8 January 2025

CMMC 2.0 and the possibility of a cyber service: 2025 preview

Carley Welch 

Staff Sgt. Wendell Myler, a cyber warfare operations journeyman assigned to the 175th Cyberspace Operations Group of the Maryland Air National Guard monitors live cyber attacks on the operations floor of the 27th Cyberspace Squadron. (U.S. Air Force photo by J.M. Eddins Jr.)

WASHINGTON — Over the past year, the Department of Defense has set the stage for how it wants to strengthen cybersecurity and information technology infrastructure against adversarial threats, namely the People’s Republic of China.

But with another Donald Trump presidency on the horizon, all eyes are on him to see if he keeps the existing programs afloat or scales them back. Simultaneously, some cybersecurity experts and lawmakers have predicted that the president-elect will stand up a new cyber service.

These are some of the programs and shifts to look out for in the next year.

[This article is one of many in a series in which Breaking Defense reporters look back on the most significant (and entertaining) news stories of 2024 and look forward to what 2025 may hold.]

This year the Pentagon released its final rule for the long-awaited Cybersecurity Maturity Model Certification (CMMC) 2.0, which sets new standards for contractors who handle controlled unclassified information (CUI). The 32 Code of Federal Regulations (CFR) final rule, which lays the framework for CMMC 2.0, went into effect on Dec. 16, but the DoD won’t actually begin implementing the CMMC 2.0 requirement for contractors until the 48 CFR final rule is released — likely in the spring of 2025.

No comments: