DFARS Final Rule on CMMC Is Here: What It Means for the DIB – and How to Get Audit-Ready Faster

On September 10, 2025, the Department of Defense (DoD) issued the long-awaited final DFARS rule that operationalizes CMMC inside contracts and solicitations. This rule – DFARS Case 2019-D041 – amends multiple DFARS parts and adds two key linchpins: a notice provision that tells offerors which CMMC level is required, and a contract clause that makes having the right CMMC status a condition of award and performance. The rule takes effect November 10, 2025. (Federal Register)

If you’re in the Defense Industrial Base (DIB), this is the moment CMMC moves from “plan for it” to “perform against it.” Below, we unpack what changed, how it will show up in your solicitations and contracts, and how Cyberator helps you cut the time, effort, and risk of getting compliant.

---

What exactly did DoD finalize?

Scope and timing. DoD finalized a DFARS framework that ties CMMC into procurement using two instruments:

• DFARS 252.204-7025 – Notice of Cybersecurity Maturity Model Certification Level Requirements. Contracting officers will identify the required CMMC level in each solicitation: Level 1 (Self), Level 2 (Self), Level 2 (C3PAO), or Level 3 (DIBCAC). Offerors must meet that level to be eligible. (Federal Register)
• DFARS 252.204-7021 – Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements. This clause becomes part of your contract and requires that you maintain a current CMMC status at the specified level for each relevant information system throughout performance (with flow-down obligations for applicable subs). (Federal Register)

The effective date is November 10, 2025, meaning solicitations and contracts issued on or after that date can begin requiring CMMC using the new provision and clause. (Federal Register)

What parts of DFARS changed? DFARS Parts 204, 212, 217, and 252 are amended. Among other things, Part 212 confirms use of the new notice provision in commercial acquisitions; Part 217 ties option exercises to the contractor having the required current CMMC status at the time of option execution. (Federal Register)

---

How will CMMC show up in solicitations and contracts?

Before award: Solicitations will include DFARS 252.204-7025 (“Notice”), specifying the required level. If the required level is, for example, Level 2 (C3PAO), you’ll need a current third-party certification in the DoD ecosystem to be considered. (When Level 2 “Self” is allowed, a self-assessment at Level 2 may suffice.) (Federal Register)

At award and during performance: Contracts will include DFARS 252.204-7021 (“Contractor Compliance”). You must have and keep a current CMMC status at the needed level for each CMMC unique identifier (CMMC UID) associated with your information systems processing FCI or CUI for that contract. Primes must ensure subcontractors hold the right level before award of subcontracts where information is flowed down. (Federal Register)

COTS carve-out still applies. As with earlier proposals, pure COTS buys are excluded. But the rule does apply (when required) to commercial products (non-COTS), commercial services, and even to work at or below the Simplified Acquisition Threshold (SAT). (Federal Register)

---

A phased ramp—and a firm endpoint

DoD has set a phased approach for how the clause is prescribed and when it becomes the default in broader circumstances:

• From the effective date through three years after: DFARS 252.204-7021 is used when the requiring activity determines the contractor must have a specific CMMC level (except for COTS). (Federal Register)
• Starting three years and one day after the effective date: the clause is used whenever the contractor’s information systems used to perform the work process, store, or transmit FCI or CUI, again excluding COTS. In other words, CMMC requirements become pervasive across applicable DoD work after the three-year ramp. (Federal Register)

Bottom line: Even if your near-term solicitations don’t immediately require a CMMC level, the runway is short. Use fiscal year 2026 to complete your gap remediation and get your Level 1 or Level 2 status in place according to what you handle (FCI vs. CUI).

---

Clarifications from comments: less noise, more signal

During rulemaking, industry pushed back on additional reporting burdens and definitional ambiguities. DoD’s final rule reflects several important clarifications:

• No new “lapses in information security” reporting to the KO. The proposed requirement to notify the contracting officer of “lapses” or changes in compliance status was removed. DoD points to DFARS 252.204-7012(c) (72-hour cyber-incident reporting) and the annual affirmation of continuing compliance as providing sufficient ongoing protection. (Federal Register)
• Separation from incident reporting. DoD reiterates that CMMC is an assessment framework, distinct from DFARS 252.204-7012 incident reporting; comments on broader CUI policy were deemed out of scope. (Federal Register)
• Definitions tightened. The rule refines terms such as CMMC status, CMMC UID, and how “current” is applied, and it aligns responsibilities for primes to verify subs have a current status prior to subcontract award when information is flowed down. (Federal Register)

---

What levels will you actually see?

