83092 Federal RegisterVol. 89, No. 199_2024-22905.pdf

83092 Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

1 www.federalregister.gov/citation/75-FR-68675 (November 4, 2010).

2 www.federalregister.gov/citation/75-FR-707 (December 29, 2009).

3 www.govinfo.gov/link/uscode/42/2011, et seq.

4 www.federalregister.gov/documents/2020/09/

29/2020-21123/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of.

5 www.federalregister.gov/documents/2024/08/ 15/2024-18110/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of.

6 www.sprs.csd.disa.mil/ under OMB control number 0750–0004.

DEPARTMENT OF DEFENSE

Office of the Secretary

32 CFR Part 170

[Docket ID: DoD–2023–OS–0063]

RIN 0790–AL49

Cybersecurity Maturity Model Certification (CMMC) Program

AGENCY: Office of the Department of Defense Chief Information Officer (CIO), Department of Defense (DoD).

ACTION: Final rule.

SUMMARY: With this final rule, DoD establishes the Cybersecurity Maturity Model Certification (CMMC) Program in order to verify contractors have implemented required security measures necessary to safeguard Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The mechanisms discussed in this rule will allow the Department to confirm a defense contractor or subcontractor has implemented the security requirements for a specified CMMC level and is maintaining that status (meaning level and assessment type) across the contract period of performance. This rule will be updated as needed, using the appropriate rulemaking process, to address evolving cybersecurity standards, requirements, threats, and other relevant changes.

DATES: This rule is effective December 16, 2024. The incorporation by reference of certain material listed in this rule is approved by the Director of the Federal Register as of December 16, 2024.

FOR FURTHER INFORMATION CONTACT: Ms.

Diane Knight, Office of the DoD CIO at osd.pentagon.dod-cio.mbx.cmmc-inquiries@mail.mil or 202–770–9100.

SUPPLEMENTARY INFORMATION:

History of the Program

The beginnings of CMMC start with the November 2010, Executive Order (E.O.) 13556,1 Controlled Unclassified Information. The intent of this Order was to ‘‘establish an open and uniform program for managing [unclassified] information that requires safeguarding or dissemination controls.’’ Prior to this E.O., more than 100 different markings for this information existed across the executive branch. This ad hoc, agency-specific approach created inefficiency and confusion, led to a patchwork system that failed to adequately safeguard information requiring protection, and unnecessarily restricted information-sharing.

As a result, the E.O. established the CUI Program to standardize the way the executive branch handles information requiring safeguarding or dissemination controls (excluding information that is classified under E.O. 13526, Classified National Security Information 2 or any predecessor or successor order; or the Atomic Energy Act of 1954,3 as amended).

In 2019, DoD announced the development of CMMC in order to move away from a ‘‘self-attestation’’ model of security. It was first conceived by the Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) to secure the Defense Industrial Base (DIB) sector against evolving cybersecurity threats. In September 2020, DoD published the 48 CFR CMMC interim final rule, Defense Federal Acquisition Regulation Supplement (DFARS): Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019–D041 85 FR 48513, September 9, 2020),4 which implemented the DoD’s vision for the initial CMMC Program and outlined the basic features of the framework (tiered model of practices and processes, required assessments, and implementation through contracts) to protect FCI and CUI. The 48 CFR CMMC interim final rule became effective on 30 November 2020, establishing a five-year phase-in period. In response to approximately 750 public comments on the 48 CFR CMMC interim final rule, in March 2021, the Department initiated an internal review of CMMC’s implementation.

In November 2021, the Department announced the revised CMMC Program, an updated program structure and requirements designed to achieve the primary goals of the internal review:

• Safeguard sensitive information to enable and protect the warfighter

• Enforce DIB cybersecurity standards to meet evolving threats

• Ensure accountability while minimizing barriers to compliance with DoD requirements

• Perpetuate a collaborative culture of cybersecurity and cyber resilience

• Maintain public trust through high professional and ethical standards The revised CMMC Program has three key features:

• Tiered Model: CMMC requires companies entrusted with Federal contract information and controlled unclassified information to implement cybersecurity standards at progressively advanced levels, depending on the type and sensitivity of the information. The program also describes the process for requiring protection of information flowed down to subcontractors.

• Assessment Requirement: CMMC assessments allow the Department to verify the implementation of clear cybersecurity standards.

• Phased Implementation: Once CMMC rules become effective, certain DoD contractors handling FCI and CUI will be required to achieve a particular CMMC level as a condition of contract award. CMMC requirements will be implemented using a 4-phase implementation plan over a three-year period.

Current Status of the CMMC Program Separate from this rulemaking, DoD has a proposed acquisition rule (48 CFR part 204 CMMC Acquisition rule) to amend the Defense Federal Acquisition Regulation Supplement (DFARS) to address procurement related considerations and requirements related to this program rule (32 CFR part 170 CMMC Program rule). The 48 CFR part 204 CMMC Acquisition rule also partially implements a section of the National Defense Authorization Act for Fiscal Year 2020 directing the Secretary of Defense to develop a consistent, comprehensive framework to enhance cybersecurity for the U.S. defense industrial base.5 The 48 CFR part 204 CMMC Acquisition rule, when finalized, will allow DoD to require a specific CMMC level in a solicitation or contract. When CMMC requirements are applied to a solicitation, Contracting officers will not make award, exercise an option, or extend the period of performance on a contract, if the offeror or contractor does not have the passing results of a current certification assessment or self-assessment for the required CMMC level, and an affirmation of continuous compliance with the security requirements in the Supplier Performance Risk System (SPRS) 6 for all information systems that process, store, or transmit FCI or CUI during contract performance.

