final CMMC
Status Date, the Affirming Official shall
submit a CMMC affirmation attesting to
continuing compliance with all
requirements of the CMMC Status Level
2 (Self). An affirmation shall also be
submitted at the completion of a
POA&M closeout self-assessment.

(3) Level 2 certification assessment. At

the completion of a Level 2 certification
assessment and annually following a
Final CMMC Status Date, the Affirming
Official shall submit a CMMC
affirmation attesting to continuing
compliance with all requirements of the
CMMC Status Level 2 (C3PAO). An
affirmation shall also be submitted at
the completion of a POA&M closeout
certification assessment.

(4) Level 3 certification assessment. At

the completion of a Level 3 certification
assessment and annually following a
Final CMMC Status Date, the Affirming
Official shall submit a CMMC
affirmation attesting to continuing
compliance with all requirements of the
CMMC Status Level 3 (DIBCAC).
Because C3PAOs and DCMA DIBCAC
check for compliance with different
requirements in their respective
assessments, OSCs must annually affirm
their CMMC Status of Level 2 (C3PAO)
in addition to their CMMC Status of
Level 3 (DIBCAC) to maintain eligibility
for contracts requiring compliance with
Level 3. An affirmation shall also be
submitted at the completion of a
POA&M closeout certification
assessment.

§ 170.23

Application to subcontractors.

(a) CMMC requirements apply to

prime contractors and subcontractors
throughout the supply chain at all tiers
that will process, store, or transmit any
FCI or CUI on contractor information
systems in the performance of the DoD
contract or subcontract. Prime
contractors shall comply and shall
require subcontractors to comply with
and to flow down CMMC requirements,
such that compliance will be required
throughout the supply chain at all tiers
with the applicable CMMC level and
assessment type for each subcontract as
follows:

(1) If a subcontractor will only

process, store, or transmit FCI (and not
CUI) in performance of the subcontract,

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00145

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83236

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

then a CMMC Status of Level 1 (Self) is
required for the subcontractor.

(2) If a subcontractor will process,

store, or transmit CUI in performance of
the subcontract, then a CMMC Status of
Level 2 (Self) is the minimum
requirement for the subcontractor.

(3) If a subcontractor will process,

store, or transmit CUI in performance of
the subcontract and the associated
prime contract has a requirement for a
CMMC Status of Level 2 (C3PAO), then
the CMMC Status of Level 2 (C3PAO) is
the minimum requirement for the
subcontractor.

(4) If a subcontractor will process,

store, or transmit CUI in performance of
the subcontract and the associated
prime contract has a requirement for the
CMMC Status of Level 3 (DIBCAC), then
the CMMC Status of Level 2 (C3PAO) is
the minimum requirement for the
subcontractor.

(b) As with any solicitation or

contract, the DoD may provide specific
guidance pertaining to flow-down.

§ 170.24

CMMC Scoring Methodology.

(a) General. This scoring methodology

is designed to provide a measurement of
an OSA’s implementation status of the
NIST SP 800–171 R2 security
requirements (incorporated by reference
elsewhere in this part, see § 170.2) and
the selected NIST SP 800–172 Feb2021
security requirements (incorporated by
reference elsewhere in this part, see
§ 170.2). The CMMC Scoring
Methodology is designed to credit
partial implementation only in limited
cases (e.g., multi-factor authentication
IA.L2–3.5.3).

(b) Assessment findings. Each security

requirement assessed under the CMMC
Scoring Methodology must result in one
of three possible assessment findings, as
follows:

(1) Met. All applicable objectives for

the security requirement are satisfied
based on evidence. All evidence must
be in final form and not draft.
Unacceptable forms of evidence include
but are not limited to working papers,
drafts, and unofficial or unapproved
policies.

(i) Enduring exceptions when

described, along with any mitigations,
in the system security plan shall be
assessed as MET.

(ii) Temporary deficiencies that are

appropriately addressed in operational
plans of action (i.e., include deficiency
reviews and show progress towards the
implementation of corrections to reduce
or eliminate identified vulnerabilities)
shall be assessed as MET.

(2) Not Met. One or more applicable

objectives for the security requirement
is not satisfied. During an assessment,

for each security requirement objective
marked NOT MET, the assessor will
document why the evidence does not
conform.

(3) Not Applicable (N/A). A security

requirement and/or objective does not
apply at the time of the CMMC
assessment. For example, Public-Access
System Separation (SC.L2–3.13.5) might
be N/A if there are no publicly
accessible systems within the CMMC
Assessment Scope. During an
assessment, an assessment objective
assessed as N/A is equivalent to the
same assessment objective being
assessed as MET.

(c) Scoring. At each CMMC Level,

security requirements are scored as
follows:

(1) CMMC Level 1. All CMMC Level

1 security requirements must be fully
implemented to be considered MET. No
POA&M is permitted for CMMC Level 1,
and self-assessment results are scored as
MET or NOT MET in their entirety.

