CMMC compliance of existing contracts

[MarkPelea]

Hello All,

How do you address CMMC compliance for existing CUI-based contracts which are not based on CMMC (could be based on ITAR/NIST SP 800-171, for instance)? The contract terms were already agreed between federal and contractors, but are still under the current "self-attestation". Or must the current contracts and environments built around the CUI protection for those systems continue with their existing terms, and are not subject to CMMC? Would they just need to complete their contract life in their original compliance terms? Meaning, CMMC only applies to new contracts with the DoD.

Thanks,

Mark 

[#2]

@MarkPelea DoD has said current contracts will not be modified except in extenuating circumstances. What will most likely happen is if the contract goes to recompete, a CMMC level will be applied to the new RFP.

[#3]

Thanks, @DKernus02

[#4]

@DKernus02, Do we have any idea what those extenuating circumstances might be? I'm sure it's contract by contract basis, but would be good to know if there are some guidelines that can be followed for those that have a variety of CUI/CDI contracts.

[#5]

@MarkPelea The DoD did not give any indication as to what those might be in the seminar I heard this information. The only other piece of information that may be helpful is, at the time the comment was made, they said it would be depend on the contracting officer and/or the program manager.

Just a reminder that changes are happening to CMMC guidelines almost weekly (at least it seems). I think it's best to follow the implementation of CMMC until it's finalized. Katie Arrington, CISO of DoD Acq said last night on CyberNation: CMMC they are in actively process of getting the DFAR rule changed. It's going into public comment soon for 60 days. After that, DoD expects it to be finalized.