On Aug. 15, 2024, the Department of Defense (DoD) published a proposed rule that would implement contract clauses under 48 CFR related to the Cybersecurity Maturity Model Certification (CMMC) Program (Proposed Rule). DoD previously published a related proposed rule that would implement the CMMC 2.0 Program under 32 CFR 170 and provided the relevant security requirements.
This latest Proposed Rule would introduce changes to the Defense Federal Acquisition Regulation Supplement (DFARS) to incorporate contractual clauses to implement the CMMC Program. The Proposed Rule would modify the original CMMC contract clause, which DoD drafted in a Sept. 29, 2020, interim rule implementing the original CMMC Program (DFARS 252.204-7021).