View Rule

DoD is issuing a final rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) to implement the contractual requirements associated with the CMMC 2.0 Framework in order to protect against the theft of intellectual property and sensitive information from the Defense Industrial Base (DIB) sector. The CMMC 2.0 Framework, as defined in 32 CFR part 170, assesses compliance with applicable information security requirements. This rule provides DoD with assurances that a DIB contractor can adequately protect sensitive unclassified information at a level commensurate with the risk, accounting for information flow down to its subcontractors in a multi-tier supply chain. The annualized costs associated with this rule are estimated at approximately $16 million for the public.