Introduction
The CMMC Final Rule doesn't flip a switch that makes every defense contract suddenly require the same cybersecurity status on the same day. Instead, it builds a framework that contracting officers can write into applicable DoD solicitations and contracts, one procurement at a time.
That distinction matters because many contractors are asking the wrong question. They want to know "when does CMMC start," when the real question is: which of my contracts will carry a CMMC clause, and by when do I need to prove compliance?
This article breaks down the two rules behind CMMC, clarifies the current rollout status, identifies which level applies to your work, and lays out a practical readiness plan covering scope, controls, evidence, and people.
Key Takeaways
- The Program Rule sets CMMC's structure; the DFARS Clause Rule makes it enforceable in contracts
- The DFARS clause rule became effective November 10, 2025, but individual contract requirements still phase in separately
- Your required CMMC level depends on whether you handle FCI, CUI, or neither — not company size
- CMMC requires ongoing affirmations, current SPRS records, and ready evidence, not a one-time certificate
- Phase 2 (mandatory third-party assessments) was suspended as of July 2026, pending further guidance
What the CMMC Final Rule Changed
Think of the CMMC Final Rule as a connector, not a brand-new technical standard. It links existing cybersecurity requirements to the DoD procurement process, so a contracting officer can actually verify whether a contractor meets them before awarding work.
There are two separate rules doing different jobs:
| Rule | What it covers | Publication / effective date |
|---|---|---|
| Program Rule (32 CFR Part 170) | Levels, assessment mechanics, scoring, conditional vs. final status, affirmations | Published October 15, 2024; effective December 16, 2024 |
| DFARS Clause Rule (2019-D041) | Lets CMMC requirements appear in solicitations, awards, and option periods | Published September 10, 2025; effective November 10, 2025 |
The Program Rule defines how assessments work. The DFARS rule defines when and how those requirements show up in your actual contracts, according to the Federal Register's DFARS notice.
New Clauses to Know
Three DFARS clauses do the heavy lifting:
- 252.204-7025: Appears in solicitations, naming the required CMMC level and identifiers
- 252.204-7021: Appears in awards, requiring contractors to maintain status, submit affirmations, and flow requirements down to subcontractors
- 252.204-7012: The pre-existing safeguarding and incident-reporting clause, which stays in force regardless of CMMC timing
What's Actually Different for Contractors
Previously, most contractors relied on self-assessment and supplier-reported compliance under FAR and DFARS cybersecurity clauses. The new model adds:
- A CMMC status tied directly to a specific contract, not a general policy statement
- Self-assessment, third-party (C3PAO), or government-led verification, depending on the level required
- Recurring affirmations of continuing compliance, not a single sign-off
- Accurate SPRS records and CMMC unique identifiers tied to each assessment
One caution worth repeating: a rule being "effective" doesn't mean every applicable contract has the clause yet. Contracting officers add CMMC language through new solicitations, contract modifications, or option periods, not retroactively and not all at once.
When the Rule Takes Effect and How the Rollout Works
Here's where contractors get tripped up. "Effective date" and "I need to be compliant now" are not the same thing. Five different dates matter, and they rarely line up:
- Rule effective date: when the regulation itself becomes law (November 10, 2025, for the DFARS clause)
- Solicitation issuance date: when a specific RFP includes a CMMC requirement
- Contract award date: when CMMC becomes a binding term of your agreement
- Modification or renewal date: when an existing contract adds CMMC through an option or admin mod
- Required status date: the actual deadline you must meet to remain eligible
The Phased Rollout, and a Recent Twist
The original plan called for CMMC requirements to expand over four phases, roughly one year apart, starting November 10, 2025, and reaching full implementation by November 2028.
But that timeline shifted. In July 2026, DoD suspended Phase 2, the phase that would have added mandatory Level 2 C3PAO and Level 3 government-led assessments to new solicitations, according to the DoD CIO's suspension memo.
During the pause, requiring activities may only designate Level 1 Self or Level 2 Self in new contract language. Existing contracts with C3PAO or DIBCAC requirements are being amended to remove them.
What this doesn't mean: safeguarding obligations under 252.204-7012 remain active, and Level 1/2 self-assessment requirements continue. The pause affects third-party verification, not the underlying obligation to protect information.
A Phased Rollout Isn't a Reason to Wait
Contracting officers can add CMMC requirements to relevant solicitations before the rule applies universally. Prime contractors are also setting their own supply-chain expectations ahead of mandatory deadlines, because their own compliance depends on subcontractor readiness.
Review process for every active and pending contract:
- Check solicitations, awards, and option periods for CMMC clauses
- Identify the specific level and assessment type named
- Confirm which systems and data flows the requirement covers
- Log affirmation, submission, and renewal obligations with owners and dates
- Send ambiguous clause language to contracting or legal counsel before guessing
Verify before you act: Rollout status, suspension updates, and assessment requirements change. Check DoD, DFARS, Cyber AB, and SPRS directly, and watch for prime-contractor communications, rather than relying on older articles.
Which Contractors and CMMC Levels Are in Scope
CMMC applicability isn't about company size or industry reputation. It comes down to one question: what type of government information do you handle, and on which systems?
| Level | Information protected | Requirements | Assessment type |
|---|---|---|---|
| Level 1 | FCI | 15 practices from FAR 52.204-21 | Annual self-assessment |
| Level 2 | CUI | 110 practices from NIST SP 800-171 Rev. 2 | Self-assessment or C3PAO, every 3 years |
| Level 3 | High-value CUI | Selected NIST SP 800-172 practices, building on Level 2 | Government-led (DIBCAC) |
Federal Contract Information generally points toward Level 1. Controlled Unclassified Information generally points toward Level 2. Level 3 applies only to designated contracts involving especially sensitive CUI — it's not a default tier for "important" work.
