by Thomas Kinsinger
Director of Technology, E-N Computers
10+ years experience in enterprise IT and managed services.
The public comment period for CMMC 2.0 has begun! On December 26, 2023, the Department of Defense announced publication of the CMMC program proposed rule. This marks the official start of the 60-day public comment period. You can view the proposed rule, read public comments, and leave your own comment at Regulations.gov. The comment period will end February 26, 2024, unless extended by the Department of Defebse.
In addition to the CMMC proposed rule, the DoD is accepting comments on CMMC guidance documents. The public comment period for the related DFARS proposed rule is expected to begin in Q1 2024.
QUICK ANSWER:
What is the CMMC public comment period and why does it matter?
The public comment period is your opportunity to give input on the CMMC rule and program before it is finalized. This period is scheduled to end on February 26, 2024. Afterward, the DoD will prepare a final draft and submit it to OIRA for impact analysis. This means that phase-in of CMMC is on track to begin Q1 2025.
Table of Contents
Why does the CMMC proposed rule publication matter?
The public comment period is your opportunity to give input on the proposed rule. Anyone — defense contractor, IT professional, or anyone else — can participate in this stage of the process. If you have concerns about how the rule will affect your business or sections that are unclear or if you want to express support for the rule in whole or in part, you can do so. Comments are not a vote for or against the rule but can affect the final rule.
What’s next in the CMMC process?
The comment period will end on February 26, 2024. The DoD may extend it an additional 30 days. Then, they will review comments and submit a draft of the final rule to the Office of Information and Regulatory Affairs (OIRA). According to the Office of the Federal Register, this “final analysis of estimated costs and benefits may take into consideration any comments and alternate solutions suggested in public comments.” This stage can take nine to twelve months. Afterward, the final rule will be published in the Federal Register with an effective date that must be at least 30 days out.
We currently expect that the final rule will become effective in Q1 2025. CMMC will be phased in over a three-year period, so that the program will be in full effect by 2028.
How is your IT maturity?
When you have the right people working together, you can implement systems and processes that actively help you reach your business goals. We sometimes call this IT maturity. But for many organizations, something is off when it comes to their partnerships, strategy, systems, and settings. How can you know what’s working well and where you have room for improvement? Start by taking our free IT Maturity Self-Assessment. You’ll walk away with some pointers and, if you want, a free appointment to discuss your results.
Take the IT Maturity Assessment
Is your business ready to weather changes, including employee turnover? Find out by taking our IT maturity assessment.
You’ll get personalized action items that you can use to make improvements right away. Plus, you’ll have the opportunity to book a FREE IT strategy session to get even more insights into your IT needs.
