Current update, October 6, 2026: this archived article describes the earlier rollout. The planned November 2026 Phase II expansion is now suspended; Phase I self-assessments and safeguarding duties continue. Confirm actual contract terms and amendments before acting. See the official CMMC notice and updated planning guide.
Update to 48 CFR CMMC Final Rule
So, What's the Big Deal?
CMMC is the Department of Defense's (DoD) way of making sure its contractors have proper cybersecurity in place. The program is designed to protect two main types of information:
- Federal Contract Information (FCI)
- Controlled Unclassified Information (CUI)
Once published, 48 CFR CMMC final rule will require contractors to meet certain CMMC levels (1 or 2, depending on the contract) before they can be awarded new work—or even have an existing contract extended.
Key Points:
- The rule is with OMB as of July 23, 2025.
- An October 2025 publication is possible, with enforcement to start soon after, but the dates are not guaranteed.
- No 60-day delay will follow publication because the rule isn't classified as economically significant.
- Correction: the earlier prediction that all non-COTS contracts would include CMMC by October 1, 2025 was too broad. Applicable requirements depend on the solicitation, contract, current guidance, and amendments.
- CMMC certifications must be current (within 3 years) and visible in SPRS (Supplier Performance Risk System) at the time of award or renewal.
What Contractors Need to Do:
If you're a contractor or subcontractor supporting the DoD, here's how you can prepare:
- Determine your required CMMC level based on whether you handle FCI (Level 1) or CUI (Level 2).
- Complete a self-assessment or schedule a C3PAO audit depending on your level.
- Develop and maintain your System Security Plan (SSP).
- Map your practices to NIST SP 800-171 assessment objectives.
- Ensure you're ready to prove compliance before your next contract cycle.
Bottom Line
This is not a drill. The 48 CFR CMMC final rule's journey through the regulatory process is nearly complete. CMMC will soon be a contractual requirement—not just a best practice.
If you haven't started preparing, now's the time. Waiting could mean delays, missed opportunities, or even lost contracts.
Stay informed, stay secure, and stay ahead.
Need help getting CMMC-ready? Our experts at inDirect IT can guide you through scoping, documentation, and gap assessments. Reach out anytime.
The rule has moved since this was written. Have you?
This post is preserved as originally published in July 2025 — the 48 CFR rule has since been finalized and guidance has evolved. Talk to a practitioner for the current state of CMMC enforcement and what it means for your contracts. Or email rj@indirectit.com directly.