DOD Sends DFARS Cybersecurity Assessment Final Rule to OMB

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a final rule from the DOD’s Defense Acquisition Resource Center (DARC) on “Defense Acquisition Resource Center”. DOD published an interim final rule on rulemaking on September 29^th, 2020. The notice of proposed rulemaking for the final rule was published on August 15^th, 2024.

According to the Fall 2024 Unified Agenda entry for this rulemaking:

“DoD is issuing a final rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) to implement the contractual requirements associated with the CMMC 2.0 Framework in order to protect against the theft of intellectual property and sensitive information from the Defense Industrial Base (DIB) sector. The CMMC 2.0 Framework, as defined in Title 32 of the Code of Federal Regulations (CFR), assesses compliance with applicable information security requirements. This rule provides DoD with assurances that a DIB contractor can adequately protect sensitive unclassified information at a level commensurate with the risk, accounting for information flow down to its subcontractors in a multi-tier supply chain.”

I will probably not be covering this final rule in any detail, but I will at least announce its publication in the appropriate ‘Short Takes’ post.