CMMC 2.0 Final Rule Effective Date
The CMMC Program final rule (32 CFR Part 170) became effective, formally establishing CMMC as enforceable regulation for the defense industrial base. The program rule defines the three CMMC levels, the assessment and certification requirements for each, and the roles of contractors, C3PAOs, and DoD in the certification ecosystem. Contractual enforcement arrived separately through the 48 CFR acquisition rule revising DFARS 252.204-7021, published September 10, 2025 and effective November 10, 2025, which started the four-phase rollout: Phase 1 (Level 1 and Level 2 self-assessments in new solicitations) began on that date. Phase 2 third-party assessment requirements were originally scheduled for November 10, 2026, but DoD suspended Phase 2 on July 13, 2026 pending its CMMC Reform Task Force review.
Key Analytics
Impact Analysis
The program rule marked the transition from self-attestation alone to a formal certification regime for defense contractors handling FCI and CUI. With the 48 CFR acquisition rule in effect since November 10, 2025, CMMC requirements now appear in new DoD solicitations, and contractors must demonstrate the required level at time of award. Phase 2 was originally scheduled to expand Level 2 third-party certification requirements on November 10, 2026, but DoD suspended Phase 2 on July 13, 2026 pending its CMMC Reform Task Force review, and no replacement timeline has been announced. The C3PAO assessment ecosystem remains capacity-constrained, so organizations that have not already engaged an assessor may face wait times if third-party requirements return.
Recommended Actions
- Confirm your assessment timeline with your selected C3PAO and ensure it aligns with your upcoming contract renewal or rebid dates
- Complete all remediation activities and conduct a final internal assessment to validate readiness before the third-party assessment
- Prepare the senior official affirmation documentation and ensure the designated executive understands the scope of the attestation they will sign
Always verify requirements with official regulatory sources.
Estimated Remediation Effort
Indicative effort to address this development, broken down by your organization's current compliance posture. Select the posture that best matches where you are today.
A partial program exists: some policies and controls are in place, but coverage, evidence, and ownership have gaps.
- ›Remediation completion against the open gap set before assessment
- ›Final internal assessment to validate readiness ahead of the C3PAO
- ›Assessment scheduling aligned to upcoming renewal and rebid dates
- ›Senior official affirmation documentation and executive walkthrough
The Cost of Waiting
Readiness work is dramatically cheaper before a deadline than after one. The ranges below come from the same estimate: the difference is only how prepared you are when the work starts.
Roughly 210 to 520 hours avoided by preparing early
Effort ranges are indicative planning estimates, not quotes. Actual effort depends on organizational scope, environment complexity, and evidence maturity. Talk to us for a scoped assessment.