The submission solidifies the fact that DOD has come to a consensus on a final rule and that CMMC is coming in the not-so-distant future.

The DOD is working with civilian agencies on a new FAR rule that would apply new requirements for vendors that handle controlled unclassified information.

In a new report, GAO found that the DOD only met 78% of the 110 CMMC 2.0 requirements for systems that manage controlled unclassified information.