Cyber attacks against the defense supply chain keep climbing, and the stakes are high. The Department of Defense published the final CMMC rule on September 10, 2025, and starting November 10, 2025, certification becomes a contract requirement. For defense contractors working with the federal government, if your team touches Federal Contract Information or Controlled Unclassified Information, this applies to you. To even register to do business with the federal government and pursue these opportunities, you’ll need to be listed on SAM.gov, the System for Award Management.
This post breaks down the Cybersecurity Maturity Model Certification (CMMC), rules, four-stages of rollout over three years. You will get the key changes that matter, the timeline to full enforcement by 2028, and clear steps to get ready. The goal is simple, secure federal awards, protect sensitive data, and avoid last‑minute scrambles.
CMMC verifies that contractors follow proven standards, including NIST SP 800-171 for protecting CUI and the basic safeguards for FCI. It does this through required assessments and annual affirmations, not checklists that live in a drawer. The program aligns what you do every day with what your contracts demand, building on foundational requirements like registration on SAM.gov to help secure contracts.
There are three levels to know. Level 1 covers basic safeguards for FCI with self-assessments. Level 2 is for broad CUI protection, mapped to the 110 NIST SP 800-171 requirements, with either self or third-party assessments based on the solicitation. Level 3 adds selected NIST SP 800-172 measures for advanced threats and is assessed by the government.
The rollout uses four phases over three years, starting November 10, 2025, and builds to full implementation by 2028. Small and mid-sized businesses should move now, since assessor capacity and remediation windows will get tight. In the next sections, you will see what changes first, what comes next, and how to prepare without slowing delivery.
Understanding CMMC: What It Means for Your Business
Photo by Towfiqu barbhuiya
CMMC brings clarity to what it takes to win and keep DoD work, especially through platforms like SAM.gov where contractors register and track opportunities. It sets clear levels, ties them to trusted standards, and phases in requirements over three years so teams can plan upgrades without stopping delivery. The goal is simple: stronger safeguards for Controlled Unclassified Information and a tougher defense supply chain for the federal government. If you handle Federal Contract Information or CUI, treat CMMC as a contract gate, not an IT project, starting with entity registration on SAM.gov to obtain your Unique Entity ID, a key component for entities doing business with the federal government. This section explains how the levels differ and how CMMC builds on existing clauses, including the Cybersecurity Maturity Model Certification (CMMC), rules, four-stages of rollout over three years.
Key Differences Between CMMC Levels
CMMC maps security to the sensitivity of data and who sees it, then verifies performance through assessments and annual affirmations. Compliance not only unlocks contract opportunities but also ensures eligibility for federal awards, provided you maintain active SAM registration as a crucial prerequisite for bids.
- Level 1, basic FCI safeguards: You perform an annual self-assessment against 15 practices from FAR 52.204-21, record results in SPRS, and submit an annual affirmation. POA&Ms are not allowed. FCI is non-public contract data the government shares to deliver products or services.
- Level 2, broad CUI protection (Self): For programs that allow self-assessment, your organization assesses every three years, enters results in SPRS, and affirms annually. POA&Ms are allowed and must be closed within tight timelines. CUI is sensitive, controlled information defined by policy and listed in the DoD CUI Registry.
- Level 2, C3PAO Certification: For higher risk environments, an accredited third party assesses every three years, with results managed in eMASS, and you still affirm annually. POA&Ms are permitted, with required closeout.
- Level 3, advanced threat protection: You must first hold a valid Level 2 status. DIBCAC assesses every three years, with annual affirmations required. POA&Ms are allowed, with strict closure deadlines.
These requirements flow down to subcontractors based on the data they handle. For a deeper look at Level 2 assessments, review the DoD’s CMMC Assessment Guide, Level 2.
How CMMC Aligns with Existing DoD Cybersecurity Standards
CMMC does not replace existing requirements, it enforces them. FAR 52.204-21 sets the baseline for protecting FCI, and DFARS 252.204-7012 requires 110 controls from NIST SP 800-171 for systems that process, store, or transmit CUI. CMMC builds on those clauses by requiring assessments and annual affirmations, which prevent lapses and keep practices current. Assessment results go to SPRS, and for certified Level 2, information is also managed in eMASS.
