The Department of Defense (DoD) isn’t waiting, and neither are the defense contractors leading the way in readiness. In 2025, the Cybersecurity Maturity Model Certification (CMMC) moves from planning to enforcement.
Want to see what forward-leaning contractors are doing to prepare? Dig deeper below.
The final CMMC 2.0 regulation (32 CFR Part 170) became effective in December 2024. The 48 CFR rule, currently under OMB review, will initiate contract-level enforcement by adding certification requirements as a condition of accepting award of new contracts. Most contractors handling CUI will require CMMC Level 2, which includes implementation of all 110 NIST SP 800-171 controls.
Contractors identify the type of data they handle and confirm which maturity level will be required. For many, Level 2 will be the baseline.
Organizations are evaluating how their current security controls align with NIST SP 800-171. This assessment informs tool selection, project planning, and budget allocation.
Plans of Action and Milestones and System Security Plans are being developed or updated. Many teams are scheduling remediation over a 6 to 18-month timeline to align with contract demands.
AI tools are helping teams reduce manual work and accelerate time-to-readiness:
These tools enhance workflows and reduce overhead, particularly when used in tandem with structured compliance programs.
Organizations are documenting CUI data flows and segmenting networks to minimize the in-scope environment. This approach helps reduce audit complexity and cost.
Contractors are engaging CMMC Third-Party Assessment Organizations (C3PAOs) to confirm readiness. Teams are also aligning documentation and evidence with expected audit checkpoints.
Prime contractors increasingly require subcontractors to demonstrate CMMC readiness. Suppliers are responding by working with Registered Provider Organizations, tracking Cybersecurity Accreditation Body updates, and proactively communicating their status.
AI is reshaping how defense contractors approach cybersecurity. However, it must be guided by clearly defined objectives and human oversight to ensure sustainable compliance.
Ready to accelerate your CMMC Level 2 readiness?
If you handle CUI, you will almost certainly need a third-party assessment conducted by a C3PAO. The Level 2 (C3PAO) certification requirement will apply to roughly 95% of contractors seeking this maturity level.
Use platforms hosted in environments that meet the Federal Risk and Authorization Management Program (FedRAMP) Moderate Authorized or equivalent standard. Make sure they provide clear data handling policies, access controls, and explainable outputs.
Many contractors benefit from using both. AI tools accelerate evidence collection and task tracking. GRC platforms help centralize documentation and demonstrate compliance. The right solution depends on your current environment and maturity level.