{"description":"Documents matching 'CMMC'","count":42,"total_pages":3,"next_page_url":"https://www.federalregister.gov/api/v1/documents?conditions%5Bterm%5D=CMMC&format=json&page=2","results":[{"title":"Cybersecurity Maturity Model Certification (CMMC) Program","type":"Rule","abstract":"With this final rule, DoD establishes the Cybersecurity Maturity Model Certification (CMMC) Program in order to verify contractors have implemented required security measures necessary to safeguard Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The mechanisms discussed in this rule will allow the Department to confirm a defense contractor or subcontractor has implemented the security requirements for a specified CMMC level and is maintaining that status (meaning level and assessment type) across the contract period of performance. This rule will be updated as needed, using the appropriate rulemaking process, to address evolving cybersecurity standards, requirements, threats, and other relevant changes.","document_number":"2024-22905","html_url":"https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-10-15/pdf/2024-22905.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-22905.pdf?1728650732","publication_date":"2024-10-15","agencies":[{"raw_name":"DEPARTMENT OF DEFENSE","name":"Defense Department","id":103,"url":"https://www.federalregister.gov/agencies/defense-department","json_url":"https://www.federalregister.gov/api/v1/agencies/103","parent_id":null,"slug":"defense-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"Team \n • Asset Categories \n • Authorized \n • Cloud Service Provider \n • <span class=\"match\">CMMC</span> Assessment and Certification Ecosystem \n • <span class=\"match\">CMMC</span> Assessment Scope \n • <span class=\"match\">CMMC</span> Assessor and Instructor Certification Organization (CAICO) \n • <span class=\"match\">CMMC</span> instantiation of eMASS \n • <span class=\"match\">CMMC</span> Status \n • Final Level 1 (Self) \n • Conditional Level 2 (Self) \n • Final Level 2 (Self) \n • Conditional Level 2 (C3PAO) \n • Final Level 2 (C3PAO) \n • Conditional Level 3 (DIBCAC) \n • Final Level 3 (DIBCAC) \n • <span class=\"match\">CMMC</span> Status Date \n • <span class=\"match\">CMMC</span> Third-Party Assessment Organization (C3PAO) \n • Contractor Risk Managed"},{"title":"Posting of Informational Video: Cybersecurity Maturity Model Certification (CMMC) Program","type":"Proposed Rule","abstract":"The Office of the Department of Defense Chief Information Officer (DoD CIO) has released an informational video to provide the public with an overview of the proposed rule for DoD's updated Cybersecurity Maturity Model Certification (CMMC) Program, which was published in the Federal Register on December 26, 2023 for public comment. The proposed rule establishes requirements for a comprehensive and scalable assessment mechanism to ensure defense contractors and subcontractors have, as part of the CMMC Program, implemented required existing security requirements for Federal Contract Information and Controlled Unclassified Information (CUI) and adds new CUI security requirements for certain priority programs. This document announces that a video file containing an overview briefing of the CMMC proposed rule, presented by leadership and staff from the Office of the DoD Deputy CIO for Cybersecurity, was posted on the internet on February 14, 2024.","document_number":"2024-03460","html_url":"https://www.federalregister.gov/documents/2024/02/21/2024-03460/posting-of-informational-video-cybersecurity-maturity-model-certification-cmmc-program","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-02-21/pdf/2024-03460.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-03460.pdf?1708436722","publication_date":"2024-02-21","agencies":[{"raw_name":"DEPARTMENT OF DEFENSE","name":"Defense Department","id":103,"url":"https://www.federalregister.gov/agencies/defense-department","json_url":"https://www.federalregister.gov/api/v1/agencies/103","parent_id":null,"slug":"defense-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"video on <span class=\"match\">CMMC</span>. \n \n \n SUMMARY: \n \n The Office of the Department of Defense Chief Information Officer (DoD CIO) has released an informational video to provide the public with an overview of the proposed rule for DoD's updated Cybersecurity Maturity Model Certification (<span class=\"match\">CMMC</span>) Program, which was published in the \n Federal Register \n on December 26, 2023 for public comment. The proposed rule establishes requirements for a comprehensive and scalable assessment mechanism to ensure defense contractors and subcontractors have, as part of the <span class=\"match\">CMMC</span> Program"},{"title":"Cybersecurity Maturity Model Certification (CMMC) Program Guidance","type":"Notice","abstract":"The Department of Defense announces the availability of eight guidance documents for the CMMC Program. These documents provide additional guidance for the CMMC model, assessments, scoring, and hashing.","document_number":"2023-27281","html_url":"https://www.federalregister.gov/documents/2023/12/26/2023-27281/cybersecurity-maturity-model-certification-cmmc-program-guidance","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2023-12-26/pdf/2023-27281.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2023-27281.pdf?1703252717","publication_date":"2023-12-26","agencies":[{"raw_name":"DEPARTMENT OF DEFENSE","name":"Defense Department","id":103,"url":"https://www.federalregister.gov/agencies/defense-department","json_url":"https://www.federalregister.gov/api/v1/agencies/103","parent_id":null,"slug":"defense-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"evaluate the <span class=\"match\">CMMC</span> Level of an OSC. For <span class=\"match\">CMMC</span> Level 3, assessments are performed exclusively by the DoD.