Why this matters for IT providers supporting contractors: your solutions must map cleanly to the control sets, support evidence collection, and stand up to either self, C3PAO, or DIBCAC scrutiny. Strong MFA, logging, vulnerability management, and incident response are no longer optional. The DoD’s CMMC FAQs confirm this alignment and clarify how the program verifies compliance across the DIB. Over the four-phase rollout, expect increasing use of certification in solicitations on SAM.gov, followed by full integration as a condition of award.
The CMMC Rules: Major Updates and Requirements
Photo by Antoni Shkraba Studio
CMMC is no longer a proposal, it is the standard. The final rule arrived on September 10, 2025, and the federal government will phase it in over three years using a four-stage rollout. The goal is simple, stronger safeguards for Controlled Unclassified Information and a tighter defense supply chain. Expect more solicitations to include certification requirements as the phases progress, with full integration by 2028.
Keep the focus on the basics: assessments, annual affirmations, and timely remediation. This is how you protect awards and keep performance smooth under the Cybersecurity Maturity Model Certification (CMMC), rules, four-stages of rollout over three years; especially when entities are registered in SAM.gov and pursuing federal contracts.
What’s New in the Final CMMC Rule
The September 10, 2025 acquisition rule makes CMMC a condition of contract award, with requirements appearing in solicitations starting November 10, 2025, and tied to the System for Award Management (SAM.gov) for verification. Assessments now have clear owners and timelines: Level 2 certifications are performed by a C3PAO every three years, and Level 3 is performed by DIBCAC on the same cycle. Level 3 results are recorded in eMASS, and annual affirmations continue in SPRS. To seek Level 3, you must hold a valid Level 2 for the same scope, and maintaining an active SAM registration is essential for eligibility in these contract awards.
POA&Ms are tightly limited. Level 1 cannot use them. Levels 2 and 3 may use POA&Ms for select gaps, but all items must be closed within 180 days, followed by a closeout assessment. Conditional status expires if issues remain open. Final CMMC Status is valid for three years from the status date, ensuring compliance is tracked effectively through SAM.gov. A practical overview of these contract effects appears in CMMC Final Rule: Key Takeaways for Defense Contractors.
CMMC Timeline: The Four-Stage Rollout Over Three Years
CMMC rolls out in four stages over three years to raise the floor on cybersecurity, protect Controlled Unclassified Information, and strengthen the defense supply chain. Each phase adds more contracts with assessment requirements and moves from self-attestation to third-party and government-led certifications. Expect annual affirmations, tighter POA&M rules, and clear three-year validity windows after each assessment. This section maps what starts first and what follows through 2028, so you can plan resources, budget, and schedule, while ensuring your SAM.gov setup supports overall contracting readiness.
Phase 1: Getting Started with Self-Assessments
Phase 1 starts November 10, 2025. New solicitations can require a valid Level 1 or Level 2 self-assessment as a condition of award. You will record results in SPRS and begin annual affirmations to keep status active. This is not a check-the-box exercise. Contracts can require proof of implementing the 15 FAR practices for FCI at Level 1, or all 110 NIST SP 800-171 requirements for CUI at Level 2. If you use a POA&M at Level 2, close gaps within 180 days and complete a closeout assessment to convert conditional status to final. During this phase, SAM registration becomes essential for pursuing federal awards tied to these requirements.
Phases 2-4: Building to Full Certification
As Phase 2 begins, solicitations add more Level 2 certifications performed by accredited C3PAOs every three years, with results managed in eMASS. By Phase 3 and Phase 4, high-priority programs include Level 3 certifications led by DIBCAC, and full rollout completes by 2028. Annual affirmations continue in SPRS to prevent lapses. This progression is confirmed across industry briefings that track the four-phase plan and the three-year path to full enforcement, such as this overview of the CMMC four-phase rollout.
