Locations
Members
Remote Support

Search Everywhere

More results…

Generic selectors
Exact matches only
Search in title
Search in content
Post Type Selectors
post
page
product
betterdocs_faq
docs

Contact Us

Search Everywhere

More results…

Generic selectors
Exact matches only
Search in title
Search in content
Post Type Selectors
post
page
product
betterdocs_faq
docs
Contact Us

Search Everywhere

More results…

Generic selectors
Exact matches only
Search in title
Search in content
Post Type Selectors
post
page
product
betterdocs_faq
docs

Contact Us

November 10, 2025: The Day CMMC Becomes Real for DoD Contractors and Their Subcontractors.

Share This Post

Why November 10, 2025 Matters

November 10, 2025 is the date the Cybersecurity Maturity Model Certification (CMMC) moves from planning to enforcement. Starting on this day, new and renewed Department of Defense contracts begin including CMMC requirements. If you are a prime contractor or a subcontractor, you must meet the correct CMMC level to remain eligible for award and renewal.

  • Phase 1 begins: Level 1 and certain Level 2 requirements appear in solicitations.
  • Verification replaces trust: Self-attestation gives way to verifiable assessments based on the level.
  • Flow-down is real: Subcontractors that touch Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) must comply at the level dictated by their data exposure.
 

Official references: DoD CIO CMMC Overview and the Federal Register DFARS CMMC rule.

CMMC Background and Purpose

CMMC was created to strengthen the Defense Industrial Base. It protects two types of information shared during contract performance:

  • FCI: Government information not intended for public release and provided or generated under contract.
  • CUI: Information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that requires safeguarding or controlled dissemination.
 

Implementation occurs through contracts. Primes and their subcontractors must meet the required level as a condition of award. Sources: DoD CIO, Federal Register.

Learn more about the Scope of Work for Ongoing Compliance Services

The CMMC Model

Level     Purpose Core Requirements Assessment and Cadence
Level 1 Basic safeguarding of FCI 15 practices aligned to FAR 52.204-21 Annual self-assessment and annual affirmation in SPRS
Level 2 Protection of CUI 110 controls aligned to NIST SP 800-171 Rev. 2 Either self-assessment or C3PAO certification every 3 years as specified in the solicitation, plus annual affirmation
Level 3 Higher-level protection against advanced threats Level 2 controls plus 24 practices from NIST SP 800-172 DIBCAC certification every 3 years and annual affirmation

CMMC levels 1 through 3 with requirements and assessment types

 

Key Implementation Timeline

Phase Begins What Changes
Phase 1 Nov 10, 2025 Where applicable, solicitations require Level 1 or Level 2 self-assessment
Phase 2 Nov 10, 2026 Where applicable, solicitations require Level 2 certification by a C3PAO
Phase 3 Nov 10, 2027 Where applicable, solicitations require Level 3 certification
Phase 4 Nov 10, 2028 All applicable solicitations and contracts require CMMC as a condition of award

Note: In some procurements the Department may implement CMMC requirements earlier than the planned phase. Source: DoD CIO.

Four-phase CMMC rollout from 2025 to 2028

Why Subcontractors Are Equally Affected

CMMC requirements flow down. Prime contractors must ensure each subcontractor that handles FCI or CUI meets the appropriate level. One non-compliant subcontractor can place a bid or renewal at risk.

Assessments, POA&M, and Annual Affirmation

Assessment requirements, POA&M limits, affirmation rules for Levels 1 to 3

Assessment Types

  • Self-Assessment: Performed by the Organization Seeking Assessment. Results go to the Supplier Performance Risk System (SPRS).
  • C3PAO Certification: Performed by an authorized Certified Third-Party Assessment Organization. Results go to eMASS.
  • DIBCAC Certification: Conducted by the Defense Industrial Base Cybersecurity Assessment Center for Level 3.
 

POA&M Rules

  • Not permitted for Level 1.
  • Permitted for Levels 2 and 3 with limits in the final rule. All open items must be remediated within 180 days of the conditional status date and then verified in a closeout assessment.
 

Annual Affirmation

  • Required after each assessment and every year thereafter.
  • Failure to affirm annually will cause your status to lapse.
 

Details are drawn from the DoD CIO program description and DFARS CMMC rule. See: DoD CIO and Federal Register.

Immediate Actions to Prepare

  1. Identify your level. Confirm whether you handle FCI, CUI, or both.
  2. Run a gap analysis. Compare current practices to FAR 52.204-21 for Level 1 or NIST SP 800-171 Rev. 2 for Level 2.
  3. Build your System Security Plan (SSP). Document how each requirement is met. Keep evidence current.
  4. Create POA&Ms where allowed. Assign owners and due dates. Track progress toward the 180-day closeout.
  5. Engage trusted experts. Consider a Registered Provider Organization or a C3PAO for readiness and certification.
 

Helpful links:
EasyITGuys CMMC Technical Deep Dive,
EasyITGuys Non-Technical CMMC Guide

Technical Deep Dive

NIST Alignment

  • Level 1: FAR 52.204-21 safeguards.
  • Level 2: 110 controls in NIST SP 800-171 Rev. 2.
  • Level 3: Level 2 plus 24 practices from NIST SP 800-172.
 

Validity and Systems

  • Assessments are valid for three years.
  • Annual affirmation in SPRS is required to maintain status.
  • Self-assessment results are entered in SPRS. C3PAO and DIBCAC results are tracked in eMASS.
 

