The long-anticipated Cybersecurity Maturity Model Certification (CMMC) Defense Federal Acquisition Regulation Supplement (DFARS) Proposed Rule, 48 CFR Part 204 (DFARS 252.204-7021) has officially cleared regulatory review and has reached the last stage of the regulatory process. This is a pivotal moment for defense contractors, subcontractors, and suppliers across the Defense Industrial Base (DIB). Once published in the Federal Register, CMMC will no longer be a distant requirement—it will become a contractual obligation. Here’s what you need to know.
The Path to Enforcement
- Final Rule Submission
On July 22, 2025, the Department of Defense submitted the final 48 CFR rule to the Office of Information and Regulatory Affairs (OIRA) for review. This is the final step before publication.
- OIRA Review
OIRA typically standard review period of 90 days to review, with a optional extensions period of up to 30 days, but given the national security implications, was completed by September 2, 2025.
- Publication in the Federal Register
Once OIRA clears the rule, it will be published in the Federal Register, which will establish the official start of the Phase 1 CMMC rollout.
- Effective Date
Once the rule is published, it will include the effective date, which can be 1 to 60 days later.
- Phase 1 of the Roll-Out
The effective date means all new DoD solicitations from that date forward, will include CMMC as a requirement (Level 1, 2 or 3).
What This Means for Contractors
- CMMC Level 1 will likely be a requirement in contracts starting in early to mid-Fall 2025.
- All new DoD solicitations and contracts will begin to include some level of CMMC requirement, based on the data being process, stored or transmitted (FCI, CDI, CTI or CUI)
- Contractors who are not prepared risk being excluded from bidding or being awarded future contracts.
This is no longer a “wait and see” situation—CMMC is real, it’s coming fast, and it will impact every contractor handling Controlled Unclassified Information (CUI).
How to Prepare Now
If your organization hasn’t started aligning with NIST SP 800-171 and CMMC Level 2 requirements, the time is now. Key steps include:
- Conducting a readiness assessment against NIST SP 800-171 controls using NIST SP 800-171A (Assessment Guide)
- Documenting your System Security Plan (SSP) and Plan of Action & Milestones (POA&M) with accuracy
- Establishing policies and procedures for handling CUI
- Evaluating whether your environment can meet CMMC and DFARS requirements—or whether you need a secure enclave solution like Cuick Trac™
Cuick Trac Can Help
At Cuick Trac, we specialize in helping organizations secure CUI quickly and cost-effectively. Our FedRAMP Moderate Equivalent managed enclave gives you a pre-configured, audit-tested environment for CMMC compliance—without forcing you to rip and replace your existing systems. Our customers are passing their CMMC Level 2 assessments with C3PAOs, which is exciting news for organizations looking for confidence in their external providers! With CMMC enforcement now a certainty in 2025, contractors who act early will be positioned to win contracts while others scramble to catch up.
Stay Ahead of the Final Rule
The CMMC Final Rule represents a defining moment for the Defense Industrial Base. The countdown to compliance has begun.
📌 Stay informed and stay prepared. And if you’re ready to see how Cuick Trac can help you prepare, schedule a demo with our team.