32 CFR Part 170 Key Takeaways - Revision history

Uncouth at 00:51, 26 February 2025

2025-02-26T00:51:19Z

← Older revision		Revision as of 00:51, 26 February 2025
Line 1:		Line 1:
	== Introduction ==		== Introduction ==
	On October 15, 2024 32 CFR Part 170 also known as the "CMMC Final Rule" is published to the Federal Register. Effective 60 days later, the CMMC program is in effect.		On October 15, 2024 32 CFR Part 170 also known as the "CMMC Final Rule" was published to the Federal Register. Effective 60 days later, the CMMC program became in effect.

	Below are some key considerations, changes, and details to know with this rule's publication. This page's intent is to capture key differences, address changes between the draft rule and final published version.		Below are some key considerations, changes, and details to know with this rule's publication. This page's intent is to capture key differences, address changes between the draft rule and final published version.

Uncouth: /* Virtual Desktop Infrastructure */

2024-10-14T13:54:31Z

Virtual Desktop Infrastructure

Marieramsay: /* Introduction */

2024-10-12T23:00:34Z

Introduction

← Older revision		Revision as of 23:00, 12 October 2024
Line 13:		Line 13:
	DoD projects a 7-year timeline with a 4-year phased roll-out, initially.		DoD projects a 7-year timeline with a 4-year phased roll-out, initially.

	In FY2025, DoD will primarily be requiring self-assessments. There will be approximately 500 expected third-party certifications required on contracts.		In FY2025, DoD will primarily be requiring self-assessments. There will be approximately 500 expected third-party certifications required on contracts the first year.

	CMMC self-assessments must have a score of 88 or more to "pass" and be compliant. The Affirming Official (formerly a "Senior Official" will need to affirm that the reporting is accurate. Affirming this score carries personal criminal fraud risk, and affirmations may be verified in a third party assessment later.		CMMC self-assessments must have a score of 88 or more to "pass" and be compliant. The Affirming Official (formerly a "Senior Official" will need to affirm that the reporting is accurate. Affirming this score carries personal criminal fraud risk, and affirmations may be verified in a third party assessment later.
Line 24:		Line 24:

	It's important to note that DoD has the discretion to delay the certification requirement to an option period instead of the condition of "upon contract award." While it's not expected this will be taken advantage of often, this does give DoD flexibility on specific programs that may have unique challenges to supply chain partners becoming certified.		It's important to note that DoD has the discretion to delay the certification requirement to an option period instead of the condition of "upon contract award." While it's not expected this will be taken advantage of often, this does give DoD flexibility on specific programs that may have unique challenges to supply chain partners becoming certified.

			Additionally:

			''"The CMMC Program’s assessment phase-in plan, as described in § 170.3, does not preclude entities from immediately seeking a CMMC certification assessment prior to the 48 CFR part 204 CMMC Acquisition rule being finalized and the clause being added to new or existing DoD contracts."''

	== Security Protection Data ==		== Security Protection Data ==
	~~lorem ipsum~~		When Cloud Service Providers (CSPs) only handle security protection data (SPD), and not CUI, the application or service would be treated like a security protection asset (SPA).

	== Security Protection Assets ==		== Security Protection Assets ==
Line 55:		Line 59:
	Assuming appropriate technical controls prevent data transfer, the "dumb client" (or the computer you open the virtual desktop from) can be kept out of scope.		Assuming appropriate technical controls prevent data transfer, the "dumb client" (or the computer you open the virtual desktop from) can be kept out of scope.

	== Assessors ==		== Assessors and the Training Community ==
	The minimum number of assessors per third-party assessment has been expanded from 2 to 3. This will likely increase the projected costs of assessments.		The minimum number of assessors per third-party assessment has been expanded from 2 to 3. Additionally, at Lead CMMC Certified Assessor (CCA) is required and at least one other CCA. This will likely increase the projected costs of assessments.