Furthermore, the appropriate CMMC certification requirements will flow down to subcontractors at all tiers when

VerDate Sep<11>2014 18:51 Oct 11, 2024 Jkt 265001 PO 00000 Frm 00002 Fmt 4701 Sfmt 4700 E:\FR\FM\15OCR2.SGM 15OCR2kh am m on d on

D S

K

JM

1Z 7X

2P R

O D w ith

R U

LE

S mailto:osd.pentagon.dod-cio.mbx.cmmc-inquiries@mail.mil mailto:osd.pentagon.dod-cio.mbx.cmmc-inquiries@mail.mil http://www.federalregister.gov/citation/75-FR-68675 http://www.federalregister.gov/citation/75-FR-707 http://www.govinfo.gov/link/uscode/42/2011 http://www.federalregister.gov/documents/2020/09/29/2020-21123/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of http://www.federalregister.gov/documents/2024/08/15/2024-18110/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of http://www.sprs.csd.disa.mil/ http://www.federalregister.gov/documents/2020/09/29/2020-21123/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of http://www.federalregister.gov/documents/2020/09/29/2020-21123/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of http://www.federalregister.gov/documents/2020/09/29/2020-21123/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of http://www.federalregister.gov/documents/2024/08/15/2024-18110/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of http://www.federalregister.gov/documents/2024/08/15/2024-18110/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of http://www.federalregister.gov/documents/2024/08/15/2024-18110/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of

83093 Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

7 www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting.

8 www.acquisition.gov/dfars/252.204-7020-nist-sp-800-171dod-assessment-requirements.

9 Required since November 2016, NIST SP 800– 171 R2 security requirement 3.12.4 states organizations must ‘‘develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.’’

10 https://media.defense.gov/2024/Mar/28/

2003424523/-1/-1/1/DOD_DOB_CS_STRATEGY_

DSD_SIGNED_20240325.PDF.

the subcontractor processes, stores, or transmits FCI or CUI. It should be noted the Department may include CMMC requirements on contracts awarded prior to 48 CFR part 204 CMMC Acquisition rule becoming effective, but doing so will require bilateral contract modification after negotiations.

To date, the DoD has relied on offeror representation that the security requirements of National Institute of Standards and Technology (NIST) Special Publication (SP) 800–171, ‘‘Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations’’ have been met, as described by 48 CFR 252.204–7008. In some instances, the DoD has verified contractor implementation of NIST SP 800–171 through assessment by the Defense Contract Management Agency (DCMA) Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). As part of this responsibility, DCMA DIBCAC assesses DIB companies to ensure they are meeting contractually required cybersecurity standards and to ensure contractors have the ability to protect CUI for government contracts they are awarded. DCMA DIBCAC conducts NIST SP 800–171 assessments in support of 48 CFR 252.204–7012 (DFARS clause 252.204–7012), Safeguarding Covered Defense Information and Cyber Incident Reporting,7 and 48 CFR 252.204–7020 (DFARS clause 252.204–7020), NIST SP 800–171 DoD Assessment Requirements.8 The DCMA DIBCAC prioritization process is designed to adjust as DoD’s cyber priorities evolve based on ongoing threats. DCMA DIBCAC collects and analyzes data on DoD contractors to include:

• Mission critical programs, technologies, and infrastructure and the contractors (prime or lower tier) that support DoD capabilities.

• Cyber threats, vulnerabilities, or incidents.

• DoD Leadership requests.

To date, DCMA DIBCAC has assessed

357 entities including DoD’s major prime contractors. In accordance with NIST SP 800–171, titled ‘‘Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations,’’ Revision 2, February 2020 (includes updates as of January 28, 2021) (NIST SP 800–171 R2), contractors must describe in a System Security Plan (SSP) 9 how the security requirements are met or how the organizations plan to meet the requirements and address known and anticipated threats. In the event companies cannot establish full compliance, they must develop plans of action that describe how unimplemented security requirements will be met and how any planned mitigations will be implemented.

Although an explicit time limit for mitigation is not specified in NIST SP 800–171 R2, contractors that fail to reasonably comply with applicable requirements may be subject to standard contractual remedies. The CMMC Program’s assessment phase-in plan, as described in § 170.3, does not preclude entities from immediately seeking a CMMC certification assessment prior to the 48 CFR part 204 CMMC Acquisition rule being finalized and the clause being added to new or existing DoD contracts.

The Department estimates 8350 medium and large entities will be required to meet CMMC Level 2 C3PAO assessment requirements as a condition of contract award. CMMC Level 2 requirements will apply to all contractors that process, store, or transmit CUI, and will provide DoD with a means to assess that CUI safeguarding requirements prescribed in 32 CFR part 2002 have been met. DoD estimates 135 CMMC Third-Party Assessment Organization (C3PAO)-led certification assessments will be completed in the first year, 673 C3PAO certification assessments in year 2, 2,252 C3PAO certification assessments in year 3, and 4,452 C3PAO certification assessments in year four.

