Today is the last working Monday of 2023, and it is a day spent waiting, like so many other days this year. CMMC has yet to drop as an interim proposed rule or as a final rule. The imminent arrival has been pending since November 22, 2023, when OIRA gave the rule the green light.
Waiting for CMMC to appear in contracts is not just a 2023 phenomenon. In fact, the journey began in 2020. The first interim rule for CMMC 1.0 was published in September 2020. The first rendition of CMMC had five levels and it was proposed the rule would roll out over a five-year period. The rule went into effect a couple of months later, but there was a tremendous amount of pushback, especially from the DIB (Defense Industrial Base).
By March 2021, the Department of Defense was reviewing CMMC and parsing through the hundreds of public comments it had received. In response, CMMC 2.0 was announced in November 2021. This new version of CMMC had only three levels and was viewed as being more streamlined. CMMC 1.0 was put on hold indefinitely. It was forecast at the time that CMMC would take approximately two years to complete the rulemaking process.
In early 2023, there was talk that CMMC might be published in May 2023. However, May came and went with no movement on CMMC. The rule had not even been sent to the Office of Budget and Management (OBM) yet. In fact, OIRA did not receive the rule submission until September 2023.
The expectation was that OIRA would give the green light to CMMC within a month or so. The much sought-after confirmation finally appeared on November 22, 2023, and every day since then it has been assumed the rule would be published any minute, either as an interim final rule or as a proposed rule. As of this post, on December 18, 2023, the rule has not yet appeared. Although the chances are slim that it will be published as an interim final rule, the small chance that the rule could go into effect while the Department of Defense reviews public comments is leaving the DIB in limbo. If the rule is published as a proposed rule, it likely will not appear in contracts until the first quarter of 2025.
The waiting has not just been on CMMC rulemaking in 2023. In parallel, NIST has been working on a draft of revision three of NIST SP 800-171. CMMC ultimately will be assessing a company’s compliance with this latest iteration of the NIST standard. One of the many questions the DIB is waiting to have answered is how long they will have to cover the gap between the second revision and the third revision, and when CMMC will start assessing against the newer standard.
NIST released the final draft for public comment on November 9, 2023. They have said the final standard will launch sometime during the spring of 2024. Thus far, they have remained fairly close to their proposed timelines. As has been the case so often this year, only time will tell.
If you have questions about NIST/CMMC contact our experts today and we will be happy to assist you.
.jpg?ext=.jpg)
