INFOSEC ALERT - NOTICE TO THE DEFENSE INDUSTRIAL BASE (DIB), Cybersecurity Maturity Model Certification (CMMC) Program Implementation

The Department of Defense (DoD) has published a notice to inform the Defense Industrial Base (DIB) about the implementation of the Cybersecurity Maturity Model Certification (CMMC) program. The program aims to enhance cybersecurity for the DIB by incorporating CMMC requirements into the Defense Federal Acquisition Regulation Supplement (DFARS). The notice provides information on the CMMC program, its phases, and the requirements for organizations handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). The notice also provides recommendations for contractors, including ensuring their cybersecurity posture aligns with contractual requirements and following steps to use Procurement Integrated Enterprise Environment (PIEE) applications. Key points to consider: • The CMMC program will be implemented in four phases, starting on November 10, 2025. • Organizations handling FCI or CUI must maintain specific cybersecurity maturity levels to protect sensitive data. • Contractors should ensure their cybersecurity posture aligns with contractual requirements related to NIST SP 800-171 controls. • Contractors should follow steps to use PIEE applications and post a current self-assessment score in the Supplier Performance Risk System (SPRS) module. • Contractors should monitor updates from DoD, DPCAP, and SAM.gov for USACE Special Notices, official timelines, and certification requirement updates.