DOPSR_Cleared_OSD_Memo_CMMC_Implementation_Policy_d26075de0f.pdf

OFFICE OF THE SECRETARY OF DEFENSE

1000 DEFENSE PENTAGON

WASHINGTON, DC 20301 -1000

MEMORANDLM FOR SENIOR PENTAGON LEADERSHIP

DEFENSE AGENCY AND DOD FIELD ACTIVITY DIRECTORS

SUBJECT: Implementing the Cybersecurity Maturity Model Certification (CMMC) Program:

Guidance for Detem1ining Appropriate CMMC Compliance Assessment Levels and Process for Waiving CMMC Assessment Requirements

The defense industrial base (DIB) is the target of recurrent and progressively sophisticated cyber attacks targeting Control led Unclassified Information (CLI) and Federal Contract Information (FCI) processed in, stored on. or transmitted over nonfederal unclassified information systems. These attacks threaten Department of Defense (DoD or Department) mission execution, reduce warfi ghting capabi lities, weaken American technological superiority, and exfiltrate intellectual property and national security information. The Department is undertaking multiple efforts to reduce the risk ofcyber attacks to DIB businesses.

Defense contractors and subcontractors are required to safeguard unclassified nonpublic information by applying specified network securi ty requirements, as defined in DoD Instruction 8582.01, Security ofNon-DoD Information Systems Processing Unclassified Nonpublic DoD Information, which includes identified CUI and FCI that resides in or transits contractor unclassified information systems. Title 32 of the Code of Federal Regulations (CFR) § 2002 describes requirements for adequate safeguarding that, in the context of Defense contracts, are implemented through Defense Federal Acquisition Regulation Supplement (DF ARS) clause 252.204-7012, Safeguarding Covered Defense Information and C)iber Incident Reporting. This clause appl ies to contracts that require the processing, storing, or transmitting of CUI on contractor-owned information systems.

To enhance the securi ty of DoD information and reduce the risk of cyber attacks to DIB businesses, the Department established the Cybersecurity Maturity Model Certification (CMMC) Program. The final CMMC Program rule was published to the Federal Register on October 15 , 2024 and is codified in Title 32 CFR Part 170. The CMMC Program requires pre-award assessment of covered contractor information systems against prescribed cybersecuri ty standards for safeguarding CUI or FCI. The CMMC Program will implement pre-award assessments of contractor compliance with the appropriate information safeguarding requirements. Title 32 CFR § 170 defines applicabil ity of CMMC requirements and Title 48 CFR DFARS provisions and clauses will implement those requirements.

Upon publication of the final Title 48 CFR DFARS rule, 20 I 9-D04 I, Program Managers and requiring activities shall include the need for CMMC assessments in procurement request and requirement documents in accordance with phase-in timelines described in Title 32 CFR §

170.3. Attachment I to this memorandum provides Program Managers and requiring activities guidance to apply when determining the appropriate CMMC assessment level to include in each DoD solicitation and contract. Service and Component Acquisition Executives are authorized to waive inclusion of CMMC assessment requirements in DoD solicitations. Waivers are discussed in Attachment 2.

January 15, 2025 dkluzik Cleared

At the conclusion of the phase-in period. Program Managers and requiring activities will designate a CMMC level for each contract. as appropriate. according to attributes of the information that will be processed, stored, or transmitted on covered contractor information systems, as described in Attachment 1. Service and Component Acquisition Executives may~ after following approved procedures, waive CMMC assessment requirements, as described in Attachment 2. A waiver of CMMC assessment requirements does not affect the underlying security requirements, or current policy, that may apply (including, but not limited to, Federal Acquisition Regulation (FAR) clause 52.204-21 and OFARS clause 252.204-7012)~ which will remain in effect.

Finally. when a requirement is expected to result in award of anon-FAR based grant or other legal agreement, Program Managers and requiring activities are still expected to follow the CMMC Level Determination Guide (Attachment 1) to select an appropriate CMMC level requirement.