Any DoD component can request DCMA DIBCAC to initiate an assessment and these requests will take priority in the assessment scheduling process. Once identified for assessment, DCMA DIBCAC determines the assessment date and notifies the company to begin the pre-assessment process. Typically, planning and scheduling takes place 3 to 6 months in advance of a DCMA DIBCAC assessment to allow DCMA DIBCAC and the DIB company time to prepare, however, DoD’s identified priorities may expedite the execution of an assessment. As discussed in more detail in the regulatory text, assessment results are reported to DoD, including key stakeholders via SPRS and made available to the DIB company. Please see the DCMA DIBCAC website at www.dcma.mil/DIBCAC/ that includes links to the pre-assessment documents;

a publicly releasable version of the assessment database; FAQs; an informational video; a link to Procurement Integrated Enterprise Environment (PIEE), the primary enterprise procure-to-pay application for the DoD; a link to SPRS where assessment scores are posted; and links to other reference materials.

As discussed in more detail later in the regulatory text, all requirements that are scored as NOT MET are identified in a Plan of Action and Milestones (POA&M) to meet the CMMC requirement. Organizations Seeking Assessment (OSAs) satisfy the CMMC requirements needed for contract award by successfully meeting all 110 security requirements of NIST SP 800–171 R2 or by receiving a Conditional CMMC Status when achieving the minimum passing score of 80 percent and only including permittable NOT MET requirements as described in § 170.21 on the POA&M. All requirements that were scored ‘‘NOT MET’’ and placed on the POA&M must be remedied within 180 days of receiving their Conditional CMMC Status. Proper implementation of these requirements must be verified by a second assessment, called a POA&M closeout assessment. If the POA&M closeout assessment finds that all requirements have been met, then the OSA will achieve a CMMC Status of Final Level 2 (Self) or Final Level 2 (C3PAO) as applicable. However, if the POA&M closeout assessment does not validate all requirements have been met by the end of the 180 days, then the CMMC Status of Conditional Level 2 (Self) or Conditional Level 2 (C3PAO) will expire and at this point, standard contractual remedies will apply for any current contract.

DoD has created a series of guidance documents to assist organizations in better understanding the CMMC Program and the assessment process and scope for each CMMC level. These guidance documents are available on the DoD CMMC website at https:// dodcio.defense.gov/CMMC/ Documentation/ and on the DoD Open Government website at https:// open.defense.gov/Regulatory-Program/ Guidance-Documents/. The CMMC Program has also been incorporated in the Department’s 2024 Defense Industrial Base Cybersecurity Strategy.10 The strategy requires the Department to coordinate and collaborate across components to identify and close gaps

VerDate Sep<11>2014 18:51 Oct 11, 2024 Jkt 265001 PO 00000 Frm 00003 Fmt 4701 Sfmt 4700 E:\FR\FM\15OCR2.SGM 15OCR2kh am m on d on

D S

K

JM

1Z 7X

2P R

O D w ith

R U

LE

S http://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting http://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting http://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting https://media.defense.gov/2024/Mar/28/2003424523/-1/-1/1/DOD_DOB_CS_STRATEGY_DSD_SIGNED_20240325.PDF https://media.defense.gov/2024/Mar/28/2003424523/-1/-1/1/DOD_DOB_CS_STRATEGY_DSD_SIGNED_20240325.PDF https://media.defense.gov/2024/Mar/28/2003424523/-1/-1/1/DOD_DOB_CS_STRATEGY_DSD_SIGNED_20240325.PDF http://www.acquisition.gov/dfars/252.204-7020-nist-sp-800-171dod-assessment-requirements http://www.acquisition.gov/dfars/252.204-7020-nist-sp-800-171dod-assessment-requirements https://open.defense.gov/Regulatory-Program/Guidance-Documents/ https://open.defense.gov/Regulatory-Program/Guidance-Documents/ https://open.defense.gov/Regulatory-Program/Guidance-Documents/ https://dodcio.defense.gov/CMMC/Documentation/ https://dodcio.defense.gov/CMMC/Documentation/ https://dodcio.defense.gov/CMMC/Documentation/ http://www.dcma.mil/DIBCAC/

83094 Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

11 www.govinfo.gov/content/pkg/FR-2020-12-21/ pdf/2020-27698.pdf).

12 www.dcsa.mil/Industrial-Security/National- Industrial-Security-Program-Oversight/32-CFR-Part- 117-NISPOM-Rule/.

13 www.acquisition.gov/far/52.204-21.

14 www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting.

15 Required since November 2016, NIST SP 800– 171 R2 security requirement 3.12.4 states organizations must ‘‘develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.’’

16 www.sprs.csd.disa.mil/ under OMB control number 0750–0004.

17 The plan of action requirement described under DFARS clause 252.204–7020 is different from a Plan of Action and Milestones (POA&M) requirement in CMMC as plans of action do not require milestones.

18 www.federalregister.gov/documents/2020/09/ 29/2020-21123/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of.

19 www.acq.osd.mil/asda/dpc/cp/cyber/docs/ safeguarding/NIST-SP-800-171-Assessment- Methodology-Version-1.2.1-6.24.2020.pdf.

in protecting DoD networks, supply chains, and other critical resources.

