The Timing of CMMC Level Requirements During The Three-Year Phase-In

      As we discussed in a recent GovCon Bulletin,™ on September 10, 2025, the Department of Defense (DoD) published its Final Rule under the Defense Federal Acquisition Supplement (DFARS) that implements Cybersecurity Maturity Model Certification (CMMC) requirements into DoD solicitations, contracts, and contract options.  The Final DFARS CMMC rule lays out a three-year period in which CMMC Level requirements would be phased in at DoD's discretion in procurements (other than those for commercially-available off-the-shelf (COTS) items) in which government contractors are expected to handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).   After the three-year phase-in period, CMMC Level requirements would become mandatory in all such DoD contracts.

     As for which CMMC Levels would be required when, earlier this year, in January 2025, DoD issued a memo stating that CMMC Level 1 requirements would be implemented once DoD's Final CMMC Rule was published (i.e., during Phase 1), with CMMC Level 2 certification requirements phasing in 12 months later (i.e., during Phase 2).  However, in a follow-up implementation memo released in August 2025, DoD clarified the timeline for implementation of CMMC Level requirements, indicating that CMMC Level 2 self-assessment requirements could also start showing up in Phase 1 solicitations, contracts and option extensions.

     We have posted a chart on the Amadeo Law Firm's GovCon CMMC Hub webpage that can be downloaded as a pdf file and that sets out the timing of CMMC Level requirements based on the effective date of the Final DFARS CMMC Rule.   And we will continue to cover DoD's implementation of CMMC in our articles, video blogs and webinars.