(2) CMMC Level 2 Scoring

Methodology. The maximum score
achievable for a Level 2 self-assessment
or Level 2 certification assessment is
equal to the total number of CMMC
Level 2 security requirements. If all
CMMC Level 2 security requirements
are MET, OSAs are awarded the
maximum score. For each requirement
NOT MET, the associated value of the
security requirement is subtracted from
the maximum score, which may result
in a negative score.

(i) Procedures. (A) Scoring

methodology for Level 2 self-assessment
and Level 2 certification assessment is
based on all CMMC Level 2 security
requirement objectives, including those
NOT MET.

(B) In the CMMC Level 2 Scoring

Methodology, each security requirement
has a value (e.g., 1, 3 or 5), which is
related to the designation by NIST as
basic or derived security requirements.
Per NIST SP 800–171 R2, the basic
security requirements are obtained from
FIPS PUB 200 Mar2006, which provides
the high-level and fundamental security
requirements for Federal information
and systems. The derived security
requirements, which supplement the
basic security requirements, are taken
from the security controls in NIST SP
800–53 R5.

(1) For NIST SP 800–171 R2 basic and

derived security requirements that, if
not implemented, could lead to
significant exploitation of the network,
or exfiltration of CUI, five (5) points are
subtracted from the maximum score.
The basic and derived security
requirements with a value of five (5)
points include:

(i) Basic security requirements.

AC.L2–3.1.1, AC.L2–3.1.2, AT.L2–3.2.1,
AT.L2–3.2.2, AU.L2–3.3.1, CM.L2–3.4.1,
CM.L2–3.4.2, IA–L2–3.5.1, IA–L2–3.5.2,
IR.L2–3.6.1, IR.L2–3.6.2, MA.L2–3.7.2,
MP.L2–3.8.3, PS.L2–3.9.2, PE.L2–3.10.1,
PE.L2–3.10.2, CA.L2–3.12.1, CA.L2–
3.12.3, SC.L2–3.13.1, SC.L2–3.13.2,
SI.L2–3.14.1, SI.L2–3.14.2, and SI.L2–
3.14.3.

(ii) Derived security requirements.

AC.L2–3.1.12, AC.L2–3.1.13, AC.L2–
3.1.16, AC.L2–3.1.17, AC.L2–3.1.18,
AU.L2–3.3.5, CM.L2–3.4.5, CM.L2–
3.4.6, CM.L2–3.4.7, CM.L2–3.4.8, IA.L2–
3.5.10, MA.L2–3.7.5, MP.L2–3.8.7,
RA.L2–3.11.2, SC.L2–3.13.5, SC.L2–
3.13.6, SC.L2–3.13.15, SI.L2–3.14.4, and
SI.L2–3.14.6.

(2) For basic and derived security

requirements that, if not implemented,
have a specific and confined effect on
the security of the network and its data,
three (3) points are subtracted from the
maximum score. The basic and derived
security requirements with a value of
three (3) points include:

(i) Basic security requirements.

AU.L2–3.3.2, MA.L2–3.7.1, MP.L2–
3.8.1, MP.L2–3.8.2, PS.L2–3.9.1, RA.L2–
3.11.1, and CA.L2–3.12.2.

(ii) Derived security requirements.

AC.L2–3.1.5, AC.L2- 3.1.19, MA.L2–
3.7.4, MP.L2–3.8.8, SC.L2–3.13.8, SI.L2–
3.14.5, and SI.L2–3.14.7.

(3) All remaining derived security

requirements, other than the exceptions
noted, if not implemented, have a
limited or indirect effect on the security
of the network and its data. For these,
1 point is subtracted from the maximum
score.

(4) Two derived security

requirements, IA.L2–3.5.3 and SC.L2–
3.13.11, can be partially effective even
if not completely or properly
implemented, and the points deducted
may be adjusted depending on how the
security requirement is implemented.

(i) Multi-factor authentication (MFA)

(CMMC Level 2 security requirement
IA.L2–3.5.3) is typically implemented
first for remote and privileged users
(since these users are both limited in
number and more critical) and then for
the general user, so three (3) points are
subtracted from the maximum score if
MFA is implemented only for remote
and privileged users. Five (5) points are
subtracted from the maximum score if
MFA is not implemented for any users.

(ii) FIPS-validated encryption (CMMC

Level 2 security requirement SC.L2–
3.13.11) is required to protect the
confidentiality of CUI. If encryption is
employed, but is not FIPS-validated,
three (3) points are subtracted from the
maximum score; if encryption is not

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00146

Fmt 4701

Sfmt 4700

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2




83237

Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

employed; five (5) points are subtracted
from the maximum score.

(5) OSAs must have a System Security

Plan (SSP) (CMMC security requirement
CA.L2–3.12.4) in place at the time of
assessment to describe each information
system within the CMMC Assessment
Scope. The absence of an up to date SSP
at the time of the assessment would
result in a finding that ‘an assessment
could not be completed due to
incomplete information and
noncompliance with 48 CFR 252.204–
7012.’

