UPDATE: The Safer Federal Workforce Task Force issued updated Guidance on November 10 confirming that the date a covered employee must be fully vaccinated is January 18, 2022.
With the addition of new answers to frequently asked questions (FAQs) on November 1, and the November 4 “Fact Sheet” issued by the White House accompanying the rollout of the Department of Labor’s Occupational Safety and Health Administration (OSHA) and Centers for Medicare & Medicaid Services (CMS) vaccination requirements for, respectively, employers with 100 or more employees and health care workers and facilities participating in Medicare and Medicaid, federal contractors have been given additional breathing room to address recalcitrant covered employees who are resisting the vaccination mandate.

In conducting its review of CMMC 1.0, the DoD focused largely on clarifying the standard and reducing the cost impact on the Defense Industrial Base (DIB). The result? A “been there, already had to do that” standard that should leave the DIB relatively pleased and the burgeoning CMMC accreditation industry mildly perplexed. In place of the five-tiered, third-party-assessed cybersecurity framework addressing data confidentiality, integrity, and availability, the new CMMC 2.0 presents as a three-tiered, largely self-assessed bolstering of the NIST SP 800-171 safeguarding requirements already required to be implemented by contractors in possession of “Covered Defense Information” (CDI) under DFARS 252.204-7012.