The Office of the DoD Chief Information Officer intends to incorporate the attached policies into one or more DoD Instructions, as appropriate. Additionally. the Department will revise DoD Instruction 8582.01 to provide guidance for applying the enhanced protections provided by National Institute of Standards and Technology (NIST) Special Publication (SP) 800-172, which are carried forward in CMMC Level 3. The CMMC Program Management • Office is the point of contact for this effort: osd.pentagon.dod-cio.list.cmmc-mbx@mail.mil.

The Office of the Under Secretary of Defense for Research and Engineering will publish and maintain a guidebook with additional details for the application of NIST SP 800-172 at https://aaf.dau.edu/guidebook.

~~~.A-- ~~~ Heidi Shyu .lftN 1 5 2025 Under Secretary of Defen§'ew Acting Chief Information Officer for Research and Engineering of the Department of Defense

Dr William LaPlante Under Secretary of Defense for Acquisition and Sustainment

Attachments:

As stated https://aaf.dau.edu/guidebook mailto:osd.pentagon.dod-cio.list.cmmc-mbx@mail.mil

Attachment 1 Cybersecurity Maturity Model Certification Level Determination

Defense Federal Acquisition Regulation Supplement (OF ARS) clause 252.204-7012 and Federal Acquisition Regulation (FAR) clause 52.204-21 establish the cybersecurity requirements for FAR-based contracts. Title 32 of the Code of Federal Regulations (CFR) § 170.3 (e) describes a phased implementation plan for assessment of compliance with these requirements under the CMMC Program.

Program Managers and requiring activities shall follow the CMMC Program implementation phases defined in Title 32 CFR § I 70.3(e). Upon publication of the final Title 48 CFR OF ARS rule, 2019-D041, all procurement requests that may result in a contract where the contractor or a subcontractor. at any tier. may have Federal Contract Information (FCI). as defined in FAR clause 52.204-7021, residing in or transiting through its information system shall include CMMC Level I.

One year after publication of the OF ARS rule, Program Managers and requiring activities shall also begin to require CMMC Level 2 certification assessments. when appropriate. In two years, Program Managers and requiring activities shall begin to implement CMMC Level 3 certification assessment requirements, when appropriate.

In accordance with DFARS Procedures, Guidance. and Information 204.7303-l(b)(l ). the requiring activity must notify the contracting officer when an effort is expected to result in a contract, task order, or delivery order that will involve covered defense information (including Controlled Unclassified Information (CUI)) or operationally critical support. Covered defense information is defined in OF ARS clause 252.204-7012. In order to appropriately apply information safeguarding requirements, when the effort will involve CUI, the requiring activity must also identify whether CMMC Level 2 self-assessment of certification assessment is the minimum requirement. Contacting Officers will rely on information provided by the requiring activity to communicate the applicable CMMC level requirements to offerors and contractors.

CMMC Level 3 assessments shall be required when DoD policy requires the application of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-172.

The enhanced protections of NIST SP 800-172 must be applied to safeguard CUI associated with mission critical or unique technologies and programs. Program Managers and requiring activities must also carefully consider the risks associated with the security of the subcontractors· nonfederal information systems in the multi-tier supply chain and provide additional solicitation guidance regarding the extent to which CMMC Level 3 requirements must be flowed down.

The Department is updating Do DI 8582.0 I. Security ofNon-DoD b?formarion Sys/ems Processing Unc/assffied Nonpublic DoD lrformation, and is developing a Defense Acquisition University guidebook. to include guidance for applying NIST SP 800-172.

DoD Program Managers and requiring activities will use the following CMMC Level Determination Guide to identify the appropriate CMMC level for a given contract. When a contract effort will result in CUI being processed. stored. or transmitted on a contractor information system that meets multiple CMMC level determination criteria, Program Managers and requiring activities shall select the highest applicable CMMC level. The guidance contained herein addresses the minimum required assessment levels and does not preclude selection of a higher CMMC level requirement when security needs dictate.