Other prongs of the Department’s cybersecurity strategy are described in the Department’s National Industrial Security Program Operating Manual (NISPOM) which address implementation of the Security Executive Agent Directive (SEAD) 3 11 procedures for the protection and reproduction of classified information;

controlled unclassified information (CUI); National Interest Determination (NID) requirements for cleared contractors operating under a Special Security Agreement for Foreign Ownership, Control, or Influence; and eligibility determinations for personnel security clearance processes and requirements.12

Overview of Revised CMMC Program

Current Requirements for Defense Contractors and Subcontractors

Currently, Federal contracts (including defense contracts) involving the transfer of FCI to a non-Government organization follow the requirements specified in 48 CFR 52.204–21 (Federal Acquisition Regulation (FAR) clause 52.204–21), Basic Safeguarding of Covered Contractor Information Systems.13 FAR clause 52.204–21 requires compliance with 15 security requirements, FAR clause 52.204–21 (b)(1), items (i) through (xv). These requirements are the minimum necessary for any entity wishing to receive FCI from the US Government

(USG).

Defense contracts involving the development or transfer of CUI to a non- Government organization require applicable requirements of DFARS clause 252.204–7012.14 This clause requires defense contractors to provide adequate security on all covered contractor information systems by implementing the 110 security requirements specified in NIST SP 800–

171. This clause includes additional requirements; for example, defense contractors must confirm that any Cloud Service Providers (CSPs) used by the contractor to handle CUI meet Federal Risk and Authorization Management Program (FedRAMP) Moderate Baseline or the equivalent requirements. It also requires defense contractors to flow down all the requirements to their subcontractors who process, store, or transmit CUI. The CMMC Program currently does not include any requirements for contractors operating systems on behalf of the DoD.

To comply with DFARS clause 252.204–7012, contractors are required to develop a SSP 15 detailing the policies and procedures their organization has in place to comply with NIST SP 800–171.

The SSP serves as a foundational document for the required NIST SP 800–171 self-assessment. To comply with 48 CFR 252.204–7019 (DFARS provision 252.204–7019) and DFARS clause 252.204–7020, self-assessment scores must be submitted.16 The highest score is 110, meaning all 110 NIST SP 800–171 security requirements have been fully implemented. If a contractor’s Supplier Performance Risk System (SPRS) score is less than 110, indicating security gaps exist, then the contractor must create a plan of action 17 identifying security tasks that still need to be accomplished. In essence, an SSP describes the cybersecurity plan the contractor has in place to protect CUI.

The SSP needs to address each NIST SP 800–171 security requirement and explain how the requirement is implemented. This can be through policy, technology, or a combination of both.

In November 2020, the DoD released its 48 CFR CMMC interim final rule, the Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements 18 (DFARS Case 2019– D041, 85 FR 61505, November 30, 2020). The goal of this rule was to increase compliance with its cybersecurity regulations and improve security throughout the DIB. This rule introduced one new provision and two new clauses—DFARS provision 252.204–7019, DFARS clause 252.204– 7020, and 48 CFR 252.204–7021 (DFARS clause 252.204–7021).

• DFARS provision 252.204–7019 complements DFARS clause 252.204–

7012 by requiring contractors to have a NIST SP 800–171 assessment (basic, medium, or high) according to NIST SP 800–171 DoD Assessment Methodology.19 Assessment scores must be reported to the Department via SPRS.

SPRS scores must be submitted by the time of contract award and not be more than three years old.

• DFARS clause 252.204–7020 notifies contractors that DoD reserves the right to conduct a higher-level assessment of contractors’ cybersecurity compliance, and contractors must give DoD assessors full access to their facilities, systems, and personnel.

Further, DFARS clause 252.204–7020 complements DFARS clause 252.204– 7012’s flow down requirements by holding contractors responsible for confirming their subcontractors have SPRS scores on file prior to awarding them contracts.

• DFARS clause 252.204–7021 paves the way for rollout of the CMMC Program. Once CMMC is implemented, the required CMMC Level and assessment type will be specified in the solicitation and resulting contract.

Contractors handling FCI or CUI will be required to meet the CMMC requirement specified in the contract. DFARS clause 252.204–7021 also stipulates contractors will be responsible for flowing down the CMMC requirements to their subcontractors.

CFR Part 170 Additional Requirements for Defense Contractors and Subcontractors Discussed in This Final Rule

When this 32 CFR part 170 CMMC Program rule and the complementary 48 CFR part 204 CMMC Acquisition rule are finalized and following a phased implementation plan, solicitations and resulting defense contracts involving the processing, storing, or transmitting of FCI or CUI on a non-Federal system will, unless waived, have a CMMC level and assessment type requirement that a contractor must meet to be eligible for a contract award. The four phases of the implementation plan add CMMC level requirements incrementally, starting in Phase 1 with self-assessments, and ending in Phase 4, which represents full implementation of program requirements. The DoD elected to base the phase-in plan on the level and type of assessment to provide time to train the necessary number of assessors, and to allow companies time to understand and implement CMMC requirements.