(6) For each NOT MET security

requirement the OSA must have a
POA&M in place. A POA&M addressing

NOT MET security requirements is not
a substitute for a completed
requirement. Security requirements not
implemented, whether described in a
POA&M or not, is assessed as ‘NOT
MET.’

(7) Specialized Assets must be

evaluated for their asset category per the
CMMC scoping guidance for the level in
question and handled accordingly as set
forth in § 170.19.

(8) If an OSC previously received a

favorable adjudication from the DoD
CIO indicating that a security
requirement is not applicable or that an
alternative security measure is equally
effective (in accordance with 48 CFR

252.204–7008 or 48 CFR 252.204–7012),
the DoD CIO adjudication must be
included in the system security plan to
receive consideration during an
assessment. A security requirement for
which implemented security measures
have been adjudicated by the DoD CIO
as equally effective is assessed as MET
if there have been no changes in the
environment.

(ii) CMMC Level 2 Scoring Table.

CMMC Level 2 scoring has been
assigned based on the methodology set
forth in table 1 to this paragraph
(c)(2)(ii).

TABLE 7 TO § 170.24(c)(2)(ii)—CMMC LEVEL 2 SCORING TABLE

CMMC Level 2 requirement categories

Point value

subtracted from

maximum score

Basic Security Requirements:

If not implemented, could lead to significant exploitation of the network, or exfiltration of CUI ...........................................

5

If not implemented, has specific and confined effect on the security of the network and its data .......................................

3

Derived Security Requirements:

If not implemented, could lead to significant exploitation of the network, or exfiltration of CUI ...........................................

5

If not completely or properly implemented, could be partially effective and points adjusted depending on how the secu-

rity requirement is implemented: ........................................................................................................................................

3 or 5

—Partially effective implementation—3 points.
—Non-effective (not implemented at all)—5 points.

If not implemented, has specific and confined effect on the security of the network and its data .......................................

3

If not implemented, has a limited or indirect effect on the security of the network and its data ..........................................

1

(3) CMMC Level 3 assessment scoring

methodology. CMMC Level 3 scoring
does not utilize varying values like the
scoring for CMMC Level 2. All CMMC
Level 3 security requirements use a
value of one (1) point for each security
requirement. As a result, the maximum
score achievable for a Level 3
certification assessment is equivalent to
the total number of the selected subset
of NIST SP 800–172 Feb2021 security
requirements for CMMC Level 3, see
§ 170.14(c)(4). The maximum score is
reduced by one (1) point for each
security requirement NOT MET. The
CMMC Level 3 scoring methodology
reflects the fact that all CMMC Level 2
security requirements must already be
MET (for the Level 3 CMMC Assessment

Scope). A maximum score on the Level
2 certification assessment is required to
be eligible to initiate a Level 3
certification assessment. The Level 3
certification assessment score is equal to
the number of CMMC Level 3 security
requirements that are assessed as MET.

Appendix A to Part 170—Guidance

Guidance documents include:
(a) ‘‘CMMC Model Overview’’ available at

https://DoDcio.defense.gov/CMMC/.

(b) ‘‘CMMC Assessment Guide—Level 1’’

available at [https://DoDcio.defense.gov/CMMC/ https://DoDcio.defense.gov/
CMMC/. ]

(c) ‘‘CMMC Assessment Guide—Level 2’’

available at [https://DoDcio.defense.gov/CMMC/ https://DoDcio.defense.gov/
CMMC/. ]

(d) ‘‘CMMC Assessment Guide—Level 3’’

available at [https://DoDcio.defense.gov/CMMC/ https://DoDcio.defense.gov/
CMMC/. ]

(e) ‘‘CMMC Scoping Guide—Level 1’’

[https://DoDcio.defense.gov/CMMC/ available at https://DoDcio.defense.gov/
CMMC/. ]

(f) ‘‘CMMC Scoping Guide—Level 2’’

[https://DoDcio.defense.gov/CMMC/ available at https://DoDcio.defense.gov/
CMMC/. ]

(g) ‘‘CMMC Scoping Guide—Level 3’’

[https://DoDcio.defense.gov/CMMC/ available at https://DoDcio.defense.gov/
CMMC/. ]

(h) ‘‘CMMC Hashing Guide’’ available at

https://DoDcio.defense.gov/CMMC/.

Dated: September 30, 2024.

Patricia L. Toppings,
OSD Federal Register Liaison Officer,
Department of Defense.
[FR Doc. 2024–22905 Filed 10–11–24; 8:45 am]

BILLING CODE 6001–FR–P

VerDate Sep<11>2014

18:51 Oct 11, 2024

Jkt 265001

PO 00000

Frm 00147

Fmt 4701

Sfmt 9990

E:\FR\FM\15OCR2.SGM

15OCR2

khammond on DSKJM1Z7X2PROD with RULES2



Original source: https://www.govinfo.gov/content/pkg/FR-2024-10-15/pdf/2024-22905.pdf

Retrieved from "https://cmmcwiki.org/index.php?title=32_CFR_Part_170&oldid=669"