DOD estimated that the rulemaking process for CMMC 2.0 can take “9-24 months,” and the CMMC 2.0 will not be a contract requirement until after that is complete.

DoD does not intend to approve inclusion of a Cybersecurity Maturity Model Certification (CMMC) requirement in any contract prior to completion of the CMMC 2.0 rulemaking process, which can take 9 to ...