New cybersecurity rules land for Defense Department contractors

The U.S. Department of Defense has finalized its CMMC rule, effective November 9, requiring defense contractors to meet one of three cybersecurity compliance levels based on the sensitivity of unclassified data they handle. Level 1 involves annual self-assessment, most Level 2 cases require third-party audits, and Level 3 mandates government-led assessments. The rule also directs contracting officers to specify required CMMC levels in solicitations and only award to vendors with current assessments, reflecting a shift of compliance responsibility onto contractors.