IMHO – Lots gone in the last week in the wonderful world of “Safeguarding CUI/FCI in Defense Supply Chain”. There appears to be an attempt to create a stop gap arrangement to let the DOD programs continue without disruption until CMMC CoE and AB are fully functional and DIB’s self-attestation (DFARS clause 252.204-7012) moves to proper Accreditation.

Per DoD, in the interim, a rule change to DFARS will facilitate the bridge to planned CMMC mandates relating to contracts. This rule has finished interagency review, and is expected to come out by the end of the calendar year. See https://www.govconwire.com/2020/09/rule-change-to-add-cmmc-requirements-to-contracts-completes-interagency-review/

The Office of Information and Regulatory Affairs (“OIRA”) unit of the Office of Management and Budget (“OMB”) approved last week, a new solicitation provision for DoD contracts which will require offerors to provide a self-assessment (DFARS clause 252.204-7012) and possibly documentary support of the offeror’s compliance in implementing the NIST SP 800-171 controls for CUI. See https://www.reginfo.gov/public/do/PRAViewICR?ref_nbr=202009-0750-001#