Arlington: Rule change needed for CMMC program enters 'end phase'

摘要

The Defense Department expects to have a proposed acquisition rule needed to implement its cyber certification program out for public comment by November, according to Pentagon acquisition Chief Information Security Officer Katie Arlington, with the final regulation probably pushed into 2021. The rule for the Cybersecurity Maturity Model Certification program was submitted for review by the Office of Management and Budget in May. DOD had set an aggressive schedule for issuing the proposed rule for public comment by July and getting the final rule put in place by the end of this year. The delay means that the time to review and adjudicate comments on the proposed rule will likely shift into early 2021. Once the final rule is sent to OMB's Office of Information and Regulatory Affairs, there could be a second -potentially lengthy - interagency process before it is released and becomes effective.