Plan now. To get started, register with SAM.gov if you haven’t already, verifying your Unique Entity ID as a key identifier for entities pursuing contracts. Most teams need 6 to 12 months to harden systems, collect evidence, and remediate findings, alongside managing the renewal process for ongoing SAM.gov compliance. A smart sequence is to scope CUI, implement 800-171, run a gap assessment, and lock down POA&Ms early. Then schedule your C3PAO. This keeps you in step with the Cybersecurity Maturity Model Certification (CMMC), rules, four-stages of rollout over three years and protects awards as requirements expand.
Preparing for CMMC: Actionable Steps for Defense Contractors
CMMC is now a contract gate, and the four-stage rollout over three years will tighten requirements as more solicitations call for certification. The goal is simple, stronger safeguards for Controlled Unclassified Information and a tougher defense supply chain. Before diving into CMMC specifics, defense contractors must ensure they are registered to do business with the federal government through SAM.gov, which is part of the Integrated Award Environment (IAE). This SAM registration process is essential for accessing contract opportunities and grant funding in the federal space. Use the steps below to get ready without slowing delivery across the Cybersecurity Maturity Model Certification (CMMC), rules, four-stages of rollout over three years.
Ensure Active SAM.gov Registration as a Prerequisite
To bid on DoD contracts requiring CMMC, maintain an active entity registration in SAM.gov. The federal government stopped using DUNS Number in favor of new Unique Entity Identifiers, making the Unique Entity ID a key requirement. The UEI is a 12-character alpha-numeric value serving as your entity’s identifier, often called the SAM UEI.
Start by checking if you need to register an organization or update an existing one. If not already done, obtain a UEI through the SAM.gov entity registration portal. This active SAM registration confirms your status as registered in SAM.gov and is crucial for your entity’s SAM.gov registration to remain valid. Remember to renew your registration annually to keep it active; failing to renew registration could lapse your active registration, blocking access to federal opportunities.
For ongoing compliance, monitor and renew registration as needed to sustain active entity registration. This foundational step aligns with broader federal government contracting requirements and positions you for CMMC-related solicitations.
Set Your Target Level and Scope Your Data
Start with what you handle. Do you process Federal Contract Information, Controlled Unclassified Information, or both?
- Level 1 protects FCI and uses annual self-assessments. POA&Ms are not allowed.
- Level 2 protects CUI and maps to all 110 NIST SP 800-171 requirements. Assessments occur every three years. Some contracts permit self-assessment, others require a C3PAO.
- Level 3 adds selected NIST SP 800-172 controls for advanced threats. DIBCAC performs the assessment every three years. A valid Level 2 is required for the same scope.
Define your assessment scope early. Document where CUI lives, who accesses it, and what systems store or transmit it. If helpful, isolate CUI into a dedicated enclave to reduce scope.
Build Your System Security Plan and Inventory
Your System Security Plan is the blueprint auditors expect to see.
- Document architecture, boundaries, assets, and data flows.
- Maintain an asset inventory for endpoints, servers, SaaS, and cloud services in scope.
- Map policies and procedures to each NIST SP 800-171 control.
- Track exceptions and create a Plan of Action and Milestones for gaps at Level 2 and Level 3 only.
Keep the SSP current. Update it when systems, tools, or vendors change.
Close Technical Gaps for Level 2 Controls
Most findings come from the basics. Lock these down early:
- Access control: least privilege, unique accounts, and timely offboarding.
- MFA: enforce strong MFA for users and admins, across on-prem and cloud.
- Configuration management: baselines, hardening, and change control.
- Logging and monitoring: centralize logs, retain them, and review alerts.
- Vulnerability management: scanning, patching, and risk-based remediation.
- Incident response: clear playbooks, contacts, and tabletop tests.
- Backup and recovery: regular backups, offline copies, and restore tests.
- Encryption: protect data at rest and in transit using approved ciphers.
- Supplier controls: agreements that align with your CUI handling rules.
