DoD Finalizes CMMC Rule: What Contractors Need to Do Now

On 10 September 2025, the Department of Defense published the final DFARS rule to implement the Cybersecurity Maturity Model Certification program. The rule becomes effective 60 days later on 10 November 2025 and begins a three-year phase-in. This newsletter explains what changed, who is affected, and exactly what to do next.

TL;DR — The Few Things That Matter Most

Part 1: What the Final Rule Does

• Adds new DFARS clauses and a solicitation provision to require CMMC status for systems that process, store, or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). DFARS Part 204
• Requires contractors to post self-assessments and affirmations in the Supplier Performance Risk System (SPRS) or to record third-party/government assessments in eMASS, depending on level and assessment type. SPRS · Cyber Reports
• Phases in requirements over three years so DoD can require higher assessment levels over time rather than all at once.

Part 2: Who Is Affected

• Any contractor or subcontractor that will process, store, or transmit FCI or CUI on contractor systems for DoD work. This includes many service providers, IT vendors, and systems integrators.
• Offerors will be ineligible for award if they have not reported the required CMMC status to DoD when the clause is in the solicitation. That makes SPRS/eMASS entries critical.

Part 3: Assessment & Reporting Rules by Level

Part 4: Immediate Actions to Take This Week

1. Identify systems that process FCI or CUI and map them to contracts and proposals. Start with systems used on your top 5 DoD efforts. DoD CMMC resources
2. Confirm your SPRS record and eMASS readiness. Fix missing or incorrect SPRS data — it will block awards. Use SPRS guides. SPRS
3. If you expect Level 2 work, decide now whether you need a C3PAO assessment or a self-assessment route. Schedule assessors early — C3PAO capacity is limited. CMMC assessment process: cyberab.org
4. Update subcontractor flow-downs. Primes must ensure subcontractors have a current CMMC status when their systems handle FCI or CUI. Add verification steps to your subcontractor intake.
5. Prepare affirmations and internal controls to support the required annual affirmations in SPRS. Assign an "affirming official." Federal Register / DFARS rule

Part 5: Things to Remember

• This rule does not add new technical controls beyond what NIST SP 800-171 / SP 800-172 already require. It requires formal assessments, attestations, and DoD reporting.
• If a solicitation includes the DFARS CMMC clause, reporting a current CMMC status is a condition for award. Don't wait until the RFP drops to check SPRS.
• Primes remain responsible for flow-downs and must confirm subcontractor status before awarding subcontracts that involve FCI or CUI. Plan for verification in your intake process.

Quick Checklist You Can Use Now

Helpful Links