Special Notice

DoD published the final CMMC rule on September 10, 2025, ref. 90 Federal Register (FR) 43560, with an effective date of November 10, 2025. This rule amends the Defense Federal Acquisition Regulation Supplement (DFARS) to incorporate CMMC requirements and partially implement Section 1648 of the FY20 NDAA, which directed the Secretary of Defense to develop a consistent, comprehensive framework to enhance cybersecurity for the Defense Industrial Base (DIB). The rule adds a new solicitation provision (DFARS 252.204-7025, Notice of Cybersecurity Maturity Model Certification Level Requirements) addressing CMMC pre-award requirements, and revises the existing contract clause (DFARS 252.204-7021, Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirement[s]) to address new CMMC post-award requirements. DoD will implement CMMC in four phases: Phase 1 begins on November 10, 2025. Phase 2 begins on November 10, 2026. Phase 3 begins on November 10, 2027. Phase 4, the final phase, begins on November 10, 2028. DoDs CMMC Program mandates that all organizations handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) maintain specifi...

Notice ID: 1ad604692aee4319b2574d53da38772c · View on SAM.gov ↗