Until supplanted by a DoD Instruction, this CMMC Level Determination Guide defines the minimum CMMC level requirement. Other DoD policies, regulations, or security concerns may necessitate selection of a higher CMMC level requirement. Service and Component Acquisition Executives may issue supplementary guidance to ensure CMMC requirements are consistently applied, in particular for CMMC Level 3 Certification assessments. Flow-down requirements for all other CMMC assessment requirements are defined in Title 32 CFR § 170.23.

CMMC Level Determination Guide

CMMC Level 1 CMMC Level 2 CMMCLevel2 CMMC Level 3 (Self-Assessment) (Self-Assessment) (Certification) (Certification)

1/.'hen enhanced NIST SP 800-172 protections are reqc red

O!.her progra11s or ldhncloru des.~na'.ed b/ the

SAE CAE Pr.• requi• ng acti, lies

CUI CJl('gcr1es in !tie Defense Org,in1z.1? cndl lnde, G1oup c 9 Ccn~rc5ecJ Tect1n cal fnfo•rr.,3•on

,.... ~' _J't'_;(,• ~~

CAE:C0ml)Onent Acqui,,bon Executr<e CUI:Corwoted Unclassified Information FCI: Ftdenll ContrKI lnfarmetion PM:Progrwm M_, SAE: SefVice ~ition Execwve

CMMC Level 1 (Self-Assessment) - Assessed against the FAR clause 52.204-21:

• FAR clause 52.204-21 applies to FCI. This clause does not apply to information provided by the Government to the public, such as on public websites, or simple transactional information, such as is necessary to process payments.

• If the planned contract, task order, or delivery order may require the contractor (or subcontractors at any tier) to process, store, or transmit only FCI in its information system, the appropriate assessment requirement is CMMC Level 1 Self-Assessment.

CMMC Level 2 - Assessed against the NIST SP 800-171:

• DFARS clause 252.204-7012 applies when CUI will be processed, stored, or transmitted on contractor-owned information systems in the performance of a DoD contract and flows down to subcontracts, or similar contractual instruments, as described in OF ARS clause 252.204- 7012.

• If the planned contract will require the contractor ( or subcontractors) to process, store, or transmit CUI on a contractor-owned information system, compliance must be assessed against NIST SP 800-171 requirements.

o CMMC Level 2 (Self-Assessment) is the minimum assessment requirement for CUI.

It is sufficient only for CUI outside of the National Archive' s CUI Registry Defense Organizational Index Grouping. Category markings and definitions may be found on the CUI Registry at https://www.archives.gov/cui. The Program Manager may elevate the CMMC level if there is high risk to the confidentiality, integrity, or availability of the CUI.

o CMMC Level 2 (Certification) is the minimum assessment requirement when the planned contract will require the contractor (or subcontractors) to process, store, or transmit CUI categorized under the National Archive·s CUI Registry Defense Organizational Index Grouping. Category markings and definitions may be found on the CUI Registry at https://www.archives.gov/cui. CMMC Level 2 certification assessment is performed by third-party assessors employing the methods described in

NIST SP 800-171A.

CMMC Level 3 (Certification) - Assessed by DoD officials against select controls in NIST SP 800-172:

• The enhanced protections of NIST SP 800-172 must be applied to safeguard mission critical or unique technologies and programs associated with the following factors/scenarios.

Compliance with NIST SP 800-172 is a significant effort. Program Managers and requiring activities must carefully consider the need for safeguarding of the particular CUI to be shared and avoid overuse of the CMMC Level 3 requirement.

o CUI associated with a breakthrough. unique. and/or advanced technology;

o Significant aggregation or compilation of CUI in a single information system or IT environment; and o Ubiquity - when an attack on a single information system or IT environment would result in widespread vulnerability across DoD.

• The Office of the Under Secretary of Defense for Research and Engineering will publish and maintain a guidebook with additional details for the application of NIST SP 800-172 at https://aaf.dau.cdu/guidebook.

• If the planned contract will require the contractor ( or subcontractors) to process, store, or transmit CUI that requires enhanced protections provided by NIST SP 800-172, then the minimum assessment requirement is CMMC Level 3 (Certification).

o DoD Program Managers and requiring activities will determine if a contract effort requires the contractor ( or subcontractors) to process. store, or transmit CUI within nonfcderal unclassified information systems pertaining to the essential technology clements identified for prioritized protection through application of the NIST SP 800- 172 requirements described in DoD Instruction 8582.01.

