Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

core/separator

core/heading

core/list

The U.S. Department of Defense (DoD)&nbsp;<a href="https://www.defense.gov/News/Releases/Release/Article/2833006/strategic-direction-for-cybersecurity-maturity-model-certification-cmmc-program/#:~:text=Today%2C%20the%20Department%20of%20Defense,senior%20leaders%20across%20the%20Department." target="_blank" rel="noopener">recently announced</a> significant changes to its Cybersecurity Maturity Model Certification (CMMC) program, which sets forth certain&nbsp;<a href="https://www.thompsonhine.com/publications/dod-publishes-interim-cybersecurity-rule-on-cmmc-and-dod-assessments" target="_blank" rel="noopener">information security standards and processes</a> applicable to defense contractors and subcontractors. The new “CMMC 2.0” is intended to address several issues and concerns raised by private industry as to the cost and complexity of the original program and is a product of a comprehensive internal assessment that DoD recently undertook. It will have a significant impact on all defense contractors, especially small businesses.

contentpilot/introduction

In 2020, DoD amended the Defense Federal Acquisition Regulation Supplement (DFARS) to require defense contractors and subcontractors to submit cybersecurity assessments to the DoD prior to the award of a government contract and to implement and maintain technical, physical, and administrative security controls to protect and safeguard certain types of controlled unclassified information and other sensitive data and obtain third-party cybersecurity certification of these controls (i.e., “CMMC 1.0”). In particular, the original CMMC 1.0 program required contractors to comply with one of five different levels of security controls based on the types of information and data they collected and processed pursuant to a government contract or subcontract. For example, contractors subject to the CMMC 1.0 Level 1 standard had to comply with the basic safeguarding requirements set forth in FAR 52.204-21, and those subject to CMMC Level 5 had to comply with over 150 security requirements, practices, and processes.

core/paragraph

The new CMMC 2.0 program is intended to simplify and streamline compliance obligations. Most significantly, CMMC 2.0 will address the following:

DoD announced the changes in CMMC 2.0 will be implemented through the rulemaking process, which will have a notice and comment period. Importantly, DoD also stated that while these rulemaking efforts are ongoing, it will suspend the current CMMC piloting efforts and will not approve the inclusion of a CMMC requirement in any DoD solicitation. The interim rule for CMMC 1.0 had previously established a five-year phase-in period, during which CMMC compliance was only required in select pilot contracts. DoD stated that CMMC 2.0 will not be a contractual requirement until it completes rulemaking to implement the program and that the rulemaking process can take 9 to 24 months.

The changes to the CMMC are summarized on DoD’s <a href="https://www.acq.osd.mil/cmmc/index.html" target="_blank" rel="noopener">CMMC website</a> and include <a href="https://www.acq.osd.mil/cmmc/faq.html" target="_blank" rel="noopener">FAQs</a>. The CMMC Accreditation Body will discuss CMMC 2.0 during a virtual “Town Hall” on November 9 from 6:00-7:00 p.m. ET, which will be recorded and posted online after the event.

Steven G. Stransky 216.566.5646 202.263.4126 <a href="mailto:Steve.Stransky@ThompsonHine.com">Steve.Stransky@ThompsonHine.com</a>

Joseph R. Berger 202.263.4193 <a href="mailto:Joseph.Berger@ThompsonHine.com">Joseph.Berger@ThompsonHine.com</a>

Tom Mason 202.263.4168 <a href="mailto:Thomas.Mason@ThompsonHine.com">Thomas.Mason@ThompsonHine.com</a>

Francis E. (Chip) Purcell, Jr. 202.263.4118 <a href="mailto:Chip.Purcell@ThompsonHine.com">Chip.Purcell@ThompsonHine.com</a>

or any member of our&nbsp;<a href="https://www.thompsonhine.com/services/privacy-and-cybersecurity" target="_blank" rel="noopener">Privacy &amp; Cybersecurity</a> or&nbsp;<a href="https://www.thompsonhine.com/services/government-contracts-2" target="_blank" rel="noopener">Government Contracts</a> groups.

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2022/04/Cybersecurity__Government_Contracts_-_DoD_Announces_CMMC_2.0.pdf

DoD Announces (New) CMMC 2.0

Services