Notice2023-27281
Cybersecurity Maturity Model Certification (CMMC) Program Guidance
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
December 26, 2023
Issuing agencies
Defense Department
Abstract
The Department of Defense announces the availability of eight guidance documents for the CMMC Program. These documents provide additional guidance for the CMMC model, assessments, scoring, and hashing.
Full Text
<html>
<head>
<title>Federal Register, Volume 88 Issue 246 (Tuesday, December 26, 2023)</title>
</head>
<body><pre>
[Federal Register Volume 88, Number 246 (Tuesday, December 26, 2023)]
[Notices]
[Pages 89139-89140]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2023-27281]
Federal Register / Vol. 88 , No. 246 / Tuesday, December 26, 2023 /
Notices
[[Page 89139]]
-----------------------------------------------------------------------
DEPARTMENT OF DEFENSE
Office of the Secretary
[Docket ID: DoD-2023-OS-0096]
Cybersecurity Maturity Model Certification (CMMC) Program
Guidance
AGENCY: Office of the Department of Defense Chief Information Officer
(CIO), Department of Defense (DoD).
ACTION: Notice of availability: CMMC guidance.
-----------------------------------------------------------------------
SUMMARY: The Department of Defense announces the availability of eight
guidance documents for the CMMC Program. These documents provide
additional guidance for the CMMC model, assessments, scoring, and
hashing.
DATES: Comments must be received by February 26, 2024.
ADDRESSES: You may use the following methods to submit comments on
these guidance documents, identified by agency name, docket number DoD-
2023-OS-0096, and title.
Comment Submission Methods include:
<bullet> Federal eRulemaking Portal: <a href="https://www.regulations.gov">https://www.regulations.gov</a>.
Follow the instructions for submitting comments.
<bullet> Mail: Department of Defense, Office of the Assistant to
the Secretary of Defense for Privacy, Civil Liberties, and
Transparency, Regulatory Directorate, 4800 Mark Center Drive, Attn:
Mailbox 24, Suite 08D09, Alexandria, VA 22350-1700.
Instructions: All submissions received must include the agency
name, docket number, and title for this Federal Register document. The
general policy for comments and other submissions from members of the
public is to make these submissions available for public viewing at
<a href="https://www.regulations.gov">https://www.regulations.gov</a> as they are received without change,
including any personal identifiers or contact information.
FOR FURTHER INFORMATION CONTACT: Ms. Diane Knight, Office of the DoD
CIO, 202-770-9100 or <a href="/cdn-cgi/l/email-protection#640b17004a0907490508011c4a000b0049070d0b4a09061c4a07090907495756070216491611080109050f0d0a032409050d084a090d08"><span class="__cf_email__" data-cfemail="d0bfa3b4febdb3fdb1bcb5a8feb4bfb4fdb3b9bffebdb2a8feb3bdbdb3fde3e2b3b6a2fda2a5bcb5bdb1bbb9beb790bdb1b9bcfebdb9bc">[email protected]</span></a>.
SUPPLEMENTARY INFORMATION:
CMMC Model Overview
DoD-CIO-00001 (ZRIN 0790-ZA17)
This document focuses on the CMMC Model as set forth in 32 CFR
170.14 of the CMMC Program proposed rule (See docket DoD-2023-OS-0063
on <a href="http://Regulations.gov">Regulations.gov</a>). The model incorporates the security requirements
from: (1) FAR 52.204-21, Basic Safeguarding of Covered Contractor
Information Systems, (2) NIST SP 800-171, Protecting Controlled
Unclassified Information in Nonfederal Systems and Organizations, and
(3) a selected set of the requirements from NIST SP 800-172, Enhanced
Security Requirements for Protecting Controlled Unclassified
Information: A Supplement to NIST Special Publication 800-171. The CMMC
Program is designed to provide increased assurance to the DoD that
defense contractors and subcontractors are compliant with information
protection requirements for Federal Contract Information (FCI) and
Controlled Unclassified Information (CUI) and are protecting such
information at a level commensurate with risk from cybersecurity
threats, including Advanced Persistent Threats (APTs).
CMMC Assessment Guide--Level 1
DoD-CIO-00002 (ZRIN 0790-ZA18)
This document provides guidance in the preparation for and
execution of a Level 1 Self-Assessment under the CMMC Program as set
forth in 32 CFR 170.15. CMMC Level 1 focuses on the protection of FCI,
which is defined in 32 CFR 170.4 and 48 CFR 4.1901 as:
Federal contract information means information, not intended for
public release, that is provided by or generated for the Government
under a contract to develop or deliver a product or service to the
Government, but not including information provided by the Government
to the public (such as on public websites) or simple transactional
information, such as necessary to process payments.
CMMC Level 1 is comprised of the 15 basic safeguarding requirements
specified in Federal Acquisition Regulation (FAR) Clause 52.204-21.
CMMC Assessment Guide--Level 2
DoD-CIO-00003 (ZRIN 0790-ZA19)
This document provides guidance in the preparation for and
execution of a Level 2 Self-Assessment or Level 2 Certification
Assessment under the CMMC Program as set forth 32 CFR 170.16 and 170.17
respectively. An Assessment as defined in 32 CFR 170.4 means:
The testing or evaluation of security controls to determine the
extent to which the controls are implemented correctly, operating as
intended, and producing the desired outcome with respect to meeting
the security requirements for an information system or organization
as defined in 32 CFR 170.15 to 32 CFR 170.18. For CMMC Level 2 there
are two types of assessments:
<bullet> A Self-Assessment is the term for the activity
performed by an entity to evaluate its own CMMC Level, as applied to
Level 1 and some Level 2.
<bullet> A CMMC Level 2 Certification Assessment is the term for
the activity performed by a Certified Third-Party Assessment
Organization (C3PAO) to evaluate the CMMC Level of an OSC.
