Status as of the review date below — CMMC rules are final and phasing into DoD contracts. This page is updated as the rollout proceeds; confirm specifics against your solicitations.
Where the Rules Stand
- Program rule — 32 CFR Part 170. Effective December 16, 2024. This established the CMMC Program: the levels, assessment types, and the certification ecosystem (C3PAOs, the Accreditation Body).
- Acquisition rule — 48 CFR (DFARS). The clause that puts CMMC into contracts, DFARS 252.204-7021, and the related provision DFARS 252.204-7025, became effective November 10, 2025. This is what makes a CMMC level a condition of award.
The Phased Rollout
DoD is phasing CMMC into solicitations over roughly three years rather than all at once. In broad terms: early phases introduce self-assessment (Level 1 and some Level 2) requirements; later phases bring third-party (C3PAO) Level 2 certification and Level 3 requirements; and by the end of the phase-in, CMMC requirements are expected in applicable solicitations and exercised options. Level 2 certification expectations generally begin appearing in new and renewing contracts around November 2026. Exact phase timing and applicability are set by DoD and by each solicitation.
The Levels, Briefly
- Level 1 — basic safeguarding of FCI (FAR 52.204-21 controls); annual self-assessment.
- Level 2 — protection of CUI (NIST SP 800-171, 110 controls); self-assessment or C3PAO assessment depending on the requirement.
- Level 3 — enhanced protection (adds NIST SP 800-172 elements); government-led assessment.
What Contractors Should Do Now
- Determine whether you handle FCI, CUI, or both — that sets your likely level. See CUI vs. FCI.
- Build to NIST SP 800-171 Revision 2 now (still the operative standard under DFARS 7012) and keep an accurate SPRS score. See DFARS 7012 and CMMC.
- Treat CMMC as verification of a posture you have already built — not a future project to start later.
Source Notes
Primary sources: 32 CFR Part 170; DFARS 252.204-7021 and 252.204-7025; NIST SP 800-171 and SP 800-172. Phase timing is governed by DoD and individual solicitations; the dates above are summarized as of the review date and subject to change. Educational analysis, not legal advice.