DoD published 48 CFR Parts 204, 212, 217, and 252—Contracting Officer’s CMMC rules!

DoD has published for public comment the DoD’s proposed amendments to 48 Code of Federal Regulation (CFR) Chapter 2 Defense Acquisition Regulations System (DFARS) Subparts 204, 212, 217, and 252 (DFARS Case 2019-D041/Docket DARS-2020-0034) on 15 August 2024. With this call for public comment, DoD is one step closer to being able to write into contracts, task orders, and delivery orders the specific Cybersecurity Maturity Model Certification (CMMC) requirements for vendors to meet.

These proposed amendments are what some people refer to as the Title 48 Rule for CMMC. With these amendments, DoD has published what it anticipates will become authoritative guidance to DoD Contracting Officers. The guidance will, to a lesser degree, also affect members of the Defense Industrial Base (DIB), for implementing CMMC.

This set of amendments do not change or adjust the rules most of us think about when we hear ‘CMMC’—those fall under Title 32 CFR National Defense Part 170 CMMC. For the non-acquisition minded, you can also think of Title 32 CFR as the many definitions and authorities to create the CMMC program. Title 48 CFR defines the Federal Acquisition System (FAR). Chapter 2 of the FAR defines what is commonly known as the DFAR (Defense Federal Acquisition Regulation Supplement). The DFAR provides all the DoD-specific guidance to DoD contracting officials and acquisition specialists so they can keep their respective organizations consistent across the vastness of the DoD. All the proposed changes lie within the DFAR chapter of the FAR.

So what does this mean for members of the DIB?? It means we have just under 60 days (15 October 2024) to submit comments that can improve the contractual language of the future! Stay tuned for Planet Technologies Inc's perspective on the important takeaways.