Forum Discussion

MarkPelea's avatar
MarkPelea
Copper Contributor
Aug 25, 2020

CMMC compliance of existing contracts

Hello All, How do you address CMMC compliance for existing CUI-based contracts which are not based on CMMC (could be based on ITAR/NIST SP 800-171, for instance)? The contract terms were already agr...
DKernus02's avatar
DKernus02
Brass Contributor
Aug 25, 2020

MarkPelea DoD has said current contracts will not be modified except in extenuating circumstances. What will most likely happen is if the contract goes to recompete, a CMMC level will be applied to the new RFP.

  • MarkPelea's avatar
    MarkPelea
    Copper Contributor
    Aug 25, 2020

    DKernus02, Do we have any idea what those extenuating circumstances might be? I'm sure it's contract by contract basis, but would be good to know if there are some guidelines that can be followed for those that have a variety of CUI/CDI contracts.

    • DKernus02's avatar
      DKernus02
      Brass Contributor
      Aug 25, 2020

      MarkPelea The DoD did not give any indication as to what those might be in the seminar I heard this information. The only other piece of information that may be helpful is, at the time the comment was made, they said it would be depend on the contracting officer and/or the program manager.

       

      Just a reminder that changes are happening to CMMC guidelines almost weekly (at least it seems). I think it's best to follow the implementation of CMMC until it's finalized. Katie Arrington, CISO of DoD Acq said last night on CyberNation: CMMC they are in actively process of getting the DFAR rule changed. It's going into public comment soon for 60 days. After that, DoD expects it to be finalized.

Resources