ACEC Comments on CMMC Interim Final Rule

ACEC News / Advocacy

December 2, 2020

ACEC Comments on CMMC Interim Final Rule

With the interim final rule for the Cybersecurity Maturity Model Certification taking effect, ACEC has submitted comments noting the industry’s concerns over the lack of clarity and definition related to Architecture-Engineering-Construction (AEC) documents.

Specifically, the A/E industry is concerned that the new requirements lack a standard definition of Controlled Unclassified Information (CUI), and that low-risk infrastructure projects, such as barracks or schools, could require a Level 3 CMMC certification, a significant investment for firms and the taxpayer.  

Before CUI was designated for all AEC documents, most AEC documents had no designation at all. Some documents were “For Official Use Only,” which will no longer be used. ACEC believes that the design and construction of most facilities, such as barracks, dining facilities, and offices, should not require a CUI designation. The Council supports a strategy to maximize participation by the defense industrial base and save time and money for the government by avoiding the use of CUI whenever possible.

In our comments, ACEC requests that the Department of Defense and the services uniformly and clearly define what constitutes CUI as it applies to AEC industry information in support of DoD contracts. Establishing a clear definition and standards for CUI will help maximize participation by the industrial base and save time and money for the government, industry, and taxpayers. 

The Council believes a DoD review of AEC documentation would find that a good portion n does not constitute CUI, in which case, the application of CMMC standards to all AEC documentation would result in excessive work and diversion of energy. 

Therefore, to the extent practicable, ACEC is requesting that DoD articulate what types of facilities and infrastructure will require Levels 1, 2, and/or 3 CMMC certification, so that industry may appropriately allocate resources to prepare for this requirement.

Click here to read ACEC’s comments. ACEC also joined with others in the defense contracting industry to submit additional comments.

 

All comments to blog posts will be moderated by ACEC staff.