CMMC Starts November 10, 2025: What You Need To Know and Who It Affects
The Department of Defense will begin inserting Cybersecurity Maturity Model Certification requirements into new solicitations and contracts on November 10, 2025. That date marks the start of a three-year, phased rollout that will touch a large portion of the Defense Industrial Base.
Why CMMC is happening
Adversaries continue to target the Defense Industrial Base for sensitive information and access to government systems. CMMC ties award eligibility to concrete cybersecurity practices so contractors protect Federal Contract Information and Controlled Unclassified Information in a consistent, verifiable way. The program replaces one-time attestations with recurring assessments that map to the sensitivity of data you handle.
The timeline at a glance
Beginning November 10, 2025, contracting officers may include the DFARS CMMC clause in new solicitations and awards. DoD will phase the requirement in over approximately three years, expanding from self-assessments to third-party and government assessments as capacity grows. Read your solicitation and contract language, since programs can choose to include CMMC earlier in the phased period based on mission needs.
Who CMMC affects
CMMC applies to most primes and subs in the Defense Industrial Base that process, store, or transmit FCI or CUI. Commercial off-the-shelf only awards are generally excluded, but most multi-tier supply chains will carry flow-down obligations when subcontractors touch covered data. Expect the clause at DFARS 252.204-7021 to appear in more and more actions as the rollout progresses.
Levels and what they mean in practice
- Level 1 covers basic safeguarding for contractors that handle only FCI. It relies on a small set of practices and uses self-assessments.
- Level 2 applies when you handle CUI. It maps to all 110 requirements in NIST SP 800-171. During the early phase, many efforts will use self-assessments, with third-party assessments required as the rollout advances.
- Level 3 is reserved for priority programs and adds selected NIST SP 800-172 requirements on top of Level 2. These assessments are conducted by the government once you have achieved a final Level 2 status.
What changes in your contracts
After November 10, 2025, solicitations can require a specific CMMC level as a condition of award. Contracting officers may choose between Level 2 self-assessments or third-party assessments based on program risk, and can flow the clause to subs that will handle FCI or CUI. Over the three-year period, usage of third-party and government assessments will increase until full implementation. Noncompliance can block award or create performance risk if milestones are missed.
What you should do now
1) Confirm what data you touch.
Inventory where FCI and CUI live, who can access them, and what systems process the data. Your data map drives scope and target level.
2) Baseline against NIST SP 800-171 if CUI is present.
Score your environment, document gaps, and create a plan with dated milestones. The 110 controls are the core of Level 2 readiness.
3) Decide your assessment path.
Look at near-term solicitations to determine whether Level 2 self-assessment will suffice early, or whether a third-party assessment will be required to compete. Book assessor capacity early if you will need it.
4) Prioritize common shortfalls.
Identity and access control, centralized logging, vulnerability management, timely patching, tested backups, and incident response evidence are frequent issues during assessments. Plan realistic remediation timelines.
5) Manage flow-down.
If you are a prime, evaluate subcontractors that touch FCI or CUI. Build CMMC language into subcontracts, request status, and track remediation progress to avoid supply chain gaps.
For CEOs and Executive Leadership
- Confirm whether your company handles FCI, CUI, or both. This drives your target level (L1, L2, or L3).
- Assign an executive sponsor and a cross-functional CMMC team (IT, compliance, finance, legal, operations).
- Approve a budget and timeline tied to contracts that will require CMMC language after Nov 10, 2025.
- Request a current NIST 800-171 score and a gap report with dated milestones.
- Ask for third-party readiness validation if Level 2 assessment is likely.
- Align cyber insurance requirements with CMMC controls and incident reporting timelines.
- Set a quarterly checkpoint cadence with measurable progress and evidence collection status.
- Plan supplier flowdown. Require subs to attest to their CMMC level when they touch FCI or CUI.
For Compliance and Legal Leads
- Map contracts to data types and clauses. Document where FCI and CUI live, who accesses them, and why.
- Maintain an up-to-date System Security Plan (SSP) and a living POA&M only for items that may be open.
- Standardize policies and procedures aligned to NIST 800-171 families. Track approval and version history.
- Stand up evidence management. Store screenshots, configs, logs, and tickets with timestamps.
- Verify incident reporting processes, contacts, and timelines. Run a tabletop focused on notification steps.
- Prepare for assessment. Define scope boundaries, enclaves, inheritance from cloud providers, and artifacts.
- Build subcontractor language for CMMC and verify their status during onboarding and renewal.
For IT and Security Leaders
- Complete a detailed inventory of systems, identities, applications, and data flows that touch FCI or CUI.
- Harden identity first. MFA everywhere, least privilege, privileged access management, and admin tiering.
- Close common gaps. Central logging, time sync, vulnerability scanning, patch cadence, and secure backups with routine restore tests.
- Implement control tooling. EDR or MDR, SIEM or SOC services, application allowlisting, ringfencing, and elevation control.
- Segment networks and restrict east-west traffic. Limit service accounts and rotate credentials.
- Lock down Microsoft 365 or Google Workspace. Secure mail flow, conditional access, and data loss prevention.
- Create assessment playbooks. Who pulls which evidence, from where, and in what format.
- Track progress. Maintain a control matrix mapping each NIST 800-171 requirement to a control owner and proof.
Quick Next Steps
- Perform a CMMC readiness assessment and confirm target level by contract.
- Remediate top five gaps that drive the largest risk and scoring impact.
- Schedule a tabletop for incident response and reporting.
- If Level 2 third-party assessment is expected, lock dates early.
How Cyber Solutions can help
Cyber Solutions supports DIB organizations with preparation, remediation, and ongoing operations aligned to your target CMMC level:
- Readiness and gap analysis mapped to NIST SP 800-171
- Policy, procedure, and evidence development for assessments
- ThreatLocker allowlisting, ringfencing, and elevation control to restrict attack paths
- EDR, MDR, SIEM and SOC services for continuous monitoring
- Tabletop exercises and incident response planning tied to reporting timelines
Start a conversation: https://discovercybersolutions.com/contact-us/
Related services
