CMMC v2.13 (the CMMC final rule) is now available!
April 23, 2025:
We have now released the final version of the CMMC framework. The new version is v2.13 and we have published the framework, assessment, and task pack (level 1 and level 2).
The final rule was published on October 14, 2024 and went into effect on December 16, 2024. While the rule went into effect on December 16, 2024, that does not mean that all companies must be immediately compliant with the CMMC rule. The requirements will be rolled out to contractors over the next several years and will become a requirement for individual companies when it is written into their DOD contracts. This roll out phase started in Q1 2025 and will last through some time in 2028 with the requirement being written into each companies contract.
The final rule included minor changes in things such as control numbering for both level 1 and level 2. Level 1 included some combining of controls to slightly shrink the number of required controls. The requirements of each level has remained consistent.
Some other changes include items that will affect how companies approach their assessments to ensure to include all required data, how its stored, and who has a stake in the CUI and associated data. These are requirements that have been updated, but do not affect the actual structure of the framework.
Please refer to the following links for more information on changes to the structure of how to conduct assessments and requirements outside of the actual framework:
https://www.defense.gov/News/Releases/Release/Article/3932947/cybersecurity-maturity-model-certification-program-final-rule-published/
https://cyberab.org/Portals/0/Notice%20to%20CMMC%20Ecosystem%2016DEC2024.pdf
Categories
- All Categories
- 19 Product
- Audits
- Assessments
- 1 Frameworks
- Reporting
- Risk Manager
- Vendor Manager
- 84 Apptega Community
- 29 General Community
- 5 Welcome to the Community