			CMMC instructors are now prohibited to also consult. Additional clarification is expected on this.

Marieramsay: /* Security Protection Assets */

2024-10-12T22:41:15Z

Security Protection Assets

← Older revision		Revision as of 22:41, 12 October 2024
Line 9:		Line 9:

	== Timelines ==		== Timelines ==
	~~Phased~~ rollout, ~~48 CFR~~, ~~blah blah~~		The Final Rule codifies that Joint Surveillance Voluntary Assessments (JSVAs) will equate to a CMMC Level 2 certification, assuming the organization received a perfect 110 score.

			DoD projects a 7-year timeline with a 4-year phased roll-out, initially.

			In FY2025, DoD will primarily be requiring self-assessments. There will be approximately 500 expected third-party certifications required on contracts.

			CMMC self-assessments must have a score of 88 or more to "pass" and be compliant. The Affirming Official (formerly a "Senior Official" will need to affirm that the reporting is accurate. Affirming this score carries personal criminal fraud risk, and affirmations may be verified in a third party assessment later.

			In FY2026, that 500 grows to about 2500 and by FY2027, about 9000. By FY2028, DoD anticipates 16,000 third-party certifications needed a year.

			By the end of the rollout, the numbers projected by DoD are 4,000 self-assessed and 76,000 assessed by a Certified Third Party Assessment Organization (C3PAO).

			Many DIB contractors (and sub-contractors) can expect to be required to self-assessment, per contract and purchase order flow-down requirements.

			It's important to note that DoD has the discretion to delay the certification requirement to an option period instead of the condition of "upon contract award." While it's not expected this will be taken advantage of often, this does give DoD flexibility on specific programs that may have unique challenges to supply chain partners becoming certified.

	== Security Protection Data ==		== Security Protection Data ==
Line 15:		Line 29:

	== Security Protection Assets ==		== Security Protection Assets ==
	~~lorem ipsum~~		The Final Rule now suggests that Security Protection Assets (SPAs) will be assessed against security requirements that are "relevant to the capabilities provided."

			''"If an OSA utilizes an ESP, including a Cloud Service Provider (CSP), that does not process, store, or transmit CUI, the ESP does not require its own CMMC assessment. The services provided by the ESP are assessed as part of the OSC’s assessment as Security Protection Assets."''

	== External Service Providers ==		== External Service Providers ==
	~~lorem ipsum~~		The Final Rule clarifies the difference between Cloud Service Providers (CSPs), External Service Providers (ESPs), and Managed Service Providers (MSPs).

			The requirement for ESPs (regardless of the services it provides) to be CMMC-Certified is no longer a requirement. However, an MSP, acting as an ESP, may choose to become CMMC-Certified.

			The Final Rule suggests that Organizations Seeking Certification (OSC) may inherit controls for External Service Providers (ESPs) in scope when the ESP is CMMC-Certified.

	== Managed Service Providers ==		== Managed Service Providers ==
	~~are great~~		The Final Rule clarifies that Managed Service Providers (MSPs) do not need FedRAMP Moderate to support an Organization Seeking Certification (OSC).

			The Rule also allows MSPs to get CMMC certified to avoid being re-assessed for every client.

	== FedRAMP & Equivalency ==		== FedRAMP & Equivalency ==
	~~lorem ipsum~~		FedRAMP Moderate is required when CUI is stored, processed, or transmitted.

			There is still some question on the commentary and verbiage, but there is clarity in that a CSP only handles security protection data (SPD), and not CUI, therefore, the application or service would be treated like a security protection asset (SPA).

	== Virtual Desktop Infrastructure ==		== Virtual Desktop Infrastructure ==
	~~CRMA? More like CROHYAY~~		Virtual Desktop Infrastructure (VDI) language was added to remove the endpoint from scope if the endpoint is not processing, storing, or transmitting CUI.

			Assuming appropriate technical controls prevent data transfer, the "dumb client" (or the computer you open the virtual desktop from) can be kept out of scope.