\n \n An OSC seeking a <span class=\"match\">CMMC</span> Level 3 Certification Assessment must have first received a <span class=\"match\">CMMC</span> Level 2 Final Certification Assessment, as set forth in 32 CFR 170.18, for all applicable information systems within the <span class=\"match\">CMMC</span> Assessment Scope, and the OSC must implement the Level 3 requirements specified in 32 CFR 170.14(c)(4). This is followed by the <span class=\"match\">CMMC</span> Level 3 assessment conducted by the DoD. \n \n OSCs may also use this guide to perform <span class=\"match\">CMMC</span> Level 3 self-assessment"},{"title":"Cybersecurity Maturity Model Certification (CMMC) Program","type":"Proposed Rule","abstract":"DoD is proposing to establish requirements for a comprehensive and scalable assessment mechanism to ensure defense contractors and subcontractors have, as part of the Cybersecurity Maturity Model Certification (CMMC) Program, implemented required security measures to expand application of existing security requirements for Federal Contract Information (FCI) and add new Controlled Unclassified Information (CUI) security requirements for certain priority programs. DoD currently requires covered defense contractors and subcontractors to implement the security protections set forth in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Rev 2 to provide adequate security for sensitive unclassified DoD information that is processed, stored, or transmitted on contractor information systems and to document their implementation status, including any plans of action for any NIST SP 800-171 Rev 2 requirement not yet implemented, in a System Security Plan (SSP). The CMMC Program provides the Department the mechanism needed to verify that a defense contractor or subcontractor has implemented the security requirements at each CMMC Level and is maintaining that status across the contract period of performance, as required.","document_number":"2023-27280","html_url":"https://www.federalregister.gov/documents/2023/12/26/2023-27280/cybersecurity-maturity-model-certification-cmmc-program","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2023-12-26/pdf/2023-27280.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2023-27280.pdf?1703252717","publication_date":"2023-12-26","agencies":[{"raw_name":"DEPARTMENT OF DEFENSE","name":"Defense Department","id":103,"url":"https://www.federalregister.gov/agencies/defense-department","json_url":"https://www.federalregister.gov/api/v1/agencies/103","parent_id":null,"slug":"defense-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"Self-Assessment \n • <span class=\"match\">CMMC</span> Level 2 Certification Assessment \n • <span class=\"match\">CMMC</span> Level 3 Certification Assessment \n • Assessment Findings Report \n • Assessment Team \n • Asset Categories \n • Authorized \n • <span class=\"match\">CMMC</span> Assessment and Certification Ecosystem \n • <span class=\"match\">CMMC</span> Assessment Scope \n • <span class=\"match\">CMMC</span> Assessor and Instructor Certification Organization (CAICO) \n • <span class=\"match\">CMMC</span> instantiation of eMASS \n • <span class=\"match\">CMMC</span> Level 1 Self-Assessment \n • <span class=\"match\">CMMC</span> Level 2 Conditional Certification Assessment \n • <span class=\"match\">CMMC</span> Level 2 Conditional Self-Assessment \n • <span class=\"match\">CMMC</span> Level 2 Final Certification Assessment \n • <span class=\"match\">CMMC</span> Level 2 Final"},{"title":"Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041)","type":"Rule","abstract":"DoD is issuing a final rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) to incorporate contractual requirements related to the final Cybersecurity Maturity Model Certification program rule, titled Cybersecurity Maturity Model Certification Program. This final DFARS rule also partially implements a section of the National Defense Authorization Act for Fiscal Year 2020 that directed the Secretary of Defense to develop a consistent, comprehensive framework to enhance cybersecurity for the U.S. defense industrial base.","document_number":"2025-17359","html_url":"https://www.federalregister.gov/documents/2025/09/10/2025-17359/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2025-09-10/pdf/2025-17359.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2025-17359.pdf?1757421911","publication_date":"2025-09-10","agencies":[{"raw_name":"DEPARTMENT OF DEFENSE","name":"Defense Department","id":103,"url":"https://www.federalregister.gov/agencies/defense-department","json_url":"https://www.federalregister.gov/api/v1/agencies/103","parent_id":null,"slug":"defense-department"},{"raw_name":"Defense Acquisition Regulations System","name":"Defense Acquisition Regulations System","id":97,"url":"https://www.federalregister.gov/agencies/defense-acquisition-regulations-system","json_url":"https://www.federalregister.gov/api/v1/agencies/97","parent_id":103,"slug":"defense-acquisition-regulations-system"}],"excerpts":"accordance with 32 CFR 170.19, <span class=\"match\">CMMC</span> scoping. <span class=\"match\">CMMC</span> includes the following <span class=\"match\">CMMC</span> Levels: <span class=\"match\">CMMC</span> Level 1 (Self); <span class=\"match\">CMMC</span> Level 2 (Self); <span class=\"match\">CMMC</span> Level 2 (C3PAO); and <span class=\"match\">CMMC</span> Level 3 (DIBCAC). See 32 CFR 170.14, <span class=\"match\">CMMC</span> Model.\n \n DoD did not incorporate the recommendation to limit inclusion of <span class=\"match\">CMMC</span> in existing contracts unless the risk warrants inclusion, as contracting officers already have the discretion to bilaterally incorporate the clause in existing contracts based on DoD's needs. The determination to modify existing contracts after the effective date of this"},{"title":"Information Collection Requirement; Defense Federal Acquisition Regulation Supplement (DFARS) Part 204, Contractor Implementation of Cybersecurity Requirements","type":"Notice","abstract":"The Defense Acquisition Regulations System has submitted to OMB for clearance the following proposal for collection of information under the provisions of the Paperwork Reduction Act.","document_number":"2025-17321","html_url":"https://www.federalregister.gov/documents/2025/09/10/2025-17321/information-collection-requirement-defense-federal-acquisition-regulation-supplement-dfars-part-204","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2025-09-10/pdf/2025-17321.