CMMC Phase 2 Paused as Proposed FAR Rule Would Expand CUI Requirements
Summary
DoD paused CMMC Phase 2, but Phase 1 self-assessments and existing contract obligations remain. A proposed FAR rule would extend CUI requirements to federal contractors and adopt NIST 800-171 Rev. 3; it is not yet final.
Key points
- DoD paused CMMC Phase 2; Phase 1 Level 1 and Level 2 self-assessments remain in applicable solicitations and contracts.
- The article says existing obligations to safeguard CUI and report incidents within 72 hours under DFARS 252.204-7012 were not changed by the pause.
- A proposed FAR Council rule would apply CUI clauses to federal contractors beyond the defense industrial base and flow incident-reporting obligations down to subcontractors.
- The proposed rule points to NIST SP 800-171 Revision 3, while CMMC Level 2 currently uses Revision 2; the rule is not final and is not yet live contract language.
- For CMMC Level 2, a POA&M is available only under specified conditions, requires a score of at least 88, and generally must be closed within 180 days.
- Huntress says 32 of the 55 NIST 800-171 Revision 2 requirements it supports fall into categories that cannot be deferred under the described Level 2 rules.
Article Details
- Event Type
- The Department of Defense paused CMMC Phase 2 while Phase 1 self-assessment requirements remain in effect. Separately, the FAR Council published a proposed CUI rule that would extend requirements to federal FAR-based contracts and use NIST SP 800-171 Revision 3. The proposed rule is not final.
- Impact
- Defense contractors remain subject to applicable Phase 1 CMMC requirements, and existing contractual obligations to safeguard CUI and report incidents within 72 hours remain in place. If finalized, the FAR rule would broaden CUI requirements beyond the defense industrial base, flow incident-reporting obligations down to subcontractors, and create a period in which contractors may face different NIST SP 800-171 revisions.
People
Vendors
Industries
DefenseI was at XChange a couple weeks ago, and I kept asking the same question at our booth: "Does anybody here have defense contractor customers, and do you care about CMMC?"Financial ServicesIf you've got higher ed, healthcare, state and local, or financial services clients, run those questions there too. Those sectors sit on FAR-based contracts more often than people expect, and the CUI categories theyHealthcareIf you've got higher ed, healthcare, state and local, or financial services clients, run those questions there too. Those sectors sit on FAR-based contracts more often than people expect, and the CUI categories theyHigher EducationState and local government