Title 48 Proposed Rule: CMMC Takes Another Step Forward
The CMMC program took another major step with the publication of the Title 48 proposed rule on August 14, 2024. This rule aims to incorporate CMMC requirements into DoD contracts, complementing the earlier Title 32 rule.
On August 14, 2024, the CMMC program took another major step forward. The Federal Register published the Title 48 Proposed Rule: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041). This is the long-anticipated complement to 32 CFR part 170 released in December 2023 that we covered in this blog on the CMMC Proposed Rule Basics.
Title 48 aims to “incorporate contractual requirements related to the proposed Cybersecurity Maturity Model Certification 2.0 program rule, Cyber Security Maturity Program.” This is the rule that will codify CMMC into contracts.
Background on Title 48
Without delving too deeply into the world of federal contracting, the DoD’s implementation of cybersecurity requirements for the DIB requires rulemaking in Title 32 and Title 48 of the Code of Federal Regulations (CFR). Here’s how each rule contributes to the process.
Title 32 of the CFR includes the regulations dealing with national defense. The DoD’s proposed rule in 32 CFR establishes the basis of the CMMC program. It focuses on the administration of the program/policy.
What’s New in Title 48?
Frankly, almost nothing. The proposed rule references and aligns tightly with proposed CFR 32 part 170. It also adds an updated definition for Controlled Unclassified Information. This is good news for advocates of CMMC as it signals the maturity of the program, and the main pillars of the program are solidified. While we may get more clarity in some areas, CMMC is not going anywhere.
The core of the proposed rule is an update to DFARS 252.204-7021 which will contain the CMMC requirements. There will also be a new clause 252.204-7YYY that will identify the CMMC Level required in the contract.
When Will We See CMMC in Contracts?
The phased rollout of CMMC is generally aligned with the guidance provided in 32 CFR part 170. Over a three-year period, CMMC will be phased in with the expectation that CMMC will be in all applicable solicitations. One interesting note is that the rule indicates that a program office may include CMMC in a solicitation prior to the effective date of the final rule. This opens the door for CMMC to appear in solicitations earlier than outlined in the phased rollout.
Where Will We See CMMC?
After the phase-in period, CMMC will be present in clause DFARS 252.204-7021 and be used in all DoD solicitations and contracts that involve storing, processing, or transmitting FCI or CUI, including commercial products or commercial services valued at greater than the micro-purchase threshold ($10,000). DFARS 252.204-7YYY will designate the CMMC level required for the solicitation.
When Does CMMC Apply?
A current CMMC Certification or self-assessment for the required CMMC Level will be required:
- At the time of award
- For the life of the contract
- When exercising an option
- To receive an extension of the period of performance
It’s important to note that contractors are required to notify the contracting officer of any changes in the contractor information systems that process, store, or transmit CUI during contract performance. It is unclear at this point what constitutes a change significant enough to make this notification.
CMMC requirements must be flowed down to subcontractors at all tiers when the subcontractor will process, store, or transmit FCI or CUI. Flow downs are based on the information being flowed down, and subcontractors must have the appropriate CMMC level before award.
Defining CUI
The proposed rule clarifies the definition of CUI as follows:
“Controlled Unclassified Information means information the Government creates or possesses, or an entity creates for or on behalf of the Government, that a law, regulation, or governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls (32 CFR 2002.4 (h)).”
What’s Next?
Title 48 was released as a proposed rule. There is a sixty (60) day comment period after which the DoD will review and respond to all comments. At that point, it is expected that the DoD will submit the final rule to OIRA for review and release.
Public Comments
Many of the public comments on the original interim rule were addressed in the proposed CFR 32-170. However, there is an analysis of some of the comments in Title 48. These comments are limited to the contractual requirements of the rule. Here are the highlights:
Other Transaction Agreements
Other Transaction Agreements (OTA) are outside the scope of DFARS and therefore outside the parameters of this rule. However, if the program office identifies a CMMC requirement in an OTA, then CMMC will be included in the solicitation and resulting agreement.
Foreign Suppliers
The proposed rule does not exempt foreign suppliers from CMMC requirements.
Simplified Acquisition Threshold
The proposed rule applies to contracts at or below the simplified acquisition threshold, but not to purchases at or below the micro-purchase threshold.
Plain Old Telephone Services (POTS)
Common carrier telecommunications circuits or POTS would not normally be considered part of the covered contractor information system. However, data transiting common carrier systems should be separately encrypted per NIST 800-171 requirement 3.13.8.
Joint Ventures
Each entity that has a requirement for CMMC would be required to comply with the requirements related to each entity’s information systems that store, process, or transit FCI or CUI.
Fundamental Research
Fundamental research is published and broadly shared within the scientific community and, as such, cannot be safeguarded as FCI or CUI. However, if the fundamental research has the potential to become CUI, it would be subject to the requirements of CMMC.
Clause 252.204-7021 Doesn’t Automatically Mean CUI
Clause 252.204-7021 applies to both FCI and CUI, so the presence of the clause does not automatically mean there is CUI.
What’s Next?
The publication of Title 48 is an important milestone in the CMMC program. It provides guidance as to how CMMC will appear in contracts and builds upon the information in 32 CFR part 170. For this rule, the next step is the public comment period of sixty days, followed by DoD review of comments and presumably a final rule publication.
From a program perspective, the next big milestone will be the publication of the final 32 CFR part 170. The government has signaled that it is on-track for publication in the October, 2024 timeframe.
Our Commitment
For more than seven years, C3 Integrated Solutions has been committed to supporting the Defense Industrial Base with innovative technology & cybersecurity solutions, day-to-day IT management, and the professional services, consulting, and support required to protect our nation’s critical data. As one of the first MSPs to provide Microsoft GOV CLOUD services, we have developed groundbreaking services and solutions—such as the Steel Root Compliance Platform—explicitly designed to accelerate and maintain compliance through CMMC solutions.
Meet the Author