			== Assessors ==
			The minimum number of assessors per third-party assessment has been expanded from 2 to 3. This will likely increase the projected costs of assessments.

Uncouth at 22:50, 11 October 2024

2024-10-11T22:50:49Z

← Older revision		Revision as of 22:50, 11 October 2024
Line 3:		Line 3:

	Below are some key considerations, changes, and details to know with this rule's publication. This page's intent is to capture key differences, address changes between the draft rule and final published version.		Below are some key considerations, changes, and details to know with this rule's publication. This page's intent is to capture key differences, address changes between the draft rule and final published version.

			Link to the PDF: https://public-inspection.federalregister.gov/2024-22905.pdf

			Link to the FAR: https://www.federalregister.gov/public-inspection/2024-22905/cybersecurity-maturity-model-certification-program

	== Timelines ==		== Timelines ==

Uncouth: Created page with "== Introduction == On October 15, 2024 32 CFR Part 170 also known as the "CMMC Final Rule" is published to the Federal Register. Effective 60 days later, the CMMC program is in effect. Below are some key considerations, changes, and details to know with this rule's publication. This page's intent is to capture key differences, address changes between the draft rule and final published version. == Timelines == Phased rollout, 48 CFR, blah blah == Security Protection Da..."

2024-10-11T22:45:51Z

Created page with "== Introduction == On October 15, 2024 32 CFR Part 170 also known as the "CMMC Final Rule" is published to the Federal Register. Effective 60 days later, the CMMC program is in effect. Below are some key considerations, changes, and details to know with this rule's publication. This page's intent is to capture key differences, address changes between the draft rule and final published version. == Timelines == Phased rollout, 48 CFR, blah blah == Security Protection Da..."

New page

== Introduction ==
On October 15, 2024 32 CFR Part 170 also known as the "CMMC Final Rule" is published to the Federal Register. Effective 60 days later, the CMMC program is in effect.

Below are some key considerations, changes, and details to know with this rule's publication. This page's intent is to capture key differences, address changes between the draft rule and final published version.

== Timelines ==
Phased rollout, 48 CFR, blah blah

== Security Protection Data ==
lorem ipsum

== Security Protection Assets ==
lorem ipsum

== External Service Providers ==
lorem ipsum

== Managed Service Providers ==
are great

== FedRAMP & Equivalency ==
lorem ipsum

== Virtual Desktop Infrastructure ==
CRMA? More like CROHYAY

← Older revision		Revision as of 13:54, 14 October 2024
Line 9:		Line 9:

	== Timelines ==		== Timelines ==
	The Final Rule codifies that Joint Surveillance Voluntary Assessments (JSVAs) will equate to a CMMC Level 2 certification, assuming the organization received a perfect 110 score.		The Final Rule codifies that [[Joint Surveillance Voluntary Assessment (JSVA)\|Joint Surveillance Voluntary Assessments (JSVAs)]] will equate to a CMMC Level 2 certification, assuming the organization received a perfect 110 score.

	DoD projects a 7-year timeline with a 4-year phased roll-out, initially.		DoD projects a 7-year timeline with a 4-year phased roll-out, initially.
Line 15:		Line 15:
	In FY2025, DoD will primarily be requiring self-assessments. There will be approximately 500 expected third-party certifications required on contracts the first year.		In FY2025, DoD will primarily be requiring self-assessments. There will be approximately 500 expected third-party certifications required on contracts the first year.

	CMMC self-assessments must have a score of 88 or more to "pass" and be compliant. The Affirming Official (formerly a "Senior Official" will need to affirm that the reporting is accurate. Affirming this score carries personal criminal fraud risk, and affirmations may be verified in a third party assessment later.		CMMC self-assessments must have a score of 88 or more to "pass" and be compliant. The [[Affirming Official]] (formerly a "Senior Official" will need to affirm that the reporting is accurate. Affirming this score carries personal criminal fraud risk, and affirmations may be verified in a third party assessment later.