o When CMMC Level 3 is warranted. a Security Classification Guide must be provided to communicate any CUI distribution limitations or instructions and allow for the segregation of information such that information that need not be covered by CMMC Level 3 can be handled appropriately at levels below CMMC level 3 throughout the supply chain. Failure to do so may result in the CMMC Level 3 requirements being unnecessarily flowed down to all sub-tiers at significant cost to the program.

https://aaf.dau.cdu/guidebook https://www.archives.gov/cui https://www.archives.gov/cui

ATTACHMENT 2

CYBERSECURITY MATURITY MODEL CERTIFICATION WAIVER

APPLICABILITY AND REPORTING REQUIREMENTS

Program Managers or requiring activities may request Service Acquisition Executive (SAE) or Component Acquisition Executive (CAE) approval to waive CMMC assessment requirements that would otherwise apply (including invoking lesser CMMC assessment levels), within the parameters below, or as supplemented by policies that SAEs or CAEs may issue. All CMMC waiver requests must be coordinated through the component Chief Information Officer (CIO) prior to SAE or CAE approval. For programs under Defense Acquisition Executive (DAE) oversight, Program Managers shall coordinate waiver requests through the component CIO. Program Executive Officer. CAE or SAE. and the Office of the DoD CIO at osd.pentagon.dod-cio.list.cmmc-mbx@mail.mil prior to DAE approval.

CMMC waivers may be requested and approved for an individual procurement or a class of procurements, and waivers will impact only whether CMMC assessments must be included in solicitation documents and resultant contracts. CMMC assessment waivers do not affect the underlying security requirements of Federal Acquisition Regulation (FAR) clause 52.204-21.

Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, or National Institute of Standards and Technology (NIST) Special Publication (SP) 800-172, when applicable pursuant to DoD policy. All agencies are required by Title 32 of the Code of Federal Regulations (CFR) § 2002 to use NIST SP 800-171 when establishing requirements to protect Controlled Unclassified Information (CUI) on nonfederal information systems. Refer to DoD Instruction 8582.01. Security of!v'on-DoD !,?formation Sysrems Processing Unclass~fied Nonpublic DoD Jnformarion, for additional guidance on security of non-DoD information systems processing unclassified DoD information.

Waiver Reporting Requirements:

SA Es and C AEs will report CMMC waiver data quarterly to the Under Secretary of Defense (USO) for Acquisition and Sustainment, the USO for Intelligence and Security, the USO for Research and Development, and the Office of the DoD CIO. Reports can me made via postings to osd.pentagon.dod-cio.list.cmmc-mbx@mail.mil. The report will enumerate all contracts awarded with CMMC assessment requirements waived, by the certification level that would otherwise have applied, and will identify common Product Service Codes or other relevant information that may explain market circumstances necessitating such assessment waivers.

Phase-In of CMMC Assessment Requirements, Including Waiver Process:

Program Managers and requiring activities should identify information security requirements for the types of information most likely to be associated with the planned contract effort. When market research indicates that including a CMMC assessment requirement may impede ability to generate robust competition or delay delivery of mission critical capabilities, the SAE, C AE. or DAE may approve requests to waive inclusion of CMMC assessment requirements. SAEs and CAEs must carefully weigh the risk of potential loss of CUI associated with mission critical capabilities before granting a waiver. SAEs and CAEs must recognize the following waiver limitations and may supplement this guidance with specific information, formatting, and coordination requirements.

1. CMMC Level 1 requirements: CMMC Level 1 is a self-assessment requirement designed to provide added insight into or assurance of the offeror' s compliance with requirements defined in FAR clause 52.204-21 for the safeguarding of Federal Contract Information (FCI). This is the most basic level of cybersecurity posture. There are no circumstances likely to warrant approval of requests to waive CMMC Level 1 requirements .

.., CMMC Level 2 requirements: CMMC Level 2 can be a self-assessment requirement or an independent third-party assessment.

