Get Support
Book Discovery Session

CMMC 2.0 : The Sky is NOT Falling!

Eric Bragger
November 4, 2021

Big changes are coming to CMMC, but there is little impact to DoD contractors in the short term.

This post is my personal interpretation and opinion on the CMMC 2.0 information released on November 4th, 2021. This should not be construed as legal or contractual advice. No warranties are expressed or implied.

Overall Recommendation to DoD Contractors

Stay the course, with only minor adjustments. More details below.

CMMC 2.0 Explained

  • CMMC 2.0 is not yet in effect. The "advanced notice of proposed rulemaking" (2021-24160) is a strong indication of what's coming, which is a relaxation of the CMMC compliance requirements. The withdrawal of this notice is likely because it was published earlier than scheduled, but may also indicate that DoD decided some more coordination is needed behind the scenes.

  • CMMC 2.0 will not be required until a rule is published in the Federal Register that states the effective date it can go into contracts. DoD OUSD(A&S) states that two rules are intended, one in Title 32 of the Code of Federal Regulations (CFR) and the other for DFARS in Title 48 of the CFR. DoD OUSD(A&S) currently estimates the rulemaking process could take 9-24 months.

  • CMMC 2.0 may change significantly by the time one or both rules are published.

  • CMMC 1.0 Level 3 will likely be replaced by CMMC 2.0 Level 2 and will only require controls/practices "aligned with" the 110 NIST SP 800-171 controls instead of the 130 CMMC 1.0 Level 3 controls/practices with Maturity Level processes. This will cause significant market confusion.

  • CMMC 1.0 Levels 4-5 will likely be replaced by CMMC 2.0 Level 3 and will require unspecified controls/practices "based on" NIST SP 800-172 in addition to the 110 controls/practices "aligned with" NIST SP 800-171.

  • Plans of Action & Milestones (POA&M) items that are "time-bound" and "enforceable" will likely be permitted for deficient controls without failing compliance. Waivers that are "selective" and "time-bound" will also have a process.

  • The DFARS Interim Rule (DFARS 252.204-7012/7019/7020/7021) is still in effect with the exception that CMMC Pilot programs have been suspended. Click here for more information on the DFARS Interim Rule.

Detailed Recommendations to Contractors



New call-to-action

Subscribe by Email