GET THE LATEST CMMC 2.0 UPDATES HERE!

2022 – Q4

CMMC: The Latest

Rule to be sent to OIRA October 2022.

• Final interim/proposed rule to be released March 2023.
• Rule in contracts beginning May 2023.
• CMMC compliance takes 9-12 months.
• Sec. 866 of the 2022 NDAA requires a report on the impact of

CMMC on small businesses within 180 days. The report must
include:

• the estimated costs of complying with each level of the
  framework;
• any decrease in the number of small business concerns that
  are part of the defense industrial base resulting from the
  implementation and use of the framework; and
• an explanation of how the Department of Defense will mitigate
  the negative effects to small business concerns that are part
  of the defense industrial base resulting from the
  implementation and use of the framework.

2022 – Q3

CMMC: The Latest

How it will work:

• DoD entered into an MOU (and now contract) with a
  single CMMC Accreditation Body (AB).
• The AB will implement the CMMC model, train and
  certify assessors, and evaluate assessments. The
  AB sits between DoD and the contractors.
• There will be three levels of assessment with the
  third being the most stringent.
• DoD will assign a CMMC rating to each contract
  and only contractors that have had a successful
  assessment at that rating can perform.
• It is unknown who will assign certification levels
  required to subcontractors and enforce that.