a. Effective September 29, 2020, DFARS Subpart 204.73, Safeguarding Covered Defense Information and Cyber lncidenl Reporting, was amended to require the inclusion of DFARS clause 252.204-7019, No/ice ofNIST SP 800-17 I DoD Assessment Requirements. in all solicitations. except those solely for the acquisition of commercial off-the-shelf items. This provision requires offerors to provide a current NIST SP 800-171 DoD Assessment on record. prior to contract award. whenever the offeror is required to implement NIST SP 800-171, pursuant to DFARS clause :252.204-7012. Due to this pre-existing minimum requirement for a Basic self-assessment under DFARS 25:2.204-7019 and the ability to establish corrective Plans of Action and Milestones: there are no circumstances likely to warrant approval of requests to waive CMMC Level 2 self-assessment requirements.

b. In rare circumstances. such as when seeking competition from non-traditional DoD sources. waivers may be warranted for CMMC Level 2 third-party assessment requirements. Such waivers are not appropriate for contracts requiring performance by a cleared defense contractor. Approved waivers on a class basis must include a planned expiration date and guidance for requiring CMMC certification in subsequent solicitations. In all such cases, the solicitation must include a requirement to submit alternate protection plans for securing FCI or Controlled Unclassified Information (CUI) data. The alternate protection plans must be evaluated as part of the selection process.

3. CMMC Level 3 requirements: Level 3 requirements are intended to protect CUI associated with the Departmenf s mission critical technologies and programs and result in an assessment performed by the Defense Contract Management Agency's Defense Industrial Base Cvbersecuritv Assessment Center. In rare circumstances, waivers mav be warranted for CMMC Level 3 third-party assessment requirements: such waivers, however, are not appropriate for contracts or work statements requiring access to both unclassified and classified DoD infonnation.

Accessibility Report

Filename:

Section 508_DoD CIO Tri Signed CMMC Implementation Policy Memos.pdf

Report created by:

Jacob Lehmann, Cybersecurity Policy Analyst, jacob.m.lehmann.ctr@mail.mil

Organization:

DoD CIO, CMMC Program Management Office

[Personal and organization information from the Preferences > Identity dialog.]

Summary

The checker found no problems in this document.

Needs manual check: 0

Passed manually: 2

Failed manually: 0

Skipped: 1

Passed: 29

Failed: 0

Detailed Report

Document

Rule Name Status Description

Accessibility permission flag Passed Accessibility permission flag must be set

Image-only PDF Passed Document is not image-only PDF

Tagged PDF Passed Document is tagged PDF

Logical Reading Order Passed manually Document structure provides a logical reading order

Primary language Passed Text language is specified

Title Passed Document title is showing in title bar

Bookmarks Passed Bookmarks are present in large documents

Color contrast Passed manually Document has appropriate color contrast

Page Content

Rule Name Status Description

Tagged content Passed All page content is tagged

Tagged annotations Passed All annotations are tagged

Tab order Passed Tab order is consistent with structure order

Character encoding Passed Reliable character encoding is provided

Tagged multimedia Passed All multimedia objects are tagged

Screen flicker Passed Page will not cause screen flicker

Scripts Passed No inaccessible scripts

Timed responses Passed Page does not require timed responses

Navigation links Passed Navigation links are not repetitive

Forms

Rule Name Status Description

Tagged form fields Passed All form fields are tagged

Field descriptions Passed All form fields have description

Alternate Text

Rule Name Status Description

Figures alternate text Passed Figures require alternate text

Nested alternate text Passed Alternate text that will never be read

Associated with content Passed Alternate text must be associated with some content

Hides annotation Passed Alternate text should not hide annotation

Other elements alternate text Passed Other elements that require alternate text

Tables

Rule Name Status Description

Rows Passed TR must be a child of Table, THead, TBody, or TFoot

TH and TD Passed TH and TD must be children of TR

Headers Passed Tables should have headers

Regularity Passed Tables must contain the same number of columns in each row and rows in each column

Summary Skipped Tables must have a summary

Lists

Rule Name Status Description

List items Passed LI must be a child of L

Lbl and LBody Passed Lbl and LBody must be children of LI

Headings

Rule Name Status Description

Appropriate nesting Passed Appropriate nesting

Back to Top