Cybersecurity Maturity Model Certification (CMMC) Program Procurement Final Rule Announced

By Susan B. Cassidy, Ashden Fein, Robert Huffman, Ryan Burnette & Krissy Chapman on September 12, 2025

Posted in Cybersecurity, Government Contracts

This blog post discusses the Department of Defense’s (“DoD”) new cybersecurity rule that imposes certain cybersecurity requirements on relevant DoD contractors and subcontractors. The post will be of interest to all DoD contractors, subcontractors, and possibly affiliates of contractors that may be impacted by the new rule’s cybersecurity requirements.

On September 10, 2025, DoD published the final version of the Cybersecurity Maturity Model Certification (“CMMC”) Defense Federal Acquisition Regulation Supplement (“DFARS”) Procurement Rule (“Procurement Rule” or “Rule”) in the Federal Register. This Rule imposes the contractual requirements associated with the CMMC Program Rule that was published in final form in October 2024. The Procurement Rule will become effective sixty days after publication, on November 10, 2025 and will be implemented in a phased approach.

The CMMC Program is expected to have significant impacts on the federal supply chain, imposing certification requirements on all contractors and subcontractors with DoD contracts that include the relevant DFARS clause (currently DFARS 252.204–7021) and under which Federal Contract Information (“FCI”) and/or Controlled Unclassified Information (“CUI”) is processed, stored, or transmitted on contractor information systems.

We wrote about the proposed Procurement Rule in a prior blog post.[1] As described further below, the final Procurement Rule makes a number of notable updates. Among other things, DoD has added and updated certain definitions; clarified when and how long conditional CMMC status can be maintained; noted the need to provide CMMC information for all unique identifiers that will store, process and/or transmit FCI or CUI; added language regarding requirements for contracting officers to confirm information is present in the Supplier Performance Risk System (“SPRS”) before awarding a contract; clarified the phased implementation approach in the prescription clause; added more guidance on subcontractor flow downs and affirmations; and removed certain rule-specific notification requirements.

Overview of the CMMC Program and the Procurement Rule

Last year, DoD released the final CMMC Program Rule, which became effective December 16, 2024. The Program Rule formally established the CMMC Program. CMMC will provide DoD with a means to validate that contractors are in compliance with security measures necessary to safeguard FCI and/or CUI and will impose stricter requirements around implementation of required security controls. The Program Rule authorizes DoD to confirm that a defense contractor or subcontractor has implemented and maintains security requirements for a specified CMMC level (Level 1, Level 2, or Level 3) and assessment type (self-assessment, third party assessment, or government assessment) across the contract period of performance. The CMMC level required is based on the type of information that must be safeguarded during contract performance, and specific security requirements are specified for each level. As noted, the Program Rule is one of two complementary sets of regulations that in combination govern operation of the Program and how contractors must comply with the Program.

The final Procurement Rule, published today, outlines contract requirements for CMMC and implements CMMC in the DFARS. Once it becomes effective on November 10, the Procurement Rule will require DoD to impose a specific CMMC level in a new solicitation or contract if the Program office or requiring activity determines that the contractor is required to have a specific CMMC level. In response to a comment that the final Rule should add an explicit prohibition on including CMMC requirements in existing contracts, DoD noted in the preamble that such an add was not necessary because contracting officers already have the discretion to “bilaterally incorporate the clause in existing contracts.” Contractors therefore may see contracting officers seeking to add the clause if the Program wants it added, especially when option exercise decisions are being made. When CMMC requirements are applied to a solicitation through this Procurement Rule, contracting officers will not make award, exercise an option, or extend the period of performance on a contract, if the offeror or contractor does not have the passing results of a current certification assessment or self-assessment for the required CMMC level, and an affirmation of continuous compliance with the security requirements in SPRS for all information systems that process, store, or transmit FCI or CUI during contract performance.

According to the DoD, a key benefit of the Procurement Rule is that it requires verification of a defense industrial base (“DIB”) contractor’s implementation of system security requirements for the protection of FCI and CUI, providing increased assurance to DoD that a DIB contractor can protect sensitive unclassified information at a level commensurate with the risk. Additionally, DoD intends for the Procurement Rule to ensure that this security verification will occur, as appropriate, down the supply chain by, requiring flow down to covered subcontractors. And DoD also touts as an additional benefit the increased protection of intellectual property and sensitive information, which DoD expects to have a significant impact on the U.S. economy and national security.

Summary of Procurement Rule Updates

In response to the proposed rule, ninety-seven respondents submitted public comments. The preamble to the final Rule highlights several changes and clarifications from the proposed rule. For example:

The Rule added definitions from related regulatory provisions to make the terms consistent across regulations. For example, the Rule added definitions for FCI and Plan of Action and Milestones that are pulled from related regulations. The Rule also clarified the definition of “current” to further address what current means when referring to CMMC conditional status, final CMMC status and affirmations of continuous compliance.
It clarified that conditional CMMC status for levels 2 and 3 may not exceed 180 days, and final CMMC is achieved upon successful closeout of a valid Plan of Action & Milestones.
The Rule clarified that offerors will not be eligible for award of a contract, task order, or delivery order resulting from a relevant solicitation, if the offeror does not have the results of a current CMMC status entered in SPRS at the required CMMC level and a current affirmation of continuous compliance for each of the contractor information systems that will process, store, or transmit FCI or CUI and be used in performance of an award resulting from the solicitation.
The Rule confirmed that contracting officers must check SPRS before awarding a contract to ensure all required information is present in SPRS.
It has also clarified the phased implementation approach, including that until November 10, 2028, the contract clause (DFARS 204.7504) will be prescribed for use if program managers and requiring activities make a determination to apply a CMMC requirement to contracts, excluding contracts solely for the commercially available off-the-shelf (“COTS”) items (unless a waiver applies); and, beginning November 11, 2028 (three years and one day after the Rule’s effective date), the clause will be prescribed for use if program managers and requiring activities determine that the contractor will be required to use contractor information systems in the performance of the contract, task order, or delivery order to process, store, or transmit FCI or CUI, excluding contracts solely for COTS items.
The final Rule clarified and enhanced flow down requirements, mandating that subcontractors also submit affirmations of continuous compliance and results of self-assessment in SPRS. The Procurement Rule confirms, however that prime contractors will not be able to view subcontractors’ CMMC certificates or self-assessment information, and thus must independently verify that lower tier subcontractors have met CMMC requirements.
It also removed certain rule-specific notification requirements in response to public comment, including reporting to contracting officer lapses in information security or changes in compliance. The preamble to the Procurement Rule cites to the cyber incident reporting obligations under DFARS 252.204–7012 and the annual affirmation of continuing compliance as offering sufficient protection to DoD.

We are closely reviewing this Rule and will provide follow up resources for clients with additional details on the final Procurement Rule.

[1] For additional background on CMMC, we first wrote about CMMC in July 2019 and published additional blog posts addressing subsequent updates to the Program, including for Version 0.4, Version 0.6, Version 0.7, and Version 1.0. For further background on Version 2.0, please reference our initial blog post when it was announced and subsequent updates (here and here).