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2025-17321.pdf?1757421907","publication_date":"2025-09-10","agencies":[{"raw_name":"DEPARTMENT OF DEFENSE","name":"Defense Department","id":103,"url":"https://www.federalregister.gov/agencies/defense-department","json_url":"https://www.federalregister.gov/api/v1/agencies/103","parent_id":null,"slug":"defense-department"},{"raw_name":"Defense Acquisition Regulations System","name":"Defense Acquisition Regulations System","id":97,"url":"https://www.federalregister.gov/agencies/defense-acquisition-regulations-system","json_url":"https://www.federalregister.gov/api/v1/agencies/97","parent_id":103,"slug":"defense-acquisition-regulations-system"}],"excerpts":"252.204-7025 to verify that an offeror's <span class=\"match\">CMMC</span> level meets the requirement for <span class=\"match\">CMMC</span> in the solicitation and to document the affirming official statement related to the <span class=\"match\">CMMC</span> status for all contractor information systems to be used in performance of a contract resulting from the solicitation. DoD uses the information submitted in response to the contract clause at DFARS 252.204-7021 to determine, prior to exercise of an option or extension of a period of performance, whether a contractor has the required <span class=\"match\">CMMC</span> status for all contractor information systems"},{"title":"Improving Government Regulations; Unified Agenda of Federal Regulatory and Deregulatory Actions","type":"Notice","abstract":"This agenda announces the regulatory and deregulatory actions the DoW plans to take in the next 12 months and those regulatory and deregulatory actions completed since the publication of the Spring 2025 Unified Agenda. It was developed under the guidelines of Executive Order 12866, \"Regulatory Planning and Review,\" and Executive Order 13563, \"Improving Regulation and Regulatory Review.\" This agenda includes actions that support the Administration's priorities; the Secretary of Defense's top priorities to revive the warrior ethos, rebuild our military, and reestablish deterrence. Members of the public may submit comments on individual proposed and interim final rulemakings at www.regulations.gov during the comment period that follows publication in the Federal Register. This agenda updates the report published on September 22, 2025, and includes regulations expected to be issued or under review by DoW over the next 12 months. The complete Unified Agenda will be available online at www.reginfo.gov. In accordance with the Regulatory Flexibility Act (5 U.S.C. 602), which requires agencies to publish their regulatory flexibility agendas in the Federal Register, the DoW's printed agenda entries in the Federal Register include only: (1) Rules that are in the Agency's regulatory flexibility agenda, in accordance with the Regulatory Flexibility Act, because they are likely to have a significant economic impact on a substantial number of small entities; and (2) Any rules that the Agency has identified for periodic review under the Regulatory Flexibility Act (5 U.S.C. 610). Although printing of these entries is limited to fields that contain information required by the Regulatory Flexibility Act's agenda requirements, additional information on these entries is in the Unified Agenda available online.","document_number":"2026-16622","html_url":"https://www.federalregister.gov/documents/2026/08/14/2026-16622/improving-government-regulations-unified-agenda-of-federal-regulatory-and-deregulatory-actions","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2026-08-14/pdf/2026-16622.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2026-16622.pdf?1786625116","publication_date":"2026-08-14","agencies":[{"raw_name":"DEPARTMENT OF WAR"}],"excerpts":"L. 116-92, sec. 1648 \n Abstract: DoD is issuing a final rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) to implement the contractual requirements associated with the <span class=\"match\">CMMC</span> 2.0 Framework in order to protect against the theft of intellectual property and sensitive information from the Defense Industrial Base (DIB) sector. The <span class=\"match\">CMMC</span> 2.0 Framework, as defined in 32 CFR part 170, assesses compliance with applicable information security requirements. This rule provides DoD with assurances that a DIB contractor can adequately protect"},{"title":"Improving Government Regulations; Unified Agenda of Federal Regulatory and Deregulatory Actions","type":"Notice","abstract":"This agenda announces the regulatory and deregulatory actions the Department of Defense (DoD) plans to take in the next 12 months and those regulatory and deregulatory actions completed since the publication of the Fall 2024 Unified Agenda. It was developed under the guidelines of Executive Order 12866, \"Regulatory Planning and Review,\" and Executive Order 13563, \"Improving Regulation and Regulatory Review.\" This agenda includes actions that support the Administration's priorities, the Secretary of Defense's top priorities to revive warrior ethos, rebuild our military, reestablish deterrence, as well as those priorities of the National Defense Strategy. These actions include efforts to make America safe, make America affordable and energy dominant, and bring back American values. Members of the public may submit comments on individual proposed and interim final rulemakings at www.regulations.gov during the comment period that follows publication in the Federal Register. This agenda updates the report published on December 13, 2024, and includes regulations expected to be issued or under review by DoD over the next 12 months. The next agenda will publish in the fall of 2025. The complete Unified Agenda will be available online at www.reginfo.gov. In accordance with the Regulatory Flexibility Act (5 U.S.C. 602), which requires agencies to publish their regulatory flexibility agendas in the Federal Register, the Department of Defense's printed agenda entries in the Federal Register include only: (1) rules that are in the Agency's regulatory flexibility agenda, in accordance with the Regulatory Flexibility Act, because they are likely to have a significant economic impact on a substantial number of small entities; and (2) Any rules that the Agency has identified for periodic review under the Regulatory Flexibility Act (5 U.S.C. 610). Although printing of these entries is limited to fields that contain information required by the Regulatory Flexibility Act's agenda requirements, additional information on these entries is in the Unified Agenda available online.","document_number":"2025-18326","html_url":"https://www.federalregister.gov/documents/2025/09/22/2025-18326/improving-government-regulations-unified-agenda-of-federal-regulatory-and-deregulatory-actions","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2025-09-22/pdf/2025-18326.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2025-18326.pdf?1758285918","publication_date":"2025-09-22","agencies":[{"raw_name":"DEPARTMENT OF DEFENSE","name":"Defense Department","id":103,"url":"https://www.federalregister.gov/agencies/defense-department","json_url":"https://www.federalregister.gov/api/v1/agencies/103","parent_id":null,"slug":"defense-department"}],"excerpts":"L. 116-92, sec. 1648 \n Abstract: DoD is issuing a final rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) to implement the contractual requirements associated with the <span class=\"match\">CMMC</span> 2.0 Framework in order to protect against the theft of intellectual property and sensitive information from the Defense Industrial Base (DIB) sector. The <span class=\"match\">CMMC</span> 2.0 Framework, as defined in 32 CFR part 170, assesses compliance with applicable information security requirements. This rule provides DoD with assurances that a DIB contractor can adequately protect"},{"title":"Submission for OMB Review; Comment Request","type":"Notice","abstract":"The DoD has submitted to the Office of Management and Budget (OMB) for clearance the following proposal for collection of information under the provisions of the Paperwork Reduction Act.","document_number":"2024-20650","html_url":"https://www.federalregister.gov/documents/2024/09/12/2024-20650/submission-for-omb-review-comment-request","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-09-12/pdf/2024-20650.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-20650.pdf?1726058734","publication_date":"2024-09-12","agencies":[{"raw_name":"DEPARTMENT OF DEFENSE","name":"Defense Department","id":103,"url":"https://www.federalregister.gov/agencies/defense-department","json_url":"https://www.federalregister.gov/api/v1/agencies/103","parent_id":null,"slug":"defense-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"Cybersecurity Maturity Model Certification (<span class=\"match\">CMMC</span>) program, which is currently in the Rulemaking process under 32 CFR part 170. The <span class=\"match\">CMMC</span> program will require <span class=\"match\">CMMC</span> Level 2 Certification Assessments be conducted by a <span class=\"match\">CMMC</span> Third Party Assessment Organization (C3PAO), accredited by the DoD approved <span class=\"match\">CMMC</span> Accreditation Body (AB). To be accredited, the <span class=\"match\">CMMC</span> AB and all C3PAOs must receive a favorable adjudication and not be subject to a level of risk from Foreign Ownership, Control, or Influence (FOCI) as determined by the <span class=\"match\">CMMC</span> Program Management Office (PMO). DCSA"},{"title":"Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041)","type":"Proposed Rule","abstract":"DoD is proposing to amend the Defense Federal Acquisition Regulation Supplement (DFARS) to incorporate contractual requirements related to the proposed Cybersecurity Maturity Model Certification 2.0 program rule, Cybersecurity Maturity Model Certification Program. This proposed DFARS rule also partially implements a section of the National Defense Authorization Act for Fiscal Year 2020 that directed the Secretary of Defense to develop a consistent, comprehensive framework to enhance cybersecurity for the U.S. defense industrial base.","document_number":"2024-18110","html_url":"https://www.federalregister.gov/documents/2024/08/15/2024-18110/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-08-15/pdf/2024-18110.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-18110.pdf?1723639522","publication_date":"2024-08-15","agencies":[{"raw_name":"DEPARTMENT OF DEFENSE","name":"Defense Department","id":103,"url":"https://www.federalregister.gov/agencies/defense-department","json_url":"https://www.federalregister.gov/api/v1/agencies/103","parent_id":null,"slug":"defense-department"},{"raw_name":"Defense Acquisition Regulations System","name":"Defense Acquisition Regulations System","id":97,"url":"https://www.federalregister.gov/agencies/defense-acquisition-regulations-system","json_url":"https://www.federalregister.gov/api/v1/agencies/97","parent_id":103,"slug":"defense-acquisition-regulations-system"}],"excerpts":"Maturity Model Certification Level Requirements, clause of this solicitation.\n \n \n (b)(1) \n Cybersecurity Maturity Model Certification (<span class=\"match\">CMMC</span>) level. \n The <span class=\"match\">CMMC</span> certificate or <span class=\"match\">CMMC</span> self-assessment level required by this solicitation is: _____ \n [Contracting Officer insert: <span class=\"match\">CMMC</span> Level 1 self-assessment; <span class=\"match\">CMMC</span> Level 2 certificate or <span class=\"match\">CMMC</span> self-assessment; or <span class=\"match\">CMMC</span> Level 3 certificate]. \n This <span class=\"match\">CMMC</span> certificate or <span class=\"match\">CMMC</span> self-assessment level, or higher, is required prior to award for each contractor information system that will process, store, or transmit"},{"title":"Submission for OMB Review; Comment Request","type":"Notice","abstract":"The DoD has submitted to the Office of Management and Budget (OMB) for clearance the following proposal for collection of information under the provisions of the Paperwork Reduction Act.","document_number":"2024-13468","html_url":"https://www.federalregister.gov/documents/2024/06/21/2024-13468/submission-for-omb-review-comment-request","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-06-21/pdf/2024-13468.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-13468.pdf?1718887518","publication_date":"2024-06-21","agencies":[{"raw_name":"DEPARTMENT OF DEFENSE","name":"Defense Department","id":103,"url":"https://www.federalregister.gov/agencies/defense-department","json_url":"https://www.federalregister.gov/api/v1/agencies/103","parent_id":null,"slug":"defense-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"requests (ICR), one for the <span class=\"match\">CMMC</span> Program and this one for <span class=\"match\">CMMC</span> eMASS.\n \n The <span class=\"match\">CMMC</span> instantiation of eMASS is the electronic collection mechanism for collecting <span class=\"match\">CMMC</span> program data, which provides the Department of Defense (DoD) visibility of the <span class=\"match\">CMMC</span> Levels 2 and 3 certification assessment results. \n \n This information collection is necessary to support the implementation of the <span class=\"match\">CMMC</span> assessment process for <span class=\"match\">CMMC</span> Level 2 and Level 3 certification assessments, as \n \n defined in 32 CFR 170.17 and 170.18 respectively.\n \n The <span class=\"match\">CMMC</span> Level 2 certification assessment"},{"title":"Submission for OMB Review; Comment Request","type":"Notice","abstract":"The DoD has submitted to the Office of Management and Budget (OMB) for clearance the following proposal for collection of information under the provisions of the Paperwork Reduction Act.","document_number":"2024-13464","html_url":"https://www.federalregister.gov/documents/2024/06/21/2024-13464/submission-for-omb-review-comment-request","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-06-21/pdf/2024-13464.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-13464.pdf?1718887517","publication_date":"2024-06-21","agencies":[{"raw_name":"DEPARTMENT OF DEFENSE","name":"Defense Department","id":103,"url":"https://www.federalregister.gov/agencies/defense-department","json_url":"https://www.federalregister.gov/api/v1/agencies/103","parent_id":null,"slug":"defense-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"rule includes two separate information collection requests (ICR), this one for the <span class=\"match\">CMMC</span> Program and one for <span class=\"match\">CMMC</span> eMASS.\n \n This information collection is necessary to support the implementation of the <span class=\"match\">CMMC</span> assessment process for Levels 2 and 3 certification assessment, as defined in 32 CFR 170.17 and 170.18 respectively. \n Level 2 Certification Assessments \n \n The Level 2 certification assessment process is conducted by <span class=\"match\">CMMC</span> Certified Assessors, employed by <span class=\"match\">CMMC</span> Third-Party Assessment Organizations (C3PAOs). During the assessment process, Organizations"},{"title":"Improving Government Regulations; Unified Agenda of Federal Regulatory and Deregulatory Actions","type":"Proposed Rule","abstract":"This agenda announces the regulatory actions the Department of Defense (DoD) plans to take in the next 12 months and those regulatory actions completed since the publication of the Fall 2023 Unified Agenda. It was developed under the guidelines of Executive Order 12866, \"Regulatory Planning and Review,\" as amended by Executive Order 14094, \"Modernizing Regulatory Review\" and Executive Order 13563, \"Improving Regulation and Regulatory Review.\" This agenda includes regulatory actions that support the Administration's regulatory priorities, the Secretary of Defense's top priorities to defend the Nation, take care of our people, and succeed through teamwork, as well as those priorities of the National Defense Strategy. These actions include efforts to promote the country's economic resilience; address healthcare issues; support underserved communities and improve small business opportunities; promote competition in the American economy; address issues impacting the Federal workforce; support national security efforts, especially safeguarding Federal Government information and information technology systems; support the climate change emergency; and address issues impacting military families. Members of the public may submit comments on individual proposed and interim final rulemakings at www.regulations.gov during the comment period that follows publication in the Federal Register. This agenda updates the report published on February 9, 2024, and includes regulations expected to be issued and under review over the next 12 months. The next agenda will publish in the fall of 2024. The complete Unified Agenda will be available online at www.reginfo.gov. In accordance with the Regulatory Flexibility Act (5 U.S.C. 602), which requires agencies to publish its regulatory flexibility agendas in the Federal Register, the Department of Defense's printed agenda entries in the Federal Register include only: (1) rules that are in the Agency's regulatory flexibility agenda, in accordance with the Regulatory Flexibility Act, because they are likely to have a significant economic impact on a substantial number of small entities; and (2) Any rules that the Agency has identified for periodic review under section 610 of the Regulatory Flexibility Act. Although printing of these entries is limited to fields that contain information required by the Regulatory Flexibility Act's agenda requirements, additional information on these entries is in the Unified Agenda available online.","document_number":"2024-16449","html_url":"https://www.federalregister.gov/documents/2024/08/16/2024-16449/improving-government-regulations-unified-agenda-of-federal-regulatory-and-deregulatory-actions","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-08-16/pdf/2024-16449.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-16449.pdf?1723725918","publication_date":"2024-08-16","agencies":[{"raw_name":"DEPARTMENT OF DEFENSE","name":"Defense Department","id":103,"url":"https://www.federalregister.gov/agencies/defense-department","json_url":"https://www.federalregister.gov/api/v1/agencies/103","parent_id":null,"slug":"defense-department"}],"excerpts":"Identifier No. \n \n \n \n 57 \n Cybersecurity Maturity Model Certification (<span class=\"match\">CMMC</span>) Program \n 0790-AL49 \n \n \n \n Defense Acquisition Regulations Council—Proposed Rule Stage \n \n Sequence No. \n Title \n \n Regulation \n Identifier No. \n \n \n \n 58 \n Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041) \n 0750-AK81 \n \n \n \n DEPARTMENT OF DEFENSE (DOD) \n \n Office of the Secretary (OS) \n Final Rule Stage \n 57. Cybersecurity Maturity Model Certification (<span class=\"match\">CMMC</span>) Program [0790-AL49] \n \n Legal Authority: \n 5 U.S.C. 301; Pub. L. 116-92"},{"title":"Proposed Collection; Comment Request","type":"Notice","abstract":"In compliance with the Paperwork Reduction Act of 1995, the Defense Counterintelligence and Security Agency (DCSA) announces a proposed public information collection and seeks public comment on the provisions thereof. Comments are invited on: whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information shall have practical utility; the accuracy of the agency's estimate of the burden of the proposed information collection; ways to enhance the quality, utility, and clarity of the information to be collected; and ways to minimize the burden of the information collection on respondents, including through the use of automated collection techniques or other forms of information technology.","document_number":"2024-08476","html_url":"https://www.federalregister.gov/documents/2024/04/22/2024-08476/proposed-collection-comment-request","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-04-22/pdf/2024-08476.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-08476.pdf?1713530723","publication_date":"2024-04-22","agencies":[{"raw_name":"DEPARTMENT OF DEFENSE","name":"Defense Department","id":103,"url":"https://www.federalregister.gov/agencies/defense-department","json_url":"https://www.federalregister.gov/api/v1/agencies/103","parent_id":null,"slug":"defense-department"},{"raw_name":"Office of the Secretary"}],"excerpts":"Cybersecurity Maturity Model Certification (<span class=\"match\">CMMC</span>) program, which is currently in the Rulemaking process under 32 CFR part 170. The <span class=\"match\">CMMC</span> program will require <span class=\"match\">CMMC</span> Level 2 Certification Assessments be conducted by a <span class=\"match\">CMMC</span> Third Party Assessment Organization (C3PAO), accredited by the DoD approved <span class=\"match\">CMMC</span> Accreditation Body (AB). To be accredited, the <span class=\"match\">CMMC</span> AB and all C3PAOs must receive a favorable adjudication and not be subject to a level of risk from Foreign Ownership, Control, or Influence (FOCI) as determined by the <span class=\"match\">CMMC</span> Program Management Office (PMO). DCSA"},{"title":"National Flood Insurance Program (NFIP); Assistance to Private Sector Property Insurers, Notice of FY 2027 Arrangement","type":"Notice","abstract":"The Federal Emergency Management Agency announces the Fiscal Year 2027 Financial Assistance/Subsidy Arrangement for private property insurers interested in participating in the National Flood Insurance Program's Write Your Own Program.","document_number":"2026-08728","html_url":"https://www.federalregister.gov/documents/2026/05/05/2026-08728/national-flood-insurance-program-nfip-assistance-to-private-sector-property-insurers-notice-of-fy","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2026-05-05/pdf/2026-08728.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2026-08728.pdf?1777898758","publication_date":"2026-05-05","agencies":[{"raw_name":"DEPARTMENT OF HOMELAND SECURITY","name":"Homeland Security Department","id":227,"url":"https://www.federalregister.gov/agencies/homeland-security-department","json_url":"https://www.federalregister.gov/api/v1/agencies/227","parent_id":null,"slug":"homeland-security-department"},{"raw_name":"FEDERAL EMERGENCY MANAGEMENT AGENCY","name":"Federal Emergency Management Agency","id":166,"url":"https://www.federalregister.gov/agencies/federal-emergency-management-agency","json_url":"https://www.federalregister.gov/api/v1/agencies/166","parent_id":227,"slug":"federal-emergency-management-agency"}],"excerpts":"Article III.M.1 with either: \n \n i. ISO/IEC 27001, \n https://www.iso.org/isoiec-27001-information-security.html; \n \n \n ii. NIST Cybersecurity Framework, \n https://csrc.nist.gov/pubs/sp/800/171/r3/final; \n \n \n iii. Cybersecurity Maturity Model Certification (<span class=\"match\">CMMC</span> 2.0); \n https://dodcio.defense.gov/<span class=\"match\">CMMC</span>; \n \n \n iv. Service and Organization Controls (SOC) 2, \n https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services; \n or\n \n v. Another comparable standard deemed acceptable by FEMA. \n \n b. Provide a plan of action"},{"title":"Improving Government Regulations; Unified Agenda of Federal Regulatory and Deregulatory Actions","type":"Proposed Rule","abstract":"This agenda announces the regulatory actions the Department of Defense (DoD) plans to take in the next 12 months and those regulatory actions completed since the publication of the spring 2023 Unified Agenda. It was developed under the guidelines of Executive Order 12866, \"Regulatory Planning and Review,\" and Executive Order 13563, \"Improving Regulation and Regulatory Review.\" This agenda includes regulatory actions that support the Administration's regulatory priorities, the Secretary of Defense's top priorities to defend the Nation, take care of our people, and succeed through teamwork, as well as those priorities of the National Defense Strategy. These actions include efforts to promote the country's economic resilience; address healthcare issues; support underserved communities and improve small business opportunities; promote competition in the American economy; promote diversity, equity, inclusion, and accessibility in the Federal workforce; support national security efforts, especially safeguarding Federal Government information and information technology systems; tackle the climate crisis; and address military family matters. Members of the public may submit comments on individual proposed and interim final rulemakings at www.regulations.gov during the comment period that follows publication in the Federal Register. Additionally, specific agenda entries include information on public participation and community outreach efforts conducted or planned for those regulatory entries. This agenda updates the report published on June 13, 2023, and includes regulations expected to be issued and under review over the next 12 months. The next agenda will publish in the spring of 2024. The complete Unified Agenda will be available online at www.reginfo.gov. In accordance with the Regulatory Flexibility Act (5 U.S.C. 602), which requires agencies to publish its regulatory flexibility agendas in the Federal Register, the Department of Defense's printed agenda entries in the Federal Register include only: (1) rules that are in the Agency's regulatory flexibility agenda, in accordance with the Regulatory Flexibility Act, because they are likely to have a significant economic impact on a substantial number of small entities; and (2) Any rules that the Agency has identified for periodic review under section 610 of the Regulatory Flexibility Act. Although printing of these entries is limited to fields that contain information required by the Regulatory Flexibility Act's agenda requirements, additional information on these entries is in the Unified Agenda available online.","document_number":"2024-00516","html_url":"https://www.federalregister.gov/documents/2024/02/09/2024-00516/improving-government-regulations-unified-agenda-of-federal-regulatory-and-deregulatory-actions","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2024-02-09/pdf/2024-00516.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2024-00516.pdf?1707399918","publication_date":"2024-02-09","agencies":[{"raw_name":"DEPARTMENT OF DEFENSE","name":"Defense Department","id":103,"url":"https://www.federalregister.gov/agencies/defense-department","json_url":"https://www.federalregister.gov/api/v1/agencies/103","parent_id":null,"slug":"defense-department"}],"excerpts":"Assistant to the Secretary of Defense for Privacy, Civil Liberties, and Transparency, Department of Defense. \n \n \n Office of the Secretary—Proposed Rule Stage \n \n Sequence No. \n Title \n \n Regulation \n Identifier No. \n \n \n \n 297 \n \n Cybersecurity Maturity Model Certification (<span class=\"match\">CMMC</span>) Program \n (Reg Plan Seq No. 19) \n \n 0790-AL49 \n \n \n References in boldface appear in The Regulatory Plan in part II of this issue of the \n Federal Register \n .\n \n \n \n Defense Acquisition Regulations Council—Proposed Rule Stage \n \n Sequence No. \n Title \n \n Regulation \n Identifier"},{"title":"National Flood Insurance Program (NFIP); Assistance to Private Sector Property Insurers, Notice of FY 2026 Arrangement","type":"Notice","abstract":"The Federal Emergency Management Agency announces the Fiscal Year 2026 Financial Assistance/Subsidy Arrangement for private property insurers interested in participating in the National Flood Insurance Program's Write Your Own Program.","document_number":"2025-00511","html_url":"https://www.federalregister.gov/documents/2025/01/15/2025-00511/national-flood-insurance-program-nfip-assistance-to-private-sector-property-insurers-notice-of-fy","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2025-01-15/pdf/2025-00511.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2025-00511.pdf?1736862326","publication_date":"2025-01-15","agencies":[{"raw_name":"DEPARTMENT OF HOMELAND SECURITY","name":"Homeland Security Department","id":227,"url":"https://www.federalregister.gov/agencies/homeland-security-department","json_url":"https://www.federalregister.gov/api/v1/agencies/227","parent_id":null,"slug":"homeland-security-department"},{"raw_name":"FEDERAL EMERGENCY MANAGEMENT AGENCY","name":"Federal Emergency Management Agency","id":166,"url":"https://www.federalregister.gov/agencies/federal-emergency-management-agency","json_url":"https://www.federalregister.gov/api/v1/agencies/166","parent_id":227,"slug":"federal-emergency-management-agency"}],"excerpts":"Article III.M.1 with either: \n \n i. ISO/IEC 27001, \n https://www.iso.org/isoiec-27001-information-security.html \n \n \n ii. NIST Cybersecurity Framework, \n https://csrc.nist.gov/pubs/sp/800/171/r3/final; \n \n \n iii. Cybersecurity Maturity Model Certification (<span class=\"match\">CMMC</span> 2.0), \n https://dodcio.defense.gov/<span class=\"match\">CMMC</span>/; \n \n \n iv. Service and Organization Controls (SOC) 2, \n https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/sorhome.html; \n or\n \n v. Another comparable standard deemed acceptable by FEMA. \n \n b. Provide a plan of action that describes how"},{"title":"Improving Government Regulations; Unified Agenda of Federal Regulatory and Deregulatory Actions","type":"Proposed Rule","abstract":"This agenda announces the regulatory actions the Department of Defense (DoD) plans to take in the next 12 months and those regulatory actions completed since the publication of the fall 2022 Unified Agenda. It was developed under the guidelines of Executive Order 12866, \"Regulatory Planning and Review,\" and Executive Order 13563, \"Improving Regulation and Regulatory Review.\" This agenda includes regulatory actions that support the Administration's regulatory priorities, the Secretary of Defense's top priorities to defend the Nation, take care of our people, and succeed through teamwork, as well as those priorities of the National Defense Strategy. These actions include efforts to promote the country's economic resilience; healthcare issues; support underserved communities and improve small business opportunities; promote competition in the American economy; promote diversity, equity, inclusion, and accessibility in the Federal workforce; support national security efforts, especially safeguarding Federal Government information and information technology systems; tackle the climate crisis; and address military family matters. Members of the public may submit comments on individual proposed and interim final rulemakings at www.regulations.gov during the comment period that follows publication in the Federal Register. This agenda updates the report published on February 22, 2023, and includes regulations expected to be issued and under review over the next 12 months. The next agenda will publish in the fall of 2023. The complete Unified Agenda will be available online at www.reginfo.gov. In accordance with the Regulatory Flexibility Act (5 U.S.C. 602), which requires agencies to publish its regulatory flexibility agendas in the Federal Register, the Department of Defense's printed agenda entries in the Federal Register include only: (1) rules that are in the Agency's regulatory flexibility agenda, in accordance with the Regulatory Flexibility Act, because they are likely to have a significant economic impact on a substantial number of small entities; and (2) Any rules that the Agency has identified for periodic review under section 610 of the Regulatory Flexibility Act. Although printing of these entries is limited to fields that contain information required by the Regulatory Flexibility Act's agenda requirements, additional information on these entries is in the Unified Agenda available online.","document_number":"2023-14541","html_url":"https://www.federalregister.gov/documents/2023/07/27/2023-14541/improving-government-regulations-unified-agenda-of-federal-regulatory-and-deregulatory-actions","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2023-07-27/pdf/2023-14541.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2023-14541.pdf?1690375513","publication_date":"2023-07-27","agencies":[{"raw_name":"DEPARTMENT OF DEFENSE","name":"Defense Department","id":103,"url":"https://www.federalregister.gov/agencies/defense-department","json_url":"https://www.federalregister.gov/api/v1/agencies/103","parent_id":null,"slug":"defense-department"}],"excerpts":"Treatment Under the TRICARE Program \n 0720-AB77 \n \n \n \n DEPARTMENT OF DEFENSE (DOD) \n \n Office of the Secretary (OS) \n Proposed Rule Stage \n 54. Cybersecurity Maturity Model Certification (<span class=\"match\">CMMC</span>) Program [0790-AL49] \n \n Legal Authority: \n 5 U.S.C. 301; Pub. L. 116-92, sec. 1648\n \n \n Abstract: \n DOD is proposing to implement the Cybersecurity Maturity Model Certification (<span class=\"match\">CMMC</span>) Framework, to help assess a Defense Industrial Base (DIB) contractor's compliance with and implementation of cybersecurity requirements to safeguard Federal Contract Information (FCI)"},{"title":"Amended Trade Mission Application Deadline and Updated Schedule to the Executive-Led Cybersecurity Business Development Mission to Taiwan, South Korea, and Japan","type":"Notice","abstract":"The United States Department of Commerce, International Trade Administration (ITA), is organizing an Executive-Led Cybersecurity Business Development Mission to Taiwan, South Korea, and Japan on September 18-26, 2023. This notice is to update the prior Federal Register notice to reflect that the application deadline is now extended to July 21, 2023 and the proposed timetable has been updated to include additional events.","document_number":"2023-14724","html_url":"https://www.federalregister.gov/documents/2023/07/18/2023-14724/amended-trade-mission-application-deadline-and-updated-schedule-to-the-executive-led-cybersecurity","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2023-07-18/pdf/2023-14724.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2023-14724.pdf?1689597915","publication_date":"2023-07-18","agencies":[{"raw_name":"DEPARTMENT OF COMMERCE","name":"Commerce Department","id":54,"url":"https://www.federalregister.gov/agencies/commerce-department","json_url":"https://www.federalregister.gov/api/v1/agencies/54","parent_id":null,"slug":"commerce-department"},{"raw_name":"International Trade Administration","name":"International Trade Administration","id":261,"url":"https://www.federalregister.gov/agencies/international-trade-administration","json_url":"https://www.federalregister.gov/api/v1/agencies/261","parent_id":54,"slug":"international-trade-administration"}],"excerpts":"specific goals of mission participants; and ground transportation.\n \n \n \n   \n \n   \n   \n \n \n Sunday, September 17, 2023 \n Trade Mission Participants Arrive in Taipei. \n \n \n Monday, September 18, 2023 \n \n Welcome and Taiwan Briefing.\n Cybersecurity Maturity Model Certification (<span class=\"match\">CMMC</span>) Seminar. \n One-on-One business matchmaking appointments. \n Networking Reception at residence of the Deputy Director of the American Institute in Taiwan (To Be Confirmed). \n \n \n \n Tuesday, September 19, 2023 \n \n Attend U.S. Business Day forum to meet with Taiwan public and"},{"title":"Cybersecurity Maturity Model Certification (CMMC) 2.0 Updates and Way Forward","type":"Proposed Rule","abstract":"This document provides updated information on DoD's way forward for the approved Cybersecurity Maturity Model Certification (CMMC) program changes, designated as \"CMMC 2.0.\" CMMC 2.0 builds upon the initial CMMC framework to dynamically enhance Defense Industrial Base (DIB) cybersecurity against evolving threats. The CMMC framework is designed to protect sensitive unclassified information that is shared by the Department with its contractors and subcontractors and provide assurance that Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) will be protected at a level commensurate with the risk from cybersecurity threats, including Advanced Persistent Threats. Under the CMMC program, DIB contractors will be required to implement certain cybersecurity protection standards, and, as required, perform self-assessments or obtain third-party certification as a condition of DoD contract award.","document_number":"2021-24880","html_url":"https://www.federalregister.gov/documents/2021/11/17/2021-24880/cybersecurity-maturity-model-certification-cmmc-20-updates-and-way-forward","pdf_url":"https://www.govinfo.gov/content/pkg/FR-2021-11-17/pdf/2021-24880.pdf","public_inspection_pdf_url":"https://public-inspection.federalregister.gov/2021-24880.pdf?1637070319","publication_date":"2021-11-17","agencies":[{"raw_name":"DEPARTMENT OF DEFENSE","name":"Defense Department","id":103,"url":"https://www.federalregister.gov/agencies/defense-department","json_url":"https://www.federalregister.gov/api/v1/agencies/103","parent_id":null,"slug":"defense-department"},{"raw_name":"Office of the Secretary"},{"raw_name":"Defense Acquisition Regulations System","name":"Defense Acquisition Regulations System","id":97,"url":"https://www.federalregister.gov/agencies/defense-acquisition-regulations-system","json_url":"https://www.federalregister.gov/api/v1/agencies/97","parent_id":103,"slug":"defense-acquisition-regulations-system"}],"excerpts":"implement any needed changes to the <span class=\"match\">CMMC</span> program content in 48 CFR. Both rules will have public comment periods. \n Publication of title 32 and title 48 CFR rules will implement DoD's requirements for the updated <span class=\"match\">CMMC</span> version 2.0, which include various modifications from <span class=\"match\">CMMC</span> 1.0. \n These modifications include: \n • Eliminating levels 2 and 4, and renaming the remaining three levels in <span class=\"match\">CMMC</span> 2.0 as follows: \n ○ Level 1 (Foundational) will remain the same as <span class=\"match\">CMMC</span> 1.0 Level 1; \n ○ Level 2 (Advanced) will be similar to <span class=\"match\">CMMC</span> 1.0 Level 3; \n ○ Level 3 (Expert)"}]}