Inteldefense
CMMC 2.0: The Deadline Is a Solicitation, Not a Date
The DFARS final rule took effect on 10 November 2025. Certification is phased in over three years, and the real clock starts with a solicitation.
The CMMC final rule is real. The 18-month deadline that followed it is not.
The DFARS rule implementing CMMC 2.0 was published on 10 September 2025 at 90 FR 43560 (opens in a new tab) and took effect on 10 November 2025. It does not give every contractor 18 months to certify. It phases the requirement in over three years, and it lets program offices decide when to apply the clause during that window.
That difference matters more than the headline.
What the rule changes
The rule adds DFARS clause 252.204-7021 and the solicitation provision at 252.204-7025. Together they put a CMMC level into a contract and require the contractor to post a current status in the Supplier Performance Risk System.
The clause uses four designations: CMMC Level 1 (Self), CMMC Level 2 (Self), CMMC Level 2 (C3PAO), and CMMC Level 3 (DIBCAC). Level 1 covers federal contract information. Level 2 maps to NIST SP 800-171, with the assessment path set by the contract. Level 3 adds NIST SP 800-172 requirements for the most sensitive programs.
The clause is not prescribed for every contract on day one. For the first three years after the effective date, it is used when a program manager or requiring activity decides to apply it. From 11 November 2028, three years and a day after the effective date, it is prescribed for contracts that require contractor information systems to process, store, or transmit FCI or CUI. Awards solely for commercial off-the-shelf items are excluded.
The backstop is 11 November 2028. The practical deadline is earlier, and it is different for every company.
The clock starts with a solicitation
Contractors keep asking for the date. The rule does not give one date. It gives a sequence.
A contracting officer cannot award to an offeror that lacks a current CMMC status in SPRS at the level the solicitation requires. So your deadline is the award date of the first solicitation that names a level your systems cannot meet. That solicitation may arrive next quarter. It may arrive in 2027. You do not control the timing. You control whether you can answer it.
The phase-in also creates uneven demand. A company working on a program that opts in early faces the requirement years before a company in a program that waits. Sector and customer matter more than company size. The rule has no small-business exemption. The only broad carve-out is for awards solely for COTS items.
There is a conditional path at Level 2: a plan of action and milestones can support a conditional status for up to 180 days. That is a bridge, not an extension of the preparation window. You still need an assessment booked and a credible closeout plan.
What to do before the solicitation arrives
Start with scope. Identify every contractor information system that will process, store, or transmit CUI and get a CMMC unique identifier for each in SPRS. Scoping is where companies either waste money on systems that are out of bounds or discover, late, that a shared service pulls them in.
Then assess against NIST SP 800-171. The gap assessment should produce a remediation plan with owners and dates, not a slide. If you plan to use a C3PAO, talk to several early. The assessor market is finite. In my experience, the credible firms book months out. Ask how they scope, what evidence they expect, and how they handle a system that fails a practice.
The assessment tests implementation. A system security plan is necessary, and it is not the evidence by itself. Assessors will look for the configuration, the logs, the ticket history, the training records, and the person who can explain how a control works. A binder that describes a process nobody follows fails.
Finally, map the flowdown. If a subcontractor handles CUI on its own systems, it needs its own CMMC status. A prime cannot certify a sub by writing a clause. It can require evidence, verify the status in SPRS, and decide whether the relationship is worth the risk.
What the rule does not settle
The rule does not tell you what certification costs. Published ranges vary by scope, system count, and the state of your documentation. Anyone who quotes a number before scoping your environment is guessing. Budget from your own gap assessment.
It does not settle the CUI scoping question either. That call drives cost and schedule, and it is the one most worth getting a second opinion on.
And it does not turn CMMC into a security program. An assessment is a snapshot. The annual affirmation of continuous compliance is the part that makes it a habit. If the underlying controls decay after the assessment, the status in SPRS becomes a claim you cannot defend.
Passing an assessment is evidence of a moment. The affirmation is evidence of a practice.
The day that matters
The CMMC rule is now a contracting mechanism with dates, clause language, and a database that contracting officers are required to check. That is a real change from guidance.
But the deadline story is simpler than the rule. Your company will not lose eligibility on a universal date. It will lose a specific award on a specific day because a solicitation asked for a level and SPRS had nothing to show.
Prepare for that day. Build the scope, close the gaps, book the assessment, and keep the evidence current. The calendar is a backstop, not a plan.