After years of anticipation, the Department of Defense (DoD) officially begins enforcing the Cybersecurity Maturity Model Certification (CMMC) requirements as a mandatory condition in new defense contracts starting November 10, 2025. This long-awaited enforcement marks a pivotal shift for defense contractors: CMMC compliance is no longer optional but a contract eligibility prerequisite.

What Changes Starting November 10, 2025

Effective with the end of the required 60-day implementation after the September 10 Federal Acquisition Regulation (48 CFR) rule publication, DoD contracting officers gain the authority to include CMMC clauses in all new contract solicitations. Specifically:

  • DFARS clause 252.204-7021 becomes mandatory for contracts handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).

  • Contractors are now required to publish their CMMC compliance status and associated Unique Identifiers (UIDs) in the Supplier Performance Risk System (SPRS).

  • Annual compliance affirmations must be submitted by designated “affirming officials,” ensuring ongoing adherence.

Phase 1 Requirements: November 2025 to November 2026

During this initial enforcement phase:

  • Level 1 self-assessments become mandatory for protecting FCI.

  • Level 2 self-assessments, aligning with 110 NIST SP 800-171 controls, must be completed for CUI protection.

  • The DoD retains discretion to require Level 2 certified third-party assessments (via C3PAOs) for contracts deemed critical.

  • Roughly 65% of the Defense Industrial Base will face immediate impact from these requirements.

Looking Ahead: Implementation Timeline

The CMMC enforcement roadmap envisions progressive certification mandates:

  • Phase 2 (November 2026): Level 2 certification through accredited C3PAO assessments becomes mandatory for applicable contracts.

  • Phase 3 (November 2027): Initiation of Level 3 assessments to protect higher-impact data.

  • Phase 4 (November 2028): Full CMMC implementation across all Department of Defense contracts.

Business Impact and Challenges

The new rule has immediate and significant business repercussions:

  • Companies lacking a current and valid CMMC status will be ineligible to bid on DoD contracts involving FCI or CUI.

  • Assessment backlogs are emerging, with wait times stretching from three to six months amid a surge in compliance efforts.

  • Achieving Level 2 certification often demands 12 to 18 months of preparation due to the complexity of required controls.

  • The DoD estimates over 80,000 companies require Level 2 certification, with more than 1,500 needing Level 3 certification in the coming years.

Critical Takeaway

The era of delay and extensions has ended. CMMC compliance is now a contractual requirement integral to DoD contract eligibility. Defense contractors and subcontractors must prioritize their cybersecurity maturity to continue competing for federal defense work.

Helpful Resources