Details of each phase are addressed in

VerDate Sep<11>2014 18:51 Oct 11, 2024 Jkt 265001 PO 00000 Frm 00004 Fmt 4701 Sfmt 4700 E:\FR\FM\15OCR2.SGM 15OCR2kh am m on d on

D S

K

JM

1Z 7X

2P R

O D w ith

R U

LE

S http://www.acq.osd.mil/asda/dpc/cp/cyber/docs/safeguarding/NIST-SP-800-171-Assessment-Methodology-Version-1.2.1-6.24.2020.pdf http://www.acq.osd.mil/asda/dpc/cp/cyber/docs/safeguarding/NIST-SP-800-171-Assessment-Methodology-Version-1.2.1-6.24.2020.pdf http://www.acq.osd.mil/asda/dpc/cp/cyber/docs/safeguarding/NIST-SP-800-171-Assessment-Methodology-Version-1.2.1-6.24.2020.pdf http://www.dcsa.mil/Industrial-Security/National-Industrial-Security-Program-Oversight/32-CFR-Part-117-NISPOM-Rule/ http://www.dcsa.mil/Industrial-Security/National-Industrial-Security-Program-Oversight/32-CFR-Part-117-NISPOM-Rule/ http://www.dcsa.mil/Industrial-Security/National-Industrial-Security-Program-Oversight/32-CFR-Part-117-NISPOM-Rule/ http://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting http://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting http://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting http://www.govinfo.gov/content/pkg/FR-2020-12-21/pdf/2020-27698.pdf http://www.govinfo.gov/content/pkg/FR-2020-12-21/pdf/2020-27698.pdf http://www.acquisition.gov/far/52.204-21 http://www.federalregister.gov/documents/2020/09/29/2020-21123/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of http://www.sprs.csd.disa.mil/ http://www.federalregister.gov/documents/2020/09/29/2020-21123/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of http://www.federalregister.gov/documents/2020/09/29/2020-21123/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of http://www.federalregister.gov/documents/2020/09/29/2020-21123/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of

83095 Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

§ 170.3(e). In Phases 2 and 3, DoD will implement CMMC Level 2 and Level 3 certification requirements, respectively.

At full implementation (Phase 4), DoD will include CMMC requirements in all applicable DoD contracts and option periods on contracts awarded after the beginning of Phase 4.

Table 1 defines the requirements for each CMMC level and assessment type.

TABLE 1—CMMC LEVEL AND ASSESSMENT REQUIREMENTS

CMMC status Source & number of security reqts. Assessment reqts. Plan of action & milestones

(POA&M) reqts. Affirmation reqts.

Level 1 (Self) ... • 15 required by FAR clause 52.204–21.

• Conducted by Organization Seeking As-sessment (OSA) annually.

• Results entered into SPRS (or its suc-cessor capability).

• Not permitted ........................ • After each assessment.

• Entered into SPRS.

Level 2 (Self) ... • 110 NIST SP 800–171 R2 re-quired by DFARS clause 252.204–7012.

• Conducted by OSA every 3 years

• Results entered into SPRS (or its suc-cessor capability).

• CMMC Status will be valid for three years from the CMMC Status Date as defined in § 170.4.

• Permitted as defined in § 170.21(a)(2) and must be closed out within 180 days.

• Final CMMC Status will be valid for three years from the Conditional CMMC Status Date.

• After each assessment and annually thereafter.

• Assessment will lapse upon failure to annually affirm.

• Entered into SPRS (or its successor capability).

Level 2

(C3PAO).

• 110 NIST SP 800–171 R2 re-quired by DFARS clause 252.204–7012.

• Conducted by C3PAO every 3 years

• Results entered into CMMC Enterprise

Mission Assurance Support Service (eMASS) (or its successor capability).

• CMMC Status will be valid for three years from the CMMC Status Date as defined in § 170.4.

• Permitted as defined in § 170.21(a)(2) and must be closed out within 180 days.

• Final CMMC Status will be valid for three years from the Conditional CMMC Status Date.

• After each assessment and annually thereafter.

• Assessment will lapse upon failure to annually affirm.

• Entered into SPRS (or its successor capability).

Level 3

(DIBCAC).

• 110 NIST SP 800–171 R2 re-quired by DFARS clause 252.204–7012.

• 24 selected from NIST SP 800–172 Feb2021, as de-tailed in table 1 to § 170.14(c)(4).

• Pre-requisite CMMC Status of Level 2 (C3PAO) for the same CMMC Assess-ment Scope, for each Level 3 certification assessment.

• Conducted by Defense Contract Manage-ment Agency (DCMA) Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) every 3 years.

• Results entered into CMMC eMASS (or its successor capability).

• CMMC Status will be valid for three years from the CMMC Status Date as defined in § 170.4.

• Permitted as defined in § 170.21(a)(3) and must be closed out within 180 days.

• Final CMMC Status will be valid for three years from the Conditional CMMC Status Date.

• After each assessment and annually thereafter.

• Assessment will lapse upon failure to annually affirm.

• Level 2 (C3PAO) affirmation must also continue to be completed annually.

• Entered into SPRS (or its successor capability).

Program Walkthrough—Contractor Perspective

This section will provide a simplified walkthrough of the CMMC Program from the perspective of an Organization Seeking Assessment (OSA) seeking to comply with program requirements.

CMMC Level Selection

An OSA will select the CMMC level it desires to attain. Once the CMMC Program is implemented, a DoD solicitation will specify the minimum CMMC Status required to be eligible for award. One of four CMMC Statuses will be specified:

• Level 1 (Self) is a self-assessment to secure FCI processed, stored, or transmitted in the course of fulfilling the contract. The OSA must comply with the 15 security requirements set by FAR clause 52.204–21. All 15 requirements must be met in full—no exceptions are allowed.

• Level 2 (Self) is a self-assessment to secure CUI processed, stored, or transmitted in the course of fulfilling the contract. The OSA must comply with the 110 Level 2 security requirements derived from NIST SP 800–171 R2.

• Level 2 (C3PAO) differs from Level 2 (Self) in the method of verifying compliance. OSAs must hire a C3PAO to conduct an assessment of the OSA’s compliance with the 110 security requirements of NIST SP 800–171 R2.