32 CFR 170.16(b) describes contract or subcontract eligibility for any
contract with a CMMC Level 2 Self-Assessment requirement, and 32 CFR
170.17(b) describes contract or subcontract eligibility for any
contract with a CMMC Level 2 Certification Assessment requirement.
Level 2 Certification Assessment requires the OSA achieve either a
Level 2 Conditional Certification Assessment or a Level 2 Final
Certification Assessment, as described in 32 CFR 170.4, obtained
through an assessment by an accredited Certified Third-Party Assessment
Organization (C3PAO).
CMMC Assessment Guide--Level 3
DoD-CIO-00004 (ZRIN 0790-ZA20)
This document provides guidance in the preparation for and
execution of a Level 3 Certification Assessment under the CMMC Program
as set forth in 32 CFR 170.18. Certification at each CMMC level occurs
independently. An Assessment as defined in 32 CFR 170.4 means:
The testing or evaluation of security controls to determine the
extent to which the controls are implemented correctly, operating as
intended, and producing the desired outcome with respect to meeting
the security requirements for an information system, or organization
as defined in 32 CFR 170.15 to 32 CFR 170.18.
A CMMC Level 3 Certification Assessment as defined in 32 CFR 170.4
is the term for the activity performed by the Department of Defense to
evaluate the CMMC Level of an OSC. For CMMC Level 3, assessments are
performed exclusively by the DoD.
An OSC seeking a CMMC Level 3 Certification Assessment must have
first received a CMMC Level 2 Final Certification Assessment, as set
forth in 32 CFR 170.18, for all applicable information systems within
the CMMC Assessment Scope, and the OSC must implement the Level 3
requirements specified in 32 CFR 170.14(c)(4). This is followed by the
CMMC Level 3 assessment conducted by the DoD.
OSCs may also use this guide to perform CMMC Level 3 self-
assessment (for example, in preparation for an annual affirmation);
however, they are not eligible to submit results from a self-assessment
in support of a CMMC Level 3 Certification Assessment. Only the results
from an assessment by the DoD are considered for award of a CMMC
[[Page 89140]]
Level 3 Certification Assessment. Level 3 reporting and affirmation
requirements can be found in 32 CFR 170.18 and 32 CFR 170.22.
CMMC Scoping Guide--Level 1
DoD-CIO-00005 (ZRIN 0790-ZA21)
This document provides scoping guidance for Level 1 of CMMC as set
forth in 32 CFR 170.19. Prior to a Level 1 CMMC Self-Assessment the OSA
must specify the CMMC Assessment Scope. The CMMC Assessment Scope
defines which assets within the OSA's environment will be assessed and
the details of the self-assessment.
This guide is intended for OSAs that will be conducting a CMMC
Level 1 self-assessment and the professionals or companies that will
support them in those efforts.
CMMC Scoping Guide--Level 2
DoD-CIO-00006 (ZRIN 0790-ZA22)
This document provides scoping guidance for Level 2 of CMMC as set
forth in 32 CFR 170.19. Prior to a Level 2 Self-Assessment or Level 2
Certification Assessment, the OSA must specify the CMMC Assessment
Scope. The CMMC Assessment Scope defines which assets within the OSA's
environment will be assessed and the details of the assessment.
This guide is intended for OSAs that will be conducting a CMMC
Level 2 Self-Assessment in accordance with 32 CFR 170.16, OSCs that
will be obtaining a CMMC Level 2 Certification Assessment in accordance
with 32 CFR 170.17, and the professionals or companies that will
support them in those efforts. OSCs are a subset of OSAs as all
organizations will participate in an assessment, but self-assessment
cannot result in certification.
CMMC Scoping Guide--Level 3
DoD-CIO-00007 (ZRIN 0790-ZA23)
This document provides scoping guidance for Level 3 of CMMC as set
forth in 32 CFR 170.19. Prior to conducting a CMMC assessment, the
Level 3 CMMC Assessment Scope must be defined as set forth in 32 CFR
170.19(d). The CMMC Assessment Scope defines which assets within the
OSC's environment will be assessed and the details of the assessment.
When seeking a Level 3 Certification, the OSC must have a CMMC
Level 2 Final Certification Assessment for the same scope as the Level
3 assessment. Any Level 2 Plan of Action and Milestones (POA&M as set
forth in 32 CFR 170.4) items must be closed prior to the initiation of
the CMMC Level 3 assessment. The CMMC Level 3 CMMC Assessment Scope may
be a subset of the Level 2 CMMC Assessment Scope (e.g., a Level 3 data
enclave with greater restrictions and protections within the Level 2
data enclave).
This guide is intended for OSCs that will be obtaining a CMMC Level
3 assessment and the professionals or companies that will support them
in those efforts.
CMMC Hashing Guide
DoD-CIO-00008 (ZRIN 0790-ZA24)
This guide assumes that the reader has a basic understanding of
command line tools and scripting. During the performance of a CMMC
assessment, the assessment team will collect objective evidence using a
combination of three assessment methods:
<bullet> examination of artifacts,
<bullet> affirmations through interviews, and
<bullet> observations of actions.
Because these OSA artifacts may be proprietary, the assessment team
will not take OSA artifacts offsite at the conclusion of the
assessment. For the protection of all stakeholders, the OSA must retain
the artifacts. This guide describes how to provide a cryptographic
reference (or hash) for each artifact used in the assessment as
discussed in 32 CFR 170.17 and 170.18.
Patricia L. Toppings,
OSD Federal Register Liaison Officer, Department of Defense.
[FR Doc. 2023-27281 Filed 12-22-23; 8:45 am]
BILLING CODE 6001-FR-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on December 26, 2023.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.