Event
Friday, March 7, 2025 from 11:00 AM – 12:00 PM Eastern
As a follow up from the ACEC Federal Agencies and Procurement Advocacy (FAPA) Committee’s Winter Meeting, officials from the Department of Defense (DoD) including the U.S. Army Corps of Engineers (USACE) will brief current policies and future requirements of the DoD Cybersecurity Maturity Model Certification (CMMC) program.
The defense industrial base (DIB) faces increasingly frequent, and complex cyberattacks. To strengthen DIB cybersecurity and better safeguard DoD information, the DoD developed the Cybersecurity Maturity Model Certification (CMMC) Program to assess existing DoD cybersecurity requirements. The CMMC model is designed to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) shared with defense contractors and subcontractors during contract performance. The CMMC Program implementation date is 60 days after the publication of the final Title 48 CFR CMMC acquisition rule. CMMC assessment requirements will be implemented using a four-phase plan over three years. The phases add CMMC Level requirements incrementally, starting with self-assessments in Phase 1 and ending with full implementation of program requirements in Phase 4. This phased approach is intended to allow time to train CMMC Third Party Assessment Organizations (C3PAOs) and for companies to understand and implement CMMC assessment requirements.
The costs and requirements that this new contract language will place on small firms are significant, and it’s imperative that firms do not wait to assess their cybersecurity.
A pending proposed FAR rule on Controlled Unclassified Information (CUI), which certainly relates to CMMC, is available for ACEC comments. The deadline for member company feedback is Wednesday, March 12.
Do not miss this opportunity to hear directly from DoD about their upcoming cybersecurity requirements.