The Notice provision requires the contracting officer to insert one of four options in each solicitation: Level 1 (Self); Level 2 (Self); Level 2 (C3PAO); or Level 3 (DIBCAC). Practically, most DIB organizations that handle CUI should anticipate Level 2—with either self-assessment or C3PAO certification depending on program needs—while Level 1 (Self) will continue to cover FCI-only environments. Level 3 will appear in specialized, high-criticality contexts and requires DIBCAC assessment. (Federal Register)

This tracks with the broader CMMC program rule (32 CFR part 170), finalized in October 2024 and effective December 16, 2024, which established the three-level construct and the mix of self and third-party assessments. The DFARS rule is the contractual lever that makes those requirements operational in acquisition. (Federal Register)

---

Implications for proposal teams, contracts, and supply chains

Capture & proposal: Your bid/no-bid calculus must include whether your organization—and any key subs—can demonstrate the correct current CMMC status at the time required by the solicitation (e.g., at proposal, at award, or before option exercise). Expect solicitations to be explicit about level and timing. (Federal Register)

Contract management: Contract administrators need a line of sight into CMMC UIDs mapped to systems per contract, tracking status expirations, and ensuring that option exercises (FAR Part 17) aren’t jeopardized by a lapsed certification or self-assessment. DFARS 217.207 now calls this out directly. (Federal Register)

Subcontractor oversight: Prime contractors are on the hook to verify that each subcontractor has the appropriate CMMC level before work begins where FCI/CUI will be flowed down. This is not one-and-done; your supply-chain onboarding and surveillance should include ongoing status checks. (Federal Register)

Cost and planning: DoD’s impact analysis acknowledges new cost activities tied to the Notice and Clause—planning, assessment readiness, and maintaining current status. Efficient evidence management, policy alignment, and audit preparation become budget items—so every hour you can eliminate from manual tracking directly improves margins. (Federal Register)

---

How to prepare—practical steps to be “current” on Day One

1. Pin down your target level by contract. Catalog where you handle FCI and CUI, then map those environments to likely Level 1 or Level 2 requirements. Keep a forward calendar of recompetes and option exercises that could trigger a status check. (Federal Register)
2. Triage your control gaps. For Level 2, use NIST SP 800-171 as the backbone. Prioritize controls that are high-impact for risk reduction and commonly sampled by assessors (access control, audit and accountability, incident response, media protection, configuration management).
3. Build a clean evidence store. Organize policies, procedures, system security plans (SSPs), network diagrams, inventories, and implementation artifacts by control, with versioning and ownership.
4. Decide on self vs. third-party for each pursuit. Where the Notice requires Level 2 (C3PAO), start scheduling early. Where Level 2 (Self) is acceptable, ensure your self-assessment meets DoD expectations and can withstand due diligence. (Federal Register)
5. Lock in subcontractor checks. Add CMMC status verification to sub onboarding and pre-award reviews, and document it. (Federal Register)
6. Instrument “current” status tracking. Track CMMC UID mappings, expiration dates, and evidence refresh cycles so your status is never stale when the government checks (e.g., at option exercise). (Federal Register)

---

The strategic takeaway

With this DFARS rule, CMMC has crossed from policy into procurement reality. DoD has delivered clarity on when and how CMMC will be required, and it has streamlined some of the proposed red tape (like extra KO notifications). For DIB organizations, the priorities are clear:

• Know your level by contract and system.
• Close your gaps against NIST SP 800-171 (for Level 2) with real evidence, not checklists.
• Keep your status current, including for subcontractors, and don’t let expirations jeopardize option exercises. (Federal Register)

And do it in a way that scales—because this isn’t a one-time push; it’s a per-contract, per-system obligation you’ll carry forward.

---

---

Sources:

• DFARS Final Rule (DFARS Case 2019-D041) — effective November 10, 2025; amends DFARS Parts 204, 212, 217, and 252; adds DFARS 252.204-7021 and DFARS 252.204-7025. (Federal Register)
• Comment-driven changes – removal of KO notifications for “lapses in information security”; reliance on DFARS 252.204-7012(c) incident reporting and annual affirmation. (Federal Register)
• Prescription and phase-in – clause use during the first three years, and broader applicability thereafter; option-exercise tie-in to current status. (Federal Register)