The timeline for CMMC is still tentative and ongoing but the DoD has provided some guidance. The below is based on available information as of August 1, 2024.
To start, there are 2 CMMC rules:
32 CFR CMMC Final Rule – Describes and establishes the CMMC Program. Once finalized and published, this rule will kick off CMMC assessments.
48 CFR CMMC Contracts Clause – Contract officers ensure contractors have a CMMC certification before they are awarded a new contract (or renewing a contract).
Today’s post will focus on 32 CFR, we will post in the near future regarding 48 CFR.
Before we move forward, it’s important to review the milestones on the CMMC Program to date:
January 2020 – CMMC 1.0 Draft Standard Released
February 2020 – CMMC-AB (now Cyber AB) formed
September 2020 – CMMC 1.0 Interim Rule Published
March 2021 – DoD begins internal review of CMMC 1.0, ~750 public comments
November 2021 – CMMC 2.0 Released, to include CMMC Pilot Joint Surveillance Voluntary Assessments
July 2023 – DoD submits CMMC Program 32 CFR Rule to OIRA for regulatory review (see our blog post on that timeline update)
December 2023 – 32 CFR Proposed Rule Published to Federal Register
January-February 2024 – Open comments period which produced over 1800 public comments.
March– June 2024 – Adjudication of public comments
June 2024 – DoD submits CMMC Program Rule to OIRA for final review
What’s next?
On June 27, 2024 the CMMC Program Final Rule (32 CFR) has moved to the last step prior to finalization and publication. The rule is now in OIRA (Office of Information and Regulatory Affairs) review. This is the last step before publication in the federal register.
OIRA has 90 days, with an option to extend by 30 days, to finalize their review. Once final rule is published in the Federal Register, there is a waiting period of 60 days for congressional review. After the 60-day review, the 32 CFR CMMC program is an official regulation and CMMC Assessments can begin. By our math, that puts the rule getting through through OIRA by October 11 at the latest, and back in the DOD’s hands for implementation not later than December 10, 2024.
When will we see CMMC in contracts?
That is the current unknown, because the final rule being published does NOT mean implementation, it just means the DoD has the authority to implement. The DoD has said publicly their target timeline is for CMMC to start showing up in contracts in October 2025, however the window for CMMC Level 2 Assessments will likely be opened up earlier to help ease the supply burden of their not being enough C3PAOs or certified assessors.
When can I schedule my CMMC Assessment?
You can beat the rush now and book your 2025 C3PAO Assessment in preparation for the final rule.