Will a final rule issued by the Department of Defense on September 10, 2025 (available here) cause companies to rethink their compliance approach? The rule –relating to the Cybersecurity Maturity Model Certification program or CMMC – will impact how defense contractors engage with the Department of Defense. (We wrote previously (here) about the separate, but related, CMMC rule that addressed substantive CMMC program requirements.)This final rule will require defense contractors to affirm CMMC compliance on a phased approach, with full implementation by November 2028. The requirement will place a significant hurdle on defense contractors, who will need to affirm their CMMC compliance in order to contract with the Department of Defense. The first implementation phase begins November 10, 2025 and addresses self-assessment and affirmation for entities that handle “FCI” (or basic Federal Contract Information) and “CUI” (or Controlled Unclassified Information). More detail about the... Read the complete article here...Copyright © 2025, Sheppard Mullin Richter & Hampton LLP.
Leveling Up: Will CMMC Contract Obligations Impact Your Organization?