OSAs can shop for C3PAOs on the CMMC Accreditation Body (AB) Marketplace.

• Level 3 (DIBCAC) is a government assessment of 24 additional requirements derived from NIST SP 800–172, titled ‘‘Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800–171,’’ February 2021 (NIST SP 800–172 Feb2021). The OSA must ensure that they have already achieved a CMMC Status of Final Level 2 (C3PAO) before seeking CMMC Status of Final Level 3 (DIBCAC). Once this is done, an OSA should then initiate a Level 3 certification assessment by emailing a request to Defense Contract Management Agency (DCMA) Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) point of contact found at www.dcma.mil/ DIBCAC, being sure to include the Level 2 (C3PAO) certification unique identifier in the email.

Scoping

In order to achieve a specified CMMC Status, OSAs must first identify which information systems, including systems or services provided by External Service Providers (ESPs), will process, store, or transmit FCI, for Level 1 (Self), and CUI for all other CMMC Statuses. These information systems constitute the scope of the assessment.

Within these information systems, for Level 2 and Level 3 the assets should be further broken down into asset categories: Contractor Risk Managed Assets (Level 2), Security Protection Assets (Level 2 and 3), and Specialized Assets (Level 2 and 3). For Level 1 all assets, with the exclusion of Specialized Assets, are simply identified as either in-scope or out-of-scope based on whether they process, store, or transmit FCI. Definitions and treatment of these categories as they relate to assessment scoping, treatment of ESPs, and treatment of assets which cannot be secured due to their inherent design, can be found at § 170.19.

Assessment and Affirmation

a. OSAs that meet all 15 Level 1 requirements have achieved CMMC Status of Final Level 1 (Self). The OSA

VerDate Sep<11>2014 18:51 Oct 11, 2024 Jkt 265001 PO 00000 Frm 00005 Fmt 4701 Sfmt 4700 E:\FR\FM\15OCR2.SGM 15OCR2kh am m on d on

D S

K

JM

1Z 7X

2P R

O D w ith

R U

LE

S http://www.dcma.mil/DIBCAC http://www.dcma.mil/DIBCAC

83096 Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations must submit an affirmation of compliance with FAR clause 52.204–21 requirements in SPRS. At this point, OSAs have satisfied the CMMC requirements needed for award of contracts requiring a CMMC Status of Final Level 1 (Self). To maintain a CMMC Status of Final Level 1 (Self), this entire process must be repeated in full on an annual basis, including both self-assessment and affirmation.

b. For Level 2 assessments, if all 110 requirements are satisfied, the assessment score will be 110 and the OSA will have achieved a CMMC Status of Final Level 2 (Self) or Final Level 2 (C3PAO) as applicable and is eligible for contract award as long as all other contractual requirements are met.

Not all requirements must immediately be MET to be eligible for contract award. If the minimum score is achieved on the assessment (equal to 80% of the maximum score) and certain critical requirements are met, OSAs will achieve a CMMC Status of Conditional Level 2 (Self) or Conditional Level 2 (C3PAO) as applicable. All NOT MET requirements must be noted in an assessment Plan of Action and Milestones (POA&M). At this point the OSA will have satisfied the CMMC requirements needed for contract award OSAs must have met all 110 security requirements of NIST SP 800–171 R2 within 180 days of receiving their Conditional CMMC Status, which must be verified with a second assessment, called a POA&M closeout assessment. If the POA&M closeout assessment finds that all requirements have been met, then the OSA will achieve a CMMC Status of Final Level 2 (Self) or Final Level 2 (C3PAO) as applicable.

However, if a POA&M closeout assessment does not find that all requirements have been met by the end of 180 days, then the CMMC Status of Conditional Level 2 (Self) or Conditional Level 2 (C3PAO) will expire. At this point, standard contractual remedies will apply.

The OSA should submit an affirmation into SPRS after achieving a CMMC Status of Conditional Level 2

(Self) or CMMC Status of Conditional Level 2 (C3PAO) as applicable. OSAs should submit an affirmation once a CMMC Status of Final Level 2 (Self) or Final Level 2 (C3PAO) as applicable is achieved. Being eligible for contracts subject to CMMC Level 2 (Self) also indicates eligibility for contracts subject to Level 1 (Self), and being eligible for contracts subject to CMMC Level 2 (C3PAO) also indicates eligibility for contracts subject to Level 1 (Self) and Level 2 (Self), assuming all other contractual requirements are met. OSAs must reaffirm in SPRS their compliance with CMMC Level 2 requirements annually but need only conduct a new assessment every three years. These deadlines are based on the CMMC Status Date of the Conditional Status if a POA&M was required or the Final Status if the assessment resulted in a score of 110. CMMC Status date is not based on the date of a POA&M closeout assessment.

c. For Level 3 assessments, OSAs should note that asset categories are assessed against security requirements differently than they are at Level 2. In particular, Contractor Risk Managed Assets identified in a Level 2 scope are treated as CUI Assets if they reside within a Level 3 scope. Definitions and treatment of these assets at Level 3 as they relate to scoping of the assessment, in addition to treatment of ESPs, are described in § 170.19(d).

During the course of assessment, DCMA DIBCAC will focus on assessing compliance with all 24 selected requirements derived from NIST SP 800–172 Feb2021, but limited checks may be performed on the 110 requirements from NIST SP 800–171 R2.