Plan Your Assessment Path and Deadlines
Match your plan to the solicitation and the phase of rollout.
- Level 1: annual self-assessment, results in SPRS, annual affirmation.
- Level 2: self or C3PAO assessment every three years, depending on the contract. Results go to SPRS for self assessments and to eMASS for C3PAO certifications. Annual affirmations are required.
- Level 3: DIBCAC assessment every three years, results managed in eMASS, annual affirmations continue.
POA&Ms are allowed for Level 2 and Level 3, but all items must be closed within 180 days. A closeout assessment is required to convert conditional status to final, or status will lapse.
Produce Evidence That Auditors Trust
Collect proof as you implement. Store it where your team can reach it fast.
- Policies and procedures mapped to each control
- Screenshots of MFA, logging, and encryption settings
- Access reviews and user provisioning tickets
- Scan results, patches applied, and change logs
- Incident response exercises and after-action reports
- Backup reports and successful restore evidence
- Vendor agreements that reflect CUI handling and flow down
Aim for evidence that is recent, complete, and repeatable.
Manage Subcontractors and Flow down
CMMC requirements flow down based on the data a subcontractor handles.
- Classify subcontractors by data exposure, then assign CMMC level needs.
- Put CUI handling and incident reporting in contracts and purchase orders.
- Verify their assessment status and annual affirmation. Track expirations.
- Provide clear data handling instructions to avoid scope creep.
Align With the Four-Stage Rollout and Schedule Early
The DoD will introduce requirements in phases over three years. Early phases emphasize self-assessments, then move to third-party and government-led certifications for higher risk programs. Schedule readiness work now, since assessor capacity and remediation windows will tighten. A practical sequence:
- Scope FCI and CUI, then set your target level.
- Build the SSP and asset inventory.
- Run a NIST SP 800-171A gap assessment and create POA&Ms for Level 2 and Level 3.
- Fix high-risk gaps first, especially identity, logging, and patching.
- Stage evidence while you remediate.
- Book your C3PAO if your solicitations require certified Level 2.
Quick Reference: Level-by-Level Actions
Use this snapshot to keep your plan on track.
- Level 1: self-assess yearly against the 15 FAR practices, record in SPRS, submit annual affirmation. No POA&Ms.
- Level 2: implement all 110 NIST SP 800-171 requirements, assess every three years by either self or C3PAO based on the contract, record results in SPRS or eMASS, affirm annually, and close POA&Ms within 180 days with a closeout assessment.
- Level 3: maintain a valid Level 2 for the same scope, complete DIBCAC assessments every three years, manage results in eMASS, affirm annually, and follow the same POA&M closeout rules.
Conclusion
CMMC is now the standard for doing business with the federal government and the DoD, and the clock is ticking. The new rule takes effect in late 2025, then moves through a four-phase rollout to 2028. Level 1 keeps FCI safe with annual self-assessments and affirmations. Level 2 protects CUI with the full NIST SP 800-171 set, using either self or C3PAO assessments every three years. Level 3 adds selected NIST SP 800-172 requirements for higher risk programs, with DIBCAC assessments and strict timelines for POA&M closeout.
This shift raises security across the defense industrial base. You gain clearer expectations, measured performance, and fewer surprises in audits. It also protects awards by aligning everyday controls with contract terms, including entries in SPRS, certified results in eMASS, and annual affirmations that keep status current, while maintaining active entity registration for ongoing compliance.
Start now. Scope your data, lock the basics, and schedule assessments early. Teams that move first avoid bottlenecks, reduce rework, and stay competitive as solicitations add certification language. Ensure your entity registration is in place, including a valid Unique Entity ID and SAM registration, as crucial steps for securing defense contracts and pursuing federal awards. The goal is simple: stronger safeguards for controlled unclassified information and a stronger defense supply chain.
Take the next step today. Use this guide to plan your path under the Cybersecurity Maturity Model Certification (CMMC), rules, four stages of rollout over three years, and don’t forget SAM.gov as a final reminder for doing business with DoD, win more work, and protect sensitive data.
