United StatesCybersecurity Maturity Model Certification (CMMC) Program, contractor cybersecurity requirements and assessments
32 CFR Part 170 (CMMC Program)
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This part reaches your organization only if it is a contractor or subcontractor awarded a Department of Defense contract or subcontract that includes a CMMC requirement and will process, store, or transmit Federal Contract Information or Controlled Unclassified Information on contractor information systems; no declared activity in this checklist stands in for that status, so read this instrument by hand if your organization holds or seeks a Department of Defense contract or subcontract.
- If this part applies to your organization, safeguard Federal Contract Information and Controlled Unclassified Information on your contractor information systems by implementing the security requirements of the CMMC level the contract requires: the 15 requirements of 48 CFR 52.204-21 for Level 1, the 110 requirements of NIST SP 800-171 Revision 2 for Level 2, and selected requirements of NIST SP 800-172 for Level 3.
- Hold the CMMC status the contract requires at award: for Level 1 and Level 2 (Self), complete a self-assessment and submit the results in the Supplier Performance Risk System, for Level 1 annually; for Level 2 (C3PAO), obtain a certification assessment from an authorized or accredited CMMC Third-Party Assessment Organization.
- Have your Affirming Official affirm continuing compliance in the Supplier Performance Risk System after every assessment and annually thereafter.
- Require each subcontractor that will process, store, or transmit Federal Contract Information or Controlled Unclassified Information to meet the applicable CMMC level, and flow the requirement down throughout the supply chain at all tiers.
These lines are LexLint's reading of the law's text, as of .
What this law does
The Cybersecurity Maturity Model Certification Program of the Department of Defense establishes requirements for defense contractors and subcontractors to implement prescribed cybersecurity standards for safeguarding Federal Contract Information and Controlled Unclassified Information.
The requirements apply to all DoD contract and subcontract awardees that will process, store, or transmit information, in performance of the DoD contract, that meets the standards for Federal Contract Information or Controlled Unclassified Information on contractor information systems. DoD safeguarding policy requires defense contractors and subcontractors to safeguard that information on contractor information systems by applying specified security requirements.
Level 1 uses the safeguarding requirements of 48 CFR 52.204-21, Level 2 uses NIST SP 800-171 Revision 2, and Level 3 uses selected security requirements from NIST SP 800-172. A contractor seeking the Final Level 1 (Self) status must achieve a MET result for all Level 1 security requirements. A contractor seeking a Level 2 certification status must obtain a certification assessment from an authorized or accredited CMMC Third-Party Assessment Organization.
A contractor must affirm continuing compliance with the appropriate level self-assessment or certification assessment. A prime contractor must require its subcontractors to comply with and to flow down the CMMC requirements throughout the supply chain at all tiers.
Phase 1 of implementation begins on the effective date of the complementary DFARS acquisition rule, and the Department of Defense intends to include the requirement for a Level 1 or Level 2 self-assessment status in all applicable solicitations and contracts as a condition of contract award. The CMMC Program rule at 32 CFR part 170 is effective . The complementary DFARS acquisition rule is effective .