If DCMA DIBCAC identifies that all 24 requirements from NIST SP 800–172 Feb2021 are satisfied, the OSA will have achieved a CMMC Status of Final Level 3 (DIBCAC) and is eligible for contract award as long as all other contractual requirements are met. Not all requirements must immediately be MET to be eligible for contract award. If the minimum score is achieved on the assessment (equal to 80% of the maximum score of 24) and certain critical requirements are met, OSAs will achieve a CMMC Status of Conditional Level 3 (DIBCAC), and all NOT MET requirements must be noted in a POA&M. At this point the OSA will have satisfied the CMMC requirements needed for contract award.

OSAs must have met all 24 selected security requirements of NIST SP 800– 172 Feb2021 within 180 days of receiving their Conditional CMMC Status, which must be verified with a POA&M closeout assessment by DCMA DIBCAC. If the POA&M closeout assessment finds that all requirements have been met, then the OSA will achieve a CMMC Status of Final Level 3 (DIBCAC). However, if a POA&M closeout assessment does not find that all requirements have been met by the end of 180 days, then the CMMC Status of Conditional Level 3 (DIBCAC) will expire. At this point, standard contractual remedies will apply.

The OSA should submit an affirmation into SPRS after achieving a CMMC Status of Conditional Level 3 (DIBCAC) if applicable and once a CMMC Status of Final Level 3 (DIBCAC) is achieved. Being eligible for contracts subject to CMMC Level 3 (DIBCAC) also indicates eligibility for contracts subject to Level 1 (Self), Level 2 (Self), and Level 2 (C3PAO), assuming all other contractual requirements are met. To maintain CMMC Level 3 (DIBCAC) status, an OSA must undergo both a Level 2 certification assessment and a Level 3 certification assessment every three years and separately affirm compliance with Level 2 and Level 3 requirements in SPRS annually. These deadlines are based on the CMMC Status Date of the Conditional certification if applicable or the CMMC Status Date of the Final determination.

CMMC Status Date is not based on the date of a POA&M closeout assessment.

Flow-Down

If the OSA employs subcontractors to fulfill the contract, those subcontractors must also have a minimum CMMC Status as shown in table 2.

TABLE 2—MINIMUM FLOW-DOWN REQUIREMENTS

Prime contractor requirement

Minimum subcontractor requirement If the subcontractor will process, store, or transmit

FCI CUI

Level 1 (Self) ...................................................... Level 1 (Self) .................................................... N/A.

Level 2 (Self) ...................................................... Level 1 (Self) .................................................... Level 2 (Self).

Level 2 (C3PAO) ................................................ Level 1 (Self) .................................................... Level 2 (C3PAO).

Level 3 (DIBCAC) ............................................... Level 1 (Self) .................................................... Level 2 (C3PAO).

VerDate Sep<11>2014 18:51 Oct 11, 2024 Jkt 265001 PO 00000 Frm 00006 Fmt 4701 Sfmt 4700 E:\FR\FM\15OCR2.SGM 15OCR2kh am m on d on

D S

K

JM

1Z 7X

2P R

O D w ith

R U

LE

S

83097 Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations

Summary of Provisions Contained in This Rule

Section 170.1 Purpose

Section 170.1 addresses the purpose of this rule. It describes the CMMC Program and establishes policy for requiring the protection of FCI and CUI that is processed, stored, or transmitted on defense contractor and subcontractor information systems. The security standards utilized in the CMMC Program are from the FAR clause 52.204–21; DFARS clause 252.204–7012 that implements NIST SP 800–171 R2;

and selected requirements from the NIST SP 800–172 Feb2021, as applicable. The purpose of the CMMC Program is for contractors and subcontractors to demonstrate that FCI and CUI being processed, stored, or transmitted is adequately safeguarded through the methodology provided in the rule.

Section 170.2 Incorporation by Reference

Section 170.2 addresses the standards and guidelines that are incorporated by reference. The Director of the Federal Register under 5 U.S.C. 552(a) and 1 CFR part 51 approves any materials that are incorporated by reference. Materials that are incorporated by reference in this rule are reasonably available.

Information on how to access the documents is detailed in § 170.2.

Materials that are incorporated by reference in this rule are from the NIST (see § 170.2(a)), the Committee on National Security Systems (see § 170.2(b)), and the International Organization for Standardization/ International Electrotechnical Commission (ISO/IEC) (see § 170.2(c)) which may require payment of a fee.

Note: While the ISO/IEC standards are issued jointly, they are available from the ISO Secretariat (see § 170.2(c)).

The American National Standards Institute (ANSI) IBR Portal provides access to standards that have been incorporated by reference in the U.S.

Code of Federal Regulations at https:// ibr.ansi.org. These standards incorporated by the U.S. government in rulemakings are offered at no cost in ‘‘read only’’ format and are presented for online reading. There are no print or download options. All users will be required to install the FileOpen plug-in and accept an online end user license agreement prior to accessing any standards.

The materials that are incorporated by reference are summarized below.

(a) Federal Information Processing Standard (FIPS) Publication (PUB) 200

(FIPS PUB 200), titled ‘‘Minimum Security Requirements for Federal Information and Information Systems,’’ is the second of two security standards mandated by the Federal Information Security Management Act (FISMA). It specifies minimum security requirements for information and information systems supporting the executive agencies of the Federal government and a risk-based process for selecting the security controls necessary to satisfy the minimum-security requirements. This standard promotes the development, implementation, and operation of more secure information systems within the Federal Government by establishing minimum levels of due diligence for information security and facilitating a more consistent, comparable, and repeatable approach for selecting and specifying security controls for information systems that meet minimum security requirements.