	In FY2026, that 500 grows to about 2500 and by FY2027, about 9000. By FY2028, DoD anticipates 16,000 third-party certifications needed a year.		In FY2026, that 500 grows to about 2500 and by FY2027, about 9000. By FY2028, DoD anticipates 16,000 third-party certifications needed a year.

	By the end of the rollout, the numbers projected by DoD are 4,000 self-assessed and 76,000 assessed by a Certified Third Party Assessment Organization (C3PAO).		By the end of the rollout, the numbers projected by DoD are 4,000 self-assessed and 76,000 assessed by a [[Certified Third Party Assessment Organization (C3PAO)]].

	Many DIB contractors (and sub-contractors) can expect to be required to self-assessment, per contract and purchase order flow-down requirements.		Many DIB contractors (and sub-contractors) can expect to be required to self-assessment, per contract and purchase order flow-down requirements.
Line 38:		Line 38:

	== External Service Providers ==		== External Service Providers ==
	The Final Rule clarifies the difference between Cloud Service Providers (CSPs), External Service Providers (ESPs), and Managed Service Providers (MSPs).		The Final Rule clarifies the difference between [[Cloud Service Provider (CSP)\|Cloud Service Providers (CSPs)]], [[External Service Provider (ESP)\|External Service Providers (ESPs)]], and [[Managed Service Provider (MSP)\|Managed Service Providers (MSPs)]].

	The requirement for ESPs (regardless of the services it provides) to be CMMC-Certified is no longer a requirement. However, an MSP, acting as an ESP, may choose to become CMMC-Certified.		The requirement for ESPs (regardless of the services it provides) to be CMMC-Certified is no longer a requirement. However, an MSP, acting as an ESP, may choose to become CMMC-Certified.
Line 50:		Line 50:

	== FedRAMP & Equivalency ==		== FedRAMP & Equivalency ==
	FedRAMP Moderate is required when CUI is stored, processed, or transmitted.		[[FedRAMP Moderate]] authorization is required when CUI is stored, processed, or transmitted in a cloud service offering.

	There is still some question on the commentary and verbiage, but there is clarity in that a CSP only handles security protection data (SPD), and not CUI, therefore, the application or service would be treated like a security protection asset (SPA).		There is still some question on the commentary and verbiage, but there is clarity in that a CSP only handles security protection data (SPD), and not CUI, therefore, the application or service would be treated like a security protection asset (SPA).

	== Virtual Desktop Infrastructure ==		== Virtual Desktop Infrastructure ==
	Virtual Desktop Infrastructure (VDI) language was added to remove the endpoint from scope if the endpoint is not processing, storing, or transmitting CUI.		[[Virtual Desktop Infrastructure (VDI)]] language was added to remove the endpoint from scope if the endpoint is not processing, storing, or transmitting CUI.

	Assuming appropriate technical controls prevent data transfer, the "dumb client" (or the computer you open the virtual desktop from) can be kept out of scope.		Assuming appropriate technical controls prevent data transfer, the "dumb client" (or the computer you open the virtual desktop from) can be kept out of scope. It was previously assumed that they would need to be at least a [[Contractor Risk Managed Asset (CRMA)]].

	== Assessors and the Training Community ==		== Assessors and the Training Community ==
	The minimum number of assessors per third-party assessment has been expanded from 2 to 3. Additionally, at Lead CMMC Certified Assessor (CCA) is required and at least one other CCA. This will likely increase the projected costs of assessments.		The minimum number of assessors per third-party assessment has been expanded from 2 to 3. Additionally, at Lead [[CMMC Certified Assessor (CCA)]] is required and at least one other CCA. This will likely increase the projected costs of assessments.

	CMMC instructors are now prohibited to also consult. Additional clarification is expected on this.		CMMC instructors are now prohibited to also consult. Additional clarification is expected on this.