June 28, 2024

Breaking News: CMMC Program 32 CFR final rule sent to OMB

It's really happening! Yesterday the final CMMC Program rule went to OMB for final review & publication:

What does this mean?

(1) OMB will publish the final rule in 90-120 days. There is a 60-day waiting period before it takes effect. This means the CMMC Program could easily "go live" before the end of this year.

(2) Official CMMC assessments can begin once the rule takes effect.

(3) We are still waiting on the 48 CFR rule that will put the 7021 clause into contracts, but OMB is expected to publish the notice in August, and it's a short rule, so should be finalized fairly quickly. This would keep us within the early 2025 timeframe that David McKeown talked about recently.

(4) If the past is any indicator, primes will start pushing their subs very hard to become certified as soon as assessments are available.

(5) Each contractor that shares CUI with a sub must flow down the clauses for that sub to properly protect the data. Make sure your supply chain is prepared! Many of them need education, training and support.

That train is barreling down the tracks! Now is the time to ramp up your CMMC preparations.

Need help? You know where to find me!

How old is your SPRS self-assessment score? Might want to review this.

Sincerely,

Glenda R. Snodgrass, CCP/CCA
grs@theneteffect.com
The Net Effect, LLC
www.theneteffect.com
251-433-0196 x107

If you enjoy these updates, you might also enjoy my weekly newsletter "Cyber Security News & Tips" -- sign up now!