The Dept. of Defense has released an advanced notice of proposed rulemaking which announces it intends to scuttle the majority of the current CMMC plan, in favor of what it calls “CMMC 2.0.” The plan immediately suspends all current CMMC pilot projects, will abandon the tiered maturity model approach, and allow for self-attestation for what was previously known as maturity level 1.

The new rule will scuttle entirely the prior “Interim Rule,” touted largely by the DoD, Katie Arrington, the CMMC-AB and the overnight cottage industry of CMMC consultants, and eventually result in a new DFARS rule to make CMMC 2.0 official.

The new approach also allows for “waivers,” and would break the current CMMC level 3 requirements into separate sets of requirements.

There is no mention of the CMMC Accreditation Body at all. Oxebridge reported yesterday that the DoD intends to allow the CMMC-AB’s contract to lapse, as it shifts management of the program to the DoD’s Office of the Chief Information Officer.

The changes now raise questions as to whether the credentials sold by the CMMC-AB to date have any value under the new scheme. Any training and credentialing done against CMMC 1.0 would now be obsolete.

The full DoD announcement can be read here (PDF).

This story is breaking.


UPDATE: Katie Arrington has admitted failure upon the news of CMMC 2.0, in a post on LinkedIn:

 

Advertisements

ISO 17000 Series Consulting

Why we report on these topics

Since 2000, Oxebridge has worked to improve ISO and related certification schemes by identifying problems and then proposing solutions. We report on issues affecting standards users because so few other news outlets do. Our belief is that in order to fix the problems in these schemes, we must first understand the nature and breadth of those problems. Our reporting aims to do just that. Elsewhere on the Oxebridge site you will find White Papers and other articles proposing ideas to correct these problems.

Leave a reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Services

Available Tools

Oxebridge SWAG