On Sept. 10, 2025, the Department Defense (DoD) issued a final rule amending the Defense Acquisition Regulation Supplement (DFARS) to implement the Cybersecurity Maturity Model Certification (CMMC) program for government contractors. This final rule established a November 10, 2025 go-live date for the start of phase 1 of CMMC. As we covered in our prior alerts, under the four-phased implementation approach, the focus will be on Level 1 and Level 2 self-assessments in the first year; Level 2 third-party certifications in the second year; Level 3 certifications in the third year; and all contracts and solicitations will include CMMC requirements in the fourth year.
Beginning on Nov. 10, contractors and subcontractors will see CMMC requirements in solicitations and option exercises. This GT Alert focuses on Level 1, which will apply to any contractors or subcontractors with information systems that store, process, or transmit federal contract information (FCI).