Executive Brief
The long-anticipated CMMC 48 Code of Federal Regulations (CFR) rule has cleared regulatory review and has been published into the Federal Register. The official effective date was November 10, 2025. Here's what defense contractors need to know:
The government's phased rollout of Cybersecurity Maturity Model Certification (CMMC) certification contract requirements began on November 10, 2025. The rollout occurs in three phases:
Even before CMMC appears in a contract’s base language, prime contractors can flow down CMMC certification requirements to their subcontractors ahead of the phased rollout schedule.
Noncompliance, intentional or not, can lead to lost contract opportunities or even legal consequences under the False Claims Act.
Dig deeper and continue reading below.
Published by the Department of Defense (DoD) (also known as the Department of War) on September 10, 2025, and effective as of November 10, 2025, the 48 CFR CMMC rule formally incorporates CMMC requirements into the Defense Federal Acquisition Regulation Supplement (DFARS). It’s the second and final rule of the CMMC 2.0 rulemaking process.
Whereas the 32 CFR CMMC rule set forth the CMMC program, requirements, and ecosystem, the 48 CFR CMMC rule establishes enforcement, requiring DoD solicitations to include CMMC certification requirements to all applicable contracts.
Here’s what you need to know now that the rule has cleared regulatory review and been published into the Federal Register:
Bottom line: Scheduling and completing a Level 2 assessment is a growing bottleneck for defense contractors. As of the end of 2025, fewer than 1% of the Defense Industrial Base (DIB) is certified. Wait times for C3PAO assessments are already around 9 months, and delays could stretch to 24-30 months by late 2026
Early certification gives you a competitive edge. Companies that achieve Level 2 certification before November 2026 will enjoy limited competition and a once-in-a-generation opportunity to grow their business pipeline while their competitors wait in line. Schedule your assessment now to secure your advantage before the Level 2 rollout rush begins.
Part of the 48 CFR CMMC rule is to amend DFARS to include a new clause: DFARS 252.204-7025 (Notice of CMMC Level Requirements). This will be the clause in your contract that identifies which maturity level your company will need to accept the award of the contract. The language will read as:
The CMMC level required by this solicitation is: ___________. This CMMC level or higher (see 32 CFR part 170) is required prior to award for each contractor information system that will process, store, or transmit Federal contract information (FCI) or controlled unclassified information (CUI) during performance of the contract.
If you’re unsure how to proceed, here are the next steps to protect your DoD contract eligibility:
ISI Insight: Don't rush to an open spot. It's more important to get it right than to rush and increase your risk of failing.
ISI Insight: The assessment backlog is beginning to grow. CCAs and C3PAOs are expanding, but not quickly enough to meet rising demand. Once you identify your scope and remediation timeline, schedule your assessment ASAP to keep your compliance journey on track!
Depending on the type of data you handle, you may be subject to one of three certification levels:
At ISI, we specialize in helping defense contractors prepare for CMMC Level 2 certification. As one of the first MSPs in the U.S. to earn CMMC Level 2 certification, we understand both the technical requirements of CMMC/NIST SP 800-171 and the day-to-day realities of small DIB IT teams.
What sets us apart from general IT providers:
With ISI, you do more than meet the minimum; we help you compete with confidence.
No, but early adopters are going to enjoy a greater competitive advantage. As of August 2025, fewer than 300 companies had achieved CMMC Level 2 certification. Don't mistake that as a reason to green-light delaying; see it as a motivator to accelerate your compliance journey.
Yes. However, less than 5% of Level 2 contractors will be able to self-assess. Level 2 (Self) heavily depends on what type of CUI you handle. If you have any CUI in the Defense Index Grouping of the CUI Registry, a C3PAO assessment is going to be required. If not, a self-assessment may suffice. But counting on self-assessments to move your business forward is a risky proposition.
The most immediate concern is you will further delay your company's ability to accept award of new defense contracts. Additionally, from a budget perspective, you are going to have to spend more to at least pay for another assessment (roughly $30-45k). On top of that, depending on which controls you failed, you may need to invest in additional tools that weren't budgeted for. Last, you could face some reputational damage, hurting your ability to win contracts even if you do eventually achieve certification.
It involves uploading your self-assessment score based on NIST SP 800-171 implementation along with basic supporting details into DoD's SPRS. While not required to initiate a CMMC assessment, completing this step is a key part of Level 2 readiness and may already be required under current DFARS clauses in your contracts.