The Department of Defense (DoD) has finalized the Cybersecurity Maturity Model Certification (CMMC) acquisition rule under 48 CFR Parts 204, 212, 217 and 252. The rule was published in the Federal Register on September 10, 2025, and will go into effect 60 days later on November 10, 2025.
This marks a major milestone in the implementation of the Cybersecurity Maturity Model Certification (CMMC) program. Beginning November 10, DoD contracting officers will be authorized to include CMMC requirements in new solicitations and contracts, enabling formal enforcement of cybersecurity standards across the defense industrial base.
The rule outlines phased implementation over three years, with full applicability to all relevant contracts by November 10, 2028, excluding those solely for commercially available off-the-shelf (COTS) items.
For more details, refer to the final rule published under docket number 2025-17359.
As a CMMC Third-Party Assessment Organization (C3PAO), Cherry Bekaert brings extensive experience navigating the complexities of CMMC requirements. Our Information Assurance & Cybersecurity and Government Contracting professionals are well-equipped to support your organization's compliance initiatives. With a deep understanding of the evolving regulatory landscape, we provide tailored solutions to ensure the necessary requirements are met efficiently.
If you have any questions or need guidance on CMMC implementation or compliance initiatives, our CMMC advisors are available to discuss your unique situation and help you navigate the process with confidence.
Related Insights
