CMMC & Defense Cybersecurity Brief

Headline

DoD continues administrative maintenance of DFARS technical data and software rights collection amid CMMC 2.0 program rollout

Executive Summary

The Department of Defense published a Federal Register notice on March 27, 2026 extending an information collection requirement under the Defense Federal Acquisition Regulation Supplement covering rights in technical data and computer software (OMB Control Number associated with DFARS 252.227-7013, 252.227-7014, and related clauses). The administrative renewal occurs during the operative phase-in of the CMMC 2.0 program under 32 CFR Part 170 and the implementing DFARS clause 252.204-7021, which together establish the Cybersecurity Maturity Model Certification framework binding on contractors handling Controlled Unclassified Information.

Key Regulatory Signals

• CMMC 2.0 Phase-In Continues: The DoD CMMC 2.0 program codified at 32 CFR Part 170 (effective December 16, 2024) and operationalised through DFARS 252.204-7021 (effective December 30, 2024) is in active phase-in, with progressive contract clause inclusion across DoD acquisitions through 2028; defense contractors must verify their CMMC level requirements and certification or self-assessment status against current contract awards and pipeline.
• Technical Data Rights and CUI Convergence: DFARS 252.227-7013/7014 technical data and software rights clauses interact with CMMC compliance because CUI-marked technical data is subject to both rights restrictions and cybersecurity protection requirements under DFARS 252.204-7012 (NIST SP 800-171 implementation); contracting officers and program managers should align rights assertion documentation with CUI handling and CMMC posture.
• NIST SP 800-171 Rev 3 Migration: NIST released SP 800-171 Revision 3 in May 2024, replacing Rev 2 as the controlling cybersecurity baseline for CMMC Level 2 self-assessment and certification; contractors should evaluate Rev 3 control gap analysis against existing System Security Plans and Plans of Action and Milestones, with DoD's contractual transition timing under active interpretation.
• C3PAO Assessment Capacity: CMMC Level 2 certification requires assessment by a Certified Third-Party Assessment Organization (C3PAO) accredited by The Cyber AB; defense contractors with material new-business pipelines requiring Level 2 certification should engage C3PAO scheduling early given documented capacity constraints in the assessor ecosystem during the phase-in window.
• DFARS Information Collection Maintenance Signal: Concurrent renewal of multiple DFARS information collections — including the technical data and software rights collection — confirms that DoD's administrative DFARS architecture is being actively maintained even as the CMMC 2.0 program imposes the most significant cybersecurity obligation expansion in the DoD supply chain since the original 2017 DFARS 252.204-7012 cyber clause.

Regulatory Delta

The CMMC program traces to a 2019 DoD initiative to replace self-attestation under DFARS 252.204-7012 with a tiered certification framework, originally announced as CMMC 1.0 in January 2020 and substantially restructured into the CMMC 2.0 framework announced in November 2021. The 32 CFR Part 170 final rule (December 16, 2024) and DFARS 252.204-7021 final rule (December 30, 2024) operationalised CMMC 2.0 after a multi-year rulemaking cycle, marking the first time DoD cybersecurity requirements moved from self-attestation to third-party certification for the majority of contractors handling CUI. The current Federal Register administrative renewal of DFARS 252.227-7013/7014 information collections is procedural, but it occurs within the operationally consequential CMMC 2.0 phase-in environment, where DoD acquisitions are progressively incorporating the new cybersecurity certification clauses through 2028. No prior period in DoD cybersecurity policy carries comparable industrial-base disruption potential, given the certification capacity constraints and supply chain depth implications.

Materiality Classification

High — CMMC 2.0 is the operative DoD cybersecurity framework binding on every contractor handling CUI; technical data rights collection renewal is procedural, but the surrounding CMMC and NIST SP 800-171 Rev 3 migration environment creates substantial near-term compliance risk for the entire defense industrial base.

Time Horizon

Short-Term — CMMC 2.0 contract clause inclusion is progressive through 2028 with active DoD program implementation; contractors face individualized timelines based on contract type, level designation, and award schedule.

Intelligence Outlook

Monitor DoD's CMMC Program Management Office, The Cyber AB, and DoD acquisition policy memoranda for additional implementation guidance and any DFARS amendments interpreting the December 30, 2024 final rule. Track NIST SP 800-171 Rev 3 transition timing under DoD contracts and any related DFARS subpart amendments. Watch C3PAO assessment capacity, scope-aggregation interpretations, and potential CMMC level recalibrations as the program matures.