Written and maintained by CASRAI Editorial Board
Last updated
The CMMC final rule is two final rules, not one. The program rule, 32 CFR Part 170, defines the Cybersecurity Maturity Model Certification program and its levels. The acquisition rule, a DFARS amendment (DFARS Case 2019-D041), is what puts CMMC requirements into Department of Defense (DoD) solicitations and contracts. The program rule’s phased rollout starts only when the acquisition rule takes effect, which is why most “when does CMMC apply” questions need both documents. This page describes both as published in the Federal Register and the eCFR, checked on 2026-10-29.
What the CMMC final rule is and who runs it
CMMC is a DoD program that verifies defense contractors have implemented required cybersecurity practices. The program rule, 32 CFR Part 170, was published in the Federal Register on October 15, 2024 and took effect on December 16, 2024. The DFARS acquisition rule (Federal Register document 2025-17359, 90 FR 43560, titled “Assessing Contractor Implementation of Cybersecurity Requirements”) was published as a final rule on September 10, 2025 and took effect on November 10, 2025. It adds the contract clause DFARS 252.204-7021 and the solicitation provision 252.204-7025. Our guide to DFARS 252.204-7021 covers the clause itself.
Two rules: 32 CFR Part 170 and the DFARS rule
| Question | 32 CFR Part 170 (program rule) | DFARS Case 2019-D041 (acquisition rule) |
|---|---|---|
| What it does | Defines the CMMC program, its levels and the phased implementation (section 170.3) | Adds CMMC requirements to DoD solicitations and contracts through clause 252.204-7021 and provision 252.204-7025 |
| Published | October 15, 2024 | September 10, 2025 (90 FR 43560) |
| Effective | December 16, 2024 | November 10, 2025 |
| Role in the rollout | States that Phase 1 begins on the effective date of the acquisition rule | Its effective date is therefore the start of Phase 1 |
Eligibility: who the rule applies to
The rule reaches DoD contractors and subcontractors on contracts that include the CMMC requirement. Section 170.3 describes the phases in terms of “applicable” DoD solicitations and contracts, so a contractor is covered only when a solicitation or contract includes the program requirement. A university or research institute is covered under the same test; see CMMC compliance for universities and research institutions for that setting. As described on the official eCFR page on 2026-10-29, the rule does not apply by organization type; it applies through the contract.
What the rule requires
The rule sets CMMC status levels that a contract can require. The levels named in the phase text are Level 1 (Self), Level 2 (Self), Level 2 (C3PAO) and Level 3 (DIBCAC). Level 2 means implementing all 110 requirements of NIST SP 800-171 Revision 2, assessed either by self-assessment or by a Certified Third-Party Assessment Organization (C3PAO), depending on the contract. Level 3 is assessed by the DoD’s DIBCAC; see CMMC Level 3. In the eCFR text current on 2026-10-01 (section 170.14), the program rule states that the Level 2 requirements are identical to those of NIST SP 800-171 Revision 2.
Compliance steps
- Read the solicitation or contract for the clause 252.204-7021 and provision 252.204-7025 and for the CMMC status level it requires.
- Match that level to the assessment type: a self-assessment, a C3PAO assessment (C3PAO authorization and requirements) or a DIBCAC assessment.
- Understand the assessment sequence in the CMMC assessment process.
- Hold the required status before award, and maintain it for the life of the contract, as the clause requires.
The four phases
Section 170.3 defines each phase relative to the one before it. The text contains no calendar dates. The table quotes the start conditions and summarizes what DoD intends in each phase.
| Phase | Start condition in section 170.3 | What DoD intends |
|---|---|---|
| 1 | “Begins on the effective date of the complementary 48 CFR part 204 CMMC Acquisition final rule.” | Level 1 (Self) or Level 2 (Self) status as a condition of award; may also apply to option periods on earlier contracts |
| 2 | “Begins one calendar year following the start date of Phase 1.” | Adds Level 2 (C3PAO) for award, which DoD may defer to an option period; DