Title 48 proposed rule was recently published for public comment on August 15 th , 2024. The public has 60 days to comment. Then, typically after a couple months, the proposed rule will be sent to OIRA (Office of Information and Regulatory Affairs) for further review before being published in its final form.
This is about 8 months behind Title 32’s process, with Title 32’s public comment period having ended this past February 2024, and its submission to OIRA in June.
It’s no secret, Title 32 will easily win as the first published final rule, expected as early as this coming November 2024, well ahead of Title 48’s expected final rule publication date if fast-tracked in Q2 2025 or more likely in Q3 2025.
The race isn’t really between the two rules, we know the winner for that already.
The race is for companies who are doing business with the DoD to get serious about meeting their CMMC/NIST compliance requirements… Or be ineligible to compete for DoD contracts.
So, let’s dig a bit deeper into what these two rules actually mean for defense manufacturers.
Title 32 and Title 48 Timeline
The 32 CFR: The Starting Gun for the CMMC Race
While the effective date of the 48 CFR Final Rule (expected in Q2 or Q3 2025) will determine when the CMMC 2.0 regulation must be included in contracts, known as the “phased rollout,” it’s a common misconception that this is the key milestone for the start of the CMMC race.
In reality, the kickoff for the CMMC race will be determined by the effective date of the 32 CFR Final Rule (expected mid-Q4 2024), not the 48 CFR Final Rule.
The 32 CFR Final Rule will initiate the “market rollout,” allowing CMMC assessments to begin. Once these assessments are available, prime contractors (e.g., Boeing, Vigor, Lockheed Martin, Raytheon) will likely require their subcontractors to obtain CMMC certification as soon as possible. This will help them maintain a competitive edge and avoid the risk of non-certified suppliers jeopardizing their owncertification status, well before the DoD enforces the “phased rollout.”
The 48 CFR: The Playbook for CMMC
The proposed rule for the 48 CFR CMMC was published on Thursday, August 15, 2024. A 60-day public comment period is in process, ending on Tuesday, October 15, 2024. Key changes to the existing Defense Federal Acquisition Regulation Supplement (DFARS) include:
- Adding references to the proposed CMMC 2.0 program requirements at 32 CFR part 170.
- Including definitions for Controlled Unclassified Information (CUI) and Department of Defense Unique Identifier (DoD UID) in the subpart.
- Establishing a solicitation provision and prescription.
- Revising the existing clause language and requirements.
The phased roll-out of these changes is expected to take three years. The Department of Defense (DoD) estimates that 35% of the Defense Industrial Base (DIB) will need CMMC Level 2 certification, whereas only 2% will require self attestation. This is from a total number o 29,543 DIB companies listed within the Title 48 proposed rule.
Considering the progression of the 32 CFR CMMC rule from proposal, through comments and adjudication, to a final rule, the self-assessment phase could begin in March 2025 and the phased roll- out could begin in Summer 2025.
The DoD has included responses to public comments on the 2020 CMMC rule. Regarding the impact on small businesses, the phased roll-out is “intended to mitigate the impact of CMMC on contractors”.
Contracting Officers May Include CMMC Clauses Prior to Final Rule
That’s right, before the final rule is published, DoD Contracting Officers “have the discretion to bilaterally incorporate the clause in contracts in effect prior to the effective date of the clause, with appropriate consideration. See FAR 1.108(d).”
This means that certain DoD contracts may require CMMC assessments for companies in their supply chain before the Title 48 final rule is published.
Title 32 and Title 48 Compared
The Executive Summary
The key point is that CMMC is happening; with the Title 32 final rule likely published before the end of 2024, and Title 48 final rule published by mid-year 2025, DoD suppliers will almost assuredly have to meet CMMC compliance within the next 12 months.
Primes are even now requiring their subcontractors and suppliers to meet CMMC requirements as a hedge against securing future contracts. The flow down of these requirements will start to become the norm, as lower tier subcontractors and suppliers under the Primes begin demanding CMMC compliance from their subcontractor and supplier base.
Eventually, perhaps before the end of 2025, all subcontractors and suppliers wh do not achieve CMMC compliance, either self-attested or assessed, will not be able to participate in supplying DoD contracts.