Supply Chain

Primes must verify that subcontractors handling FCI or CUI meet the correct CMMC level before award. This protects sensitive information throughout the supply chain and reduces risk to the program.

Upcoming Milestones

  • Nov 10, 2025: Phase 1 begins. Self-assessments for Level 1 and some Level 2 solicitations.
  • Nov 10, 2026: Level 2 C3PAO certifications required where applicable.
  • Oct 31, 2026: All new DoD contracts include CMMC language.
  • Nov 10, 2027: Level 3 certifications introduced.
  • Nov 10, 2028: Full implementation across applicable DoD solicitations and contracts.

The Bottom Line

CMMC is now enforceable. Early action protects eligibility and reduces risk. EasyITGuys can help with readiness assessments, gap remediation, documentation, and coordination with C3PAOs.

Request a CMMC Readiness Review
Explore the Statement of Work for Ongoing Compliance Services

Official Resources and Further Reading

The CMMC Model

CMMC levels 1 through 3 with requirements and assessment types

 

Key Implementation Timeline

PhaseBeginsWhat Changes
Phase 1Nov 10, 2025Where applicable, solicitations require Level 1 or Level 2 self-assessment
Phase 2Nov 10, 2026Where applicable, solicitations require Level 2 certification by a C3PAO
Phase 3Nov 10, 2027Where applicable, solicitations require Level 3 certification
Phase 4Nov 10, 2028All applicable solicitations and contracts require CMMC as a condition of award

Note: In some procurements the Department may implement CMMC requirements earlier than the planned phase. Source: DoD CIO.

Four-phase CMMC rollout from 2025 to 2028

Why Subcontractors Are Equally Affected

CMMC requirements flow down. Prime contractors must ensure each subcontractor that handles FCI or CUI meets the appropriate level. One non-compliant subcontractor can place a bid or renewal at risk.

Assessments, POA&M, and Annual Affirmation

Assessment requirements, POA&M limits, affirmation rules for Levels 1 to 3

Assessment Types

  • Self-Assessment: Performed by the Organization Seeking Assessment. Results go to the Supplier Performance Risk System (SPRS).
  • C3PAO Certification: Performed by an authorized Certified Third-Party Assessment Organization. Results go to eMASS.
  • DIBCAC Certification: Conducted by the Defense Industrial Base Cybersecurity Assessment Center for Level 3.
 

POA&M Rules

  • Not permitted for Level 1.
  • Permitted for Levels 2 and 3 with limits in the final rule. All open items must be remediated within 180 days of the conditional status date and then verified in a closeout assessment.
 

Annual Affirmation

  • Required after each assessment and every year thereafter.
  • Failure to affirm annually will cause your status to lapse.
 

Details are drawn from the DoD CIO program description and DFARS CMMC rule. See: DoD CIO and Federal Register.

Immediate Actions to Prepare

  1. Identify your level. Confirm whether you handle FCI, CUI, or both.
  2. Run a gap analysis. Compare current practices to FAR 52.204-21 for Level 1 or NIST SP 800-171 Rev. 2 for Level 2.
  3. Build your System Security Plan (SSP). Document how each requirement is met. Keep evidence current.
  4. Create POA&Ms where allowed. Assign owners and due dates. Track progress toward the 180-day closeout.
  5. Engage trusted experts. Consider a Registered Provider Organization or a C3PAO for readiness and certification.
 

Helpful links:
EasyITGuys CMMC Technical Deep Dive,
EasyITGuys Non-Technical CMMC Guide

Technical Deep Dive

NIST Alignment

  • Level 1: FAR 52.204-21 safeguards.
  • Level 2: 110 controls in NIST SP 800-171 Rev. 2.
  • Level 3: Level 2 plus 24 practices from NIST SP 800-172.
 

Validity and Systems

  • Assessments are valid for three years.
  • Annual affirmation in SPRS is required to maintain status.
  • Self-assessment results are entered in SPRS. C3PAO and DIBCAC results are tracked in eMASS.
 

Supply Chain

Primes must verify that subcontractors handling FCI or CUI meet the correct CMMC level before award. This protects sensitive information throughout the supply chain and reduces risk to the program.

Upcoming Milestones

  • Nov 10, 2025: Phase 1 begins. Self-assessments for Level 1 and some Level 2 solicitations.
  • Nov 10, 2026: Level 2 C3PAO certifications required where applicable.
  • Oct 31, 2026: All new DoD contracts include CMMC language.
  • Nov 10, 2027: Level 3 certifications introduced.
  • Nov 10, 2028: Full implementation across applicable DoD solicitations and contracts.

The Bottom Line

CMMC is now enforceable. Early action protects eligibility and reduces risk. EasyITGuys can help with readiness assessments, gap remediation, documentation, and coordination with C3PAOs.

Request a CMMC Readiness Review
Explore the Statement of Work for Ongoing Compliance Services

Official Resources and Further Reading

Need Help Navigating Ongoing Compliance Services?

Learn more about how we can help, click the link below to read about our SOW (Statement of Work) and what we include.
Learn More

Discover more from EasyITGuys

Subscribe to get the latest posts sent to your email.

More To Explore

Discover more from EasyITGuys

Subscribe now to keep reading and get access to the full archive.

Continue reading