CMMC Final Rule: Requirements and Preparation for DoD Subcontractors

Summary

A guide to CMMC requirements for DoD contractors, covering certification levels, rollout and subcontractor flow-downs, Level 2 assessment expectations, and steps organizations can take to prepare.

Key points

The article says CMMC applies across the Defense Industrial Base supply chain, with required levels depending on whether organizations handle Federal Contract Information or Controlled Unclassified Information.
Level 2 aligns with 110 NIST SP 800-171 requirements and generally requires a third-party assessment every three years; Level 3 adds 24 NIST SP 800-172 requirements.
The article describes a phased rollout beginning November 10, 2025, with requirements expected to become standard for contracts involving FCI or CUI after November 10, 2028.
Prime contractors are expected to verify that subcontractors hold the required certification before awarding contracts.
Level 2 preparation includes implementing technical controls, establishing operational processes, and maintaining assessment documentation.
The article says a Level 2 score of 110/110 is required for full certification, while eligible organizations scoring at least 88 may receive conditional certification and 180 days to address remaining items.
Suggested preparation steps include determining the applicable level, conducting a gap analysis, creating a remediation plan, and finding qualified support.