CMMC Readiness

CMMC establishes clear cybersecurity requirements across the defense supply chain for bidding on and performing War Department contracts. CMMC was created by 32 CFR 170 and mandated by 48 CFR 204 and DFARS 252.204-7021. By enforcing these standards, CMMC helps DOW safeguard national security interests and reduces the risk of cyber threats across the defense industrial base.

The mandate for initial CMMC enforcement is November 10, 2025. As of that date, the War Department begins to require CMMC compliance for new contracts involving Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).

Key dates include:

November 10, 2025:

Contractors must submit self-assessments for Level 1 (FCI) and some Level 2 (CUI) contracts.

Select contracts will require third-party Level 2 certification.

November 10, 2026:

Third-party certification (C3PAO) becomes mandatory for most Level 2 contracts.

November 10, 2027:

Level 3 assessments become mandatory for highly sensitive programs.

November 10, 2028:

Full implementation across the Defense Industrial Base, with all contracts involving FCI or CUI meeting the appropriate CMMC level.

To determine the appropriate CMMC level to certify against, a defense contractor must assess the type and sensitivity of the information they handle under their contracts.

If your contract involves FCI only, you’ll need CMMC Level 1. If a contract involves CUI, you’ll need CMMC Level 2 or 3, depending on the sensitivity.

Contractors should also assess their contracts and bidding documents for specific cybersecurity obligations.