Article

The CMMC final rule – A turning point for cybersecurity and supply chain risk management

Oct. 15, 2025 · Authored by Matt Gilbert

The Department of Defense (DOD) has finalized its long-anticipated rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) to implement the Cybersecurity Maturity Model Certification (CMMC) program. Effective Nov. 10, 2025, this rule marks a pivotal shift in how cybersecurity compliance is assessed and enforced across the defense industrial base (DIB). While the rule applies broadly to all DOD contractors handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), it also places a distinct burden on prime contractors to ensure their subcontractors meet the same standards.

What is CMMC?

CMMC is the DOD’s standardized framework for assessing and verifying the cybersecurity practices of contractors and subcontractors within the DIB. Its primary goal is to ensure that companies handling FCI or CUI have appropriate safeguards in place to protect sensitive data from cyber threats. CMMC introduces a tiered model — Levels 1 through 3 — each corresponding to increasing levels of cybersecurity maturity and rigor. Depending on the type of information a contractor handles, they may be required to undergo self-assessments, third-party audits, or government-led evaluations. CMMC transforms cybersecurity from a best practice into an expanded contractual obligation. Baker Tilly’s dedicated CMMC specialists are here to help you navigate this evolving landscape — offering guidance, tailored strategies and hands-on support to ensure your organization meets compliance with confidence and clarity.

How does this new rule finally implement CMMC?

The CMMC framework is governed by two distinct but interrelated rules: the Program Rule and the DFARS Rule. Together, they establish both the structure of the CMMC program and its integration into DOD contracts.

The Program Rule, codified at 32 C.F.R. Part 170, lays out the foundational requirements of the CMMC framework. It defines the certification levels (Level 1, 2 and 3), assessment types (self-assessments, third-party assessments and government-led assessments), and the roles of affirming officials and assessors. This rule also confirms the standards for protecting FCI and CUI, and sets expectations for continuous compliance, including annual affirmations and the use of the Supplier Performance Risk System (SPRS) to track assessment results. This rule became effective Dec. 16, 2024, but did not result in CMMC being fully operational because it was not a contractual requirement.

CMMC level	When used	Contractor obligations
CMMC Level 1 (Self)	Intended for when a contractor only handles (stores, processes or transmits) FCI within their contractor information systems.	Implement the 15 requirements of FAR 52.204-21 also known as CMMC Level 1 Conduct a self-assessment and post the results to SPRS indicating compliance with CMMC Level 1 annually The affirming official makes an affirmation regarding continued compliance with CMMC Level 1.
CMMC Level 2 (Self)	Intended for when a contractor only handles CUI within their contractor information systems. If the nature of services is deemed lower risk by the contracting officer and/or during the first year or Phase 1 of the CMMC adoption timeline as prescribed by the DOD.	Implement the requirements of DFARS 252.204-7012 including the 130 practices from NIST 800-171 Rev. 2, also known as CMMC Level 2 Conduct a self-assessment and post the results to SPRS, indicating fully met status for all practices indicating “final” compliance with CMMC Level 2 every three years. Alternatively, if 300% met ratings are not achieved, but the Plan of Action and Milestone (POA&M) requirements of 32 CFR 170.21 have been satisfied, indicating “conditional” compliance and working to convert to “final” within 180 days The affirming official makes an affirmation regarding continued compliance with CMMC Level 2.
CMMC Level 2 (C3PAO)	Intended for when a contractor handles CUI within their contractor information systems. Except for a select few contractors as indicated by the contracting officer who are likely handling more sensitive information, this will not be required during the first phase (prior to Nov. 30, 2026) but is expected for the following phases (see phases below).	Implement the requirements of DFARS 252.204-7012 including the 130 practices from NIST 800-171 Rev. 2, also known as CMMC Level 2 Engage a C3PAO to conduct an assessment and post the results to SPRS (via eMASS, a system C3PAO’s will use to communicate assessment results to the DOD) indicating fully met status for all practices and “Final” compliance with CMMC Level 2 every three years. Alternatively, if 300% met ratings are not achieved, but the POA&M requirements of 32 CFR 170.21 have been satisfied, indicating “conditional” compliance and working to convert to “final” within 180 days The affirming official makes an affirmation regarding continued compliance with CMMC Level 2
CMMC Level 3 (DIBCAC)	Intended for when a contractor handles (stores, processes or transmits) CUI within their contractor information systems.	Implement the requirements of DFARS 252.204-7012 including the 130 practices from NIST 800-171 Rev. 2, also known as CMMC Level 2, as well as the 24 additional requirements known as CMMC Level 3, derived from NIST 800-172. Achieve a CMMC Level 2 (C3PAO) “Final” as noted above as a prerequisite Engage the DIBCAC to conduct the Level 3 assessment covering the 24 practices of Level 3, earning a status of met for all. Alternatively, if 300% met ratings are not achieved, but the POA&M requirements of 32 CFR 170.21 have been satisfied, indicating “conditional” compliance and working to convert to “final” within 180 days Affirming official makes an affirmation regarding continued compliance with CMMC Level 3

The CMMC final rule – A turning point for cybersecurity and supply chain risk management

What is CMMC?

How does this new rule finally implement CMMC?

Matt Gilbert

Related sections

Article Tags

What the CMMC final rule requires

Compliance with CMMC requirements

When can we anticipate CMMC to impact us?

Subcontractor flow down and monitoring: A critical component

Connect with a CMMC specialist to guide you on your journey.