DoD has recently incorporated CMMC requirements into the Defense Federal Acquisition Regulation Supplement (DFARS Case 2019–D041, available here https://bit.ly/30LXAeE). The rule change is currently open for public comment, and I urge all interested parties to read it and provide input.
The language of the new rule includes a comprehensive description of CMMC, including its purpose and scope, its costs and benefits to the American people, a description of FCI (Federal Contract Information) vs. CUI (Controlled Unclassified Information), an explanation of CMMC assessment methods, and CMMC’s relationship to other key regulations, laws, and compliance regimes particularly NIST 800-171.
Most importantly though, the document addresses the $64,000 question: “How much will CMMC cost?” For initial assessment costs, the document uses a very simple method of estimating the initial assessment cost: (pay rate * hours) + travel costs at $250/day. Obtaining a certification and maintaining it are different matters, though, so the document also offers estimates of annual recurring costs to maintain a suitable security posture. The creators of the CMMC program worked very hard to keep the costs low. For example, they estimate that a small company should spend about $2,999.56 (a highly specific number most of us will round up to $3K) on a Level 1 (least stringent) assessment. It notes further that a majority of affected companies will require only a Level 1 assessment, and the vast majority will need no more than a Level 3 assessment (there will be a maximum of five levels at this point).
Finally, the document offers an all-important timeline indicating when CMMC will be required for all contracts (2026), and how many companies and contracts will be affected in the meantime.
CMMC is here to stay, and it will affect most, if not all, companies seeking to do business with the U.S. Department of Defense. The rule change is open for public comment as I write this, so take advantage of the opportunity to speak directly to the DoD about this ground-breaking rule change.