Beyond the Scope of the CMMC Final Rule

The 32 CFR CMMC final rule is finally final! It’s also 470 pages long. What gives? Public comment responses. Literally just 230 pages of responses to public comments. While some of the responses are helpful, much of the time DoD was forced to take the time and space to explain why comments weren’t relevant to the CMMC program at all.

(0:00 – 1:56): Intro
(1:57 – 4:19): Why is the rule so long?
(4:20 – 14:27): Everything people commented on that isn’t in the scope of the rule
(14:28 – 17:20): Out of scope comments: summarized
(17:21 – 18:41): Private sector interactions
(18:42 – 20:57): Right comment, wrong rule
(20:58 – 22:43): Additional resources

[shellvera]

Happy birthday. It’s just like you to give back and help others on your special day! Thanks for sharing this information today.

[BlueGuardianSec]

You spend years studying, working and training for a GRC position and finally land a job with DoD only to spend the better part of a year reading irrelevant RFC and being required to respond 😂

[CarRamrod-ufub]

2x playback.... you'll thank me 😁 Thanks for putting this out!

[filterabc]

This further highlights the need for DOGE — Department of Government Efficiency. Go Elon!

[yaobling]

As someone who works with CUI GRC in the international environment, I can understand a lot of the comments regarding foreign entities. There is much ambiguity in that zone.