Inteldefense
CMMC Phase 1: What the Rule Actually Requires
The CMMC clause took effect on November 10, 2025, but DoD kept three years of discretion. The date matters less than the first bid you cannot submit.
On November 10, 2025, the DFARS rule that puts CMMC into contracts took effect. The Federal Register notice (opens in a new tab) is short on drama: a final rule amending the Defense Federal Acquisition Regulation Supplement, effective that day.
Nothing switched on. No contractor was required to hold a certificate on November 11. What changed is that a contracting officer can now put a CMMC requirement in a solicitation and refuse to award without it.
That distinction is where most of the confusion lives. Contractors who read the date as a deadline prepare for the wrong thing. Contractors who read it as a permission slip wait for a solicitation that never mentions CMMC and conclude they are safe.
The effective date is not the deadline. The deadline is the first bid you want and cannot submit.
The clause, and the three years
The mechanism is DFARS clause 252.204-7021, prescribed at 204.7504. For the first three years after the effective date, the clause goes into a solicitation only when the program office or requiring activity decides that a CMMC level applies. Awards solely for commercially available off-the-shelf items are excluded.
Beginning three years and one day after the effective date, the prescription changes. From that point the clause applies whenever the contractor will use its own information systems to process, store, or transmit Federal Contract Information or Controlled Unclassified Information, with the COTS exclusion carrying over.
Read those two paragraphs together and the shape of the next three years appears. The phase-in is discretion, not delay. A program office that wants CMMC on a contract in 2026 can have it. A program office that does not is not obliged to ask for it yet. Your exposure is set by the programs you sell into, not by the calendar.
The date sets when the requirement becomes universal. It does not set when it becomes possible.
Four levels, and the one that costs money
The rule names the levels as they will appear in a solicitation: CMMC Level 1 (Self), CMMC Level 2 (Self), CMMC Level 2 (C3PAO), and CMMC Level 3 (DIBCAC).
Level 1 covers FCI and is a self-assessment. Level 2 covers CUI and can be either a self-assessment or a third-party assessment by a C3PAO, depending on what the program office requires. Level 3 is assessed by the Defense Industrial Base Cybersecurity Assessment Center and applies to the most sensitive programs.
The distinction that matters commercially is between Level 2 (Self) and Level 2 (C3PAO). Both require the 110 security requirements in NIST SP 800-171. Only one of them produces a certificate somebody else will accept. If a prime or a program office asks for evidence, a self-assessment is your own assertion about your own network, and it carries the weight that phrase implies.
Two mechanics are worth knowing before you bid.
The contracting officer checks the Supplier Performance Risk System and cannot award to an offeror without a current CMMC status at the required level or higher. There is no conversation at that point. The status is either in SPRS or the offer is ineligible.
A conditional status is available for Level 2 and Level 3 for up to 180 days from the conditional date, which lets an award happen while a plan of action and milestones is still open. Final status arrives when that plan closes. The 180 days is the part contractors underestimate: a POA&M is a runway, not a parking space.
Where the preparation usually goes wrong
Four failures account for most of the wasted money I have seen.
Scoping the boundary last. The assessment covers the systems that process, store, or transmit CUI, and the scope is set before the assessment, not during it. Companies that start with tooling and end with a boundary discover that half the spend was outside scope, or worse, that a system they excluded is in it. Decide what is in the boundary first. An enclave that isolates CUI from the rest of the corporate network is a legitimate answer and often the cheapest one.
Treating documentation as the deliverable. A system security plan is required. It is not evidence. An assessor will ask to see the configuration, the log, the ticket, and the approval, because the plan says what should happen and the artifact shows what did. The gap between those two is where findings come from.
Writing a POA&M that cannot close. A credible plan has an owner, a technical change, a date, and a way to prove the change happened. A list of intentions with dates eighteen months out reads as a decision to stay conditional. The rule gives 180 days, and an assessor can see the difference between a project and a wish.
Forgetting the affirmation. A senior official has to affirm continuous compliance in SPRS every year, and the affirmation is attached to a named person. That is a personal attestation, not a subscription renewal. Treat it as something you would be willing to explain.
What to do instead
The work is unglamorous and it is the same list regardless of which level you are chasing.
Scope the boundary and write it down. Map the 110 requirements to the systems inside it. Fix the technical ones first, because encryption, multi-factor authentication, logging, and network denial are load-bearing for a dozen other requirements each. Then write the plan for what remains, with dates you can hit.
Then decide the commercial question. Certification is expensive, and the honest alternative is to stop handling CUI: restructure the work so the sensitive data stays with the prime or inside a government system. That is a legitimate strategy for a small company, and it is cheaper than a failed assessment.
If you do decide to certify, book the assessment early. DoD's own estimate in the rule puts 337,968 prime and subcontractor entities in scope once the requirement is universal, and 68 percent of them small entities. Whatever the assessor pool is, it is not that size. The companies that wait for a solicitation to start looking will be competing for a calendar slot against everyone else who waited.
One more thing about the supply chain. Primes flow the requirement down, because a prime cannot certify a contract whose subcontractors are outside the boundary. If you support a prime on a program that carries CMMC, your customer's compliance depends on yours, and that conversation arrives before the government's does.
Financial systems are not a loophole
Accounting, budget, and cost systems are where CUI hides in plain sight. Financial data, projections, and procurement records inside a defense program are exactly the material the rule was written for, and an ERP or financial system integration is in scope when it touches that data.
The overlap with audit readiness work is real but partial. Financial improvement programs already demand access control, data governance, and an audit trail. CMMC asks for those plus configuration management, incident response, and evidence that the controls operate. A team that has done the financial work has a head start on the documentation and almost none on the technical controls. Do not let the overlap convince you the requirement is already met.
The clock is a program decision
The date in the Federal Register is a fact. The date that matters to your company is the day a program you sell into decides to require a level, and that decision is not published in advance.
That is the argument for starting now, and it is not about the certification. It is about being able to say yes when a contracting officer asks a question you did not expect. Contractors who can answer that question get considered. Contractors who cannot are not evaluated, and they usually find out from a debrief.