​​​​On December 16, 2024, the U.S. Department of Defense (DoD) finalized the Cybersecurity Maturity Model Certification (CMMC) rule, which requires that all DoD contractors must implement CMMC to safeguard Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).

Cooperatives with DoD contracts, such as utility privatization (UP) contracts, must implement CMMC, which aligns with the National Institute of Standards and Technology's (NIST) Special Publication (SP) 800-171 “Protecting Controlled Unclassified Information on Nonfederal Systems and Organizations."

This advisory provides further details on CMMC and how NRECA's Co-op Cyber Goals provide an on-ramp for cooperatives serving military organizations and required to implement CMMC.

• Advisory