Who Actually Falls In Scope
Scope reaches further than primes. It also includes:
- Subcontractors handling FCI or CUI on their own systems
- Small manufacturers and service providers supporting a defense program
- External service providers (cloud hosts, MSPs) that touch covered information
- Anyone receiving flowed-down CMMC requirements through a subcontract
A narrow exception exists for contracts limited to commercial-off-the-shelf items, but that exception is specific and shouldn't be assumed without checking current contract language.
Flowdown Follows the Information, Not the Headline Level
A prime with a Level 3 contract doesn't automatically force every subcontractor to Level 3. The rule ties the minimum subcontractor requirement to what information that subcontractor actually touches:
| Subcontractor handles | Minimum required status |
|---|---|
| FCI only | Level 1 Self |
| CUI, no elevated requirement specified | Level 2 Self |
| CUI, prime requires C3PAO | Level 2 C3PAO |
You can't pick your preferred level because it's cheaper or more convenient. The contract, the information type, and the flowdown language decide it for you.
What Contractors Must Do to Prepare
Readiness starts with paperwork, not purchasing. Here's the sequence that actually works.
1. Triage Contracts and Information Flows
- List every active, pending, and target DoD contract
- Identify which ones involve FCI, which involve CUI, and which involve neither
- Review prime and subcontract clause language directly
- Assign one accountable owner per contract's CMMC requirement
2. Define Scope Before Touching Controls
Document every system, application, endpoint, facility, user, administrator, and external service provider that touches FCI or CUI.
Skipping this step is the single biggest reason gap assessments go sideways later. You end up fixing controls on systems that were never in scope, while missing ones that were.
3. Run a Documented Gap Assessment
Compare current practice against the required level's full set of objectives. Prioritize weaknesses in:
- Access control and identification/authentication
- Configuration management
- Incident response
- System and communications protection
- Media protection and security assessment
4. Build a Real Remediation Plan
Every identified gap needs an owner, a target date, required evidence, and a note on residual risk. A POA&M can bridge limited gaps toward Level 2 conditional status, but only for eligible requirements, and it's a 180-day bridge, not a substitute for actual readiness.
5. Stand Up an Evidence System
Auditors don't take your word for it. Maintain:
- An accurate, current System Security Plan
- Policies and procedures mapped to each required practice
- Access reviews, training records, logs, and incident records
- Vulnerability remediation and configuration change history
Evidence needs to be time-stamped and consistent with what your team actually does, not a polished document that doesn't match reality on the floor.
6. Mobilize People, Not Just IT
Compliance fails most often as a people problem, not a technology one. That means training everyone who touches FCI or CUI — not just the security team — and testing whether incident reporting actually works before an assessor asks about it.
This is where a structured training approach earns its keep. QMS Learning's CMMC & NIST 800-171 training course, part of its Defense Cybersecurity Readiness pathway, covers all 14 NIST SP 800-171 control families, gap assessment methodology, SSP development, and POA&M management for C3PAO preparation.
Teams finish with named owners for each control family and a working SSP built in their own environment, not a generic template. Training builds that internal capability. It does not replace the C3PAO or government assessment itself.
How to Maintain CMMC Readiness After Preparation
Getting ready for an assessment and staying ready are two different disciplines. CMMC status isn't a certificate you file away.
The ongoing cycle looks like this:
- Monitor controls and vulnerabilities continuously
- Review privileged access and system changes regularly
- Test incident response before you need it for real
- Keep the System Security Plan updated, not static
- Capture evidence as work happens, not retroactively
Recurring Reporting Obligations
Final Level 2 and Level 3 status is valid for three years, but annual affirmation is still required, and that affirmation can't be more than a year old. Keep SPRS records and CMMC unique identifiers current, and report any UID changes to your contracting officer promptly.
Subcontractor Governance
- Flow down only what the information and contract relationship actually require
- Verify subcontractor status before work begins, not after
- Track changes to subcontractor systems and scope over time
- Keep records of due diligence and related communications
Changes That Trigger Reassessment
New cloud providers, facility changes, acquisitions, new CUI types, major network changes, and security incidents all warrant a fresh look at your controls. A quarterly internal review (checking whether documented controls still match actual practice) catches stale evidence before an assessor does.
Frequently Asked Questions
What is the CMMC Final Rule?
It's the combination of the Program Rule, which defines assessment levels and mechanics, and the DFARS Clause Rule, which lets contracting officers put CMMC requirements into actual solicitations and contracts.
When did the CMMC Final Rule take effect?
The DFARS clause rule took effect November 10, 2025. That's different from when a specific contract will carry a CMMC clause: check current implementation status before assuming a timeline.
Does CMMC apply to DoD subcontractors?
Yes, when subcontractors handle FCI or CUI on their own systems. The required level flows down through the prime contract or subcontract agreement based on the information involved.
What changed from the previous CMMC requirements?
Compliance is now tied to specific contracts, with possible third-party or government verification instead of pure self-attestation. Contractors also face recurring affirmations and formal flowdown obligations.
What CMMC level does a contractor need?
It depends on the information you handle (FCI or CUI), the contract language, and the assessment path the DoD specifies, not your company's size or industry reputation.
What should contractors do first to prepare for CMMC?
Start by reviewing your contracts, identifying where FCI or CUI touches your systems, and running a documented gap assessment. Assign leadership ownership before scheduling any formal assessment.