Department of Defense Finalizes Rule Adding New Cybersecurity Requirements for Defense Contractors and Subcontractors

By Brett W. Johnson, Derek Flint, Carrie Schaffer, and Vanessa Pomeroy

The U.S. Department of Defense (DOD) has published a Final Rule to implement the Cybersecurity Maturity Model Certification (CMMC) program, which establishes minimum cybersecurity requirements for nearly all DOD contracts. The Final Rule is part of the DOD’s efforts to bolster the protection of sensitive information within the defense industrial base against evolving cybersecurity threats. The Final Rule is effective December 16, 2024, and will require proactive measures by contractors and subcontractors seeking to partner with the DOD.

The Final Rule will be implemented in four phases over a three-year period. Relatedly, the DFARS Proposed Rule outlines how CMMC Program requirements will be incorporated into contracts. Final comments on the DFARS Proposed Rule closed on October 15, 2024, and a Final Rule is expected in mid-2025. This will serve as the effective date for the phase-in process to begin. Once this occurs, solicitations and defense contracts that require contractors to process, store, or transmit federal contract information (FCI) or controlled unclassified information (CUI) on a non-federal system will condition contract eligibility on a contractor’s ability to meet these new requirements.

Key Provisions of the CMMC Program Final Rule:

The CMMC Program will require contractors entrusted with FCI and CUI to implement cybersecurity standards at progressively advanced levels, depending on the type and sensitivity of the information. Responsibility for assigning a contract’s level will generally fall to the contracting officer. Each level will require a contractor to undergo an assessment — either self-conducted or handled by a government-approved third party (i.e., C3PAO) — to test and certify its security controls. Depending on the level, the required assessment may be annual or triennial. A brief overview is as follows:

Contractors will generally not be required to immediately meet all CMMC requirements to be eligible for an award. If a contractor is unable to satisfy Level 2 (Self), Level 2 (C3PAO), or Level 3 (DIBCAC) compliance at the time of contract award, but is at least 80 percent compliant, conditional status may be granted. Contractors will have 180 days to be 100 percent compliant with the applicable requirements.

***

Compliance with the CMMC Program will be burdensome: DOD estimates that the cost of the required assessments per entity could range from a few thousand dollars to over $100,000, depending on the CMMC level and the size of the entity. With this in mind, all defense contractors — small or large — should consider conducting a proactive review of their cybersecurity policies. As part of this, government contractors may want to assess their compliance with NIST security requirements. In addition, to the extent that subcontractors will also need to be compliant, assessing supply changes and identifying vendors that can meet the necessary requirements may be necessary. Contractors that are proactive and have the ability to meet compliance requirements on a faster timeline will have a marketing competitive advantage in future solicitations.

In addition, contractors should review solicitation requirements carefully — and in advance of submitting a bid — to confirm which CMMC level applies. Depending on the CMMC level, the additional financial burden imposed by CMMC requirements could have a significant impact on the profitability of a given contract.

As the Final Rule and its associated DFARS Proposed Rule are phased in, contractors should ensure that compliance programs and proper vetting procedures for supply chains are up to date. As these requirements are onerous, seeking regulatory counsel assistance may be advisable.