Defense Dept. rule establishes cyber compliance regime ahead of full CMMC implementation

The Pentagon will require government contractors to submit a self-assessment of their compliance with the 110 controls in NIST Special Publication 800-171 starting Nov. 30, establishing a new cyber regime for contractors under the Defense Department that will have a wide-ranging impact on the DOD supply chain.

The interim rule published on Sept. 29 sets up the requirements for the Defense Department’s Cybersecurity Maturity Model Certification program, which will be rolled out over a five-year period. In the interim, contractors...