Current update, October 6, 2026: this archived article describes the earlier rollout. The planned November 2026 Phase II expansion is now suspended; Phase I self-assessments and safeguarding duties continue. Confirm actual contract terms and amendments before acting. See the official CMMC notice and updated planning guide.
Update to 48 CFR CMMC Final Rule
So, What's the Big Deal?
CMMC is the Department of Defense's (DoD) way of making sure its contractors have proper cybersecurity in place. It protects two main types of information:
- Federal Contract Information (FCI)
- Controlled Unclassified Information (CUI)
Once published, 48 CFR CMMC final rule will require contractors to meet certain CMMC levels (1 or 2, depending on the contract) before they can be awarded new work, or even have an existing contract extended.
Key Points:
- The rule is with OMB as of July 23, 2025.
- Publication could come in October 2025, with enforcement soon after, though neither date is guaranteed.
- The original forecast here, that no 60-day delay would follow publication because the rule isn't classified as economically significant, proved wrong (see the correction below).
- Correction: the earlier prediction that all non-COTS contracts would include CMMC by October 1, 2025 was too broad. Applicable requirements depend on the solicitation, contract, current guidance, and amendments. The rule itself was published September 10, 2025 and took effect November 10, 2025, about 60 days later.
- CMMC status must be current and visible in SPRS (Supplier Performance Risk System) at the time of award or renewal. Level 2 means an assessment every three years plus a senior official's affirmation every year. Level 1 means a self-assessment and an affirmation every year.
What Contractors Need to Do:
If you're a contractor or subcontractor supporting the DoD, here's how you can prepare:
- Determine your required CMMC level based on whether you handle FCI (Level 1) or CUI (Level 2).
- Complete a self-assessment or schedule a C3PAO audit, depending on your level.
- Develop and maintain your System Security Plan (SSP).
- Map your practices to NIST SP 800-171 assessment objectives.
- Be ready to prove compliance before your next contract cycle.
Bottom Line
This is not a drill: the 48 CFR CMMC final rule is nearly through the regulatory process, and CMMC will soon move from best practice to contractual requirement.
If you haven't started preparing, now's the time. Waiting could mean delays, missed opportunities, or even lost contracts.
Need help getting CMMC-ready? Our team at inDirect IT can guide you through scoping, documentation, and gap assessments. Reach out anytime.
The rule has moved since this was written. Have you?
This post was first published in July 2025. The 48 CFR rule has since been finalized, and the guidance has changed. Talk to a practitioner for the current state of CMMC enforcement and what it means for your contracts. Or email rj@indirectit.com directly.