This document is incorporated by reference as a source for definitions.

(b) FIPS PUB 201–3, titled ‘‘Personal Identity Verification (PIV) of Federal Employees and Contractors,’’ establishes a standard for a PIV system that meets the control and security objectives of Homeland Security Presidential Directive-12. It is based on secure and reliable forms of identity credentials issued by the Federal Government to its employees and contractors. These credentials are used by mechanisms that authenticate individuals who require access to federally controlled facilities, information systems, and applications.

This Standard addresses requirements for initial identity proofing, infrastructure to support interoperability of identity credentials, and accreditation of organizations and processes issuing PIV credentials. This document is incorporated by reference as a source for definitions.

(c) NIST SP 800–37, titled ‘‘Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,’’ Revision 2 (NIST SP 800–37 R2), describes the Risk Management Framework (RMF) and provides guidelines for applying the RMF to information systems and organizations.

The RMF provides a disciplined, structured, and flexible process for managing security and privacy risk that includes information security categorization; control selection, implementation, and assessment;

system and common control authorizations; and continuous monitoring. The RMF includes activities to prepare organizations to execute the framework at appropriate risk management levels. The RMF also promotes near real-time risk management and ongoing information system and common control authorization through the implementation of continuous monitoring processes; provides senior leaders and executives with the necessary information to make efficient, cost-effective, risk management decisions about the systems supporting their missions and business functions;

and incorporates security and privacy into the system development life cycle.

Executing the RMF tasks links essential risk management processes at the system level to risk management processes at the organization level. In addition, it establishes responsibility and accountability for the controls implemented within an organization’s information systems and inherited by those systems. This document is incorporated by reference as a source for definitions.

(d) NIST SP 800–39, titled ‘‘Managing Information Security Risk: Organization, Mission, and Information System View,’’ March 2011 (NIST SP 800–39 Mar2011), provides guidance for an integrated, organization-wide program for managing information security risk to organizational operations (i.e., mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation resulting from the operation and use of Federal information systems.

NIST SP 800–39 Mar2011 provides a structured, yet flexible approach for managing risk that is intentionally broad-based, with the specific details of assessing, responding to, and monitoring risk on an ongoing basis provided by other supporting NIST security standards and guidelines. The guidance provided in this publication is not intended to replace or subsume other risk-related activities, programs, processes, or approaches that organizations have implemented or intend to implement addressing areas of risk management covered by other legislation, directives, policies, programmatic initiatives, or mission/ business requirements. Rather, the risk management guidance described herein is complementary to and should be used as part of a more comprehensive Enterprise Risk Management (ERM) program. This document is incorporated by reference as a source for definitions.

(e) NIST SP 800–53, titled ‘‘Security and Privacy Controls for Information Systems and Organizations,’’ Revision 5 (NIST SP 800–53 R5), provides a catalog of security and privacy controls for information systems and organizations to protect organizational operations and assets, individuals, other organizations, VerDate Sep<11>2014 18:51 Oct 11, 2024 Jkt 265001 PO 00000 Frm 00007 Fmt 4701 Sfmt 4700 E:\FR\FM\15OCR2.SGM 15OCR2kh am m on d on

D S

K

JM

1Z 7X

2P R

O D w ith

R U

LE

S https://ibr.ansi.org https://ibr.ansi.org

83098 Federal Register / Vol. 89, No. 199 / Tuesday, October 15, 2024 / Rules and Regulations and the Nation from a diverse set of threats and risks, including hostile attacks, human errors, natural disasters, structural failures, foreign intelligence entities, and privacy risks. The controls are flexible and customizable and implemented as part of an organization-wide process to manage risk. The controls address diverse requirements derived from mission and business needs, laws, executive orders, directives, regulations, policies, standards, and guidelines. Finally, the consolidated control catalog addresses security and privacy from a functionality perspective (i.e., the strength of functions and mechanisms provided by the controls) and from an assurance perspective (i.e., the measure of confidence in the security or privacy capability provided by the controls).

Addressing functionality and assurance helps to ensure that information technology products and the systems that rely on those products are sufficiently trustworthy. This document is incorporated by reference as a source for definitions.

(f) NIST SP 800–82r3, titled ‘‘Guide to Operational Technology (OT) Security,’’ September 2023 (NIST SP 800–82r3), provides guidance on how to secure ICS, including Supervisory Control and Data Acquisition (SCADA) systems, Distributed Control Systems (DCS), and other control system configurations such as Programmable Logic Controllers (PLC), while addressing their unique performance, reliability, and safety requirements. The document provides an overview of ICS and typical system topologies, identifies typical threats and vulnerabilities to these systems, and provides recommended security countermeasures to mitigate the associated risks. This document is incorporated by reference as a source for definitions.

(g) NIST SP 800–115, titled ‘‘Technical Guide to Information Security Testing and Assessment,’’ September 2008 (NIST SP 800–115 Sept2008), assists organizations in planning and conducting technical information security tests and examinations, analyzing findings, and developing mitigation strategies. The guide provides practical recommendations for designing, implementing, and maintaining technical information security test and examination processes and procedures.

These can be used for several purposes, such as finding vulnerabilities in a system or network and verifying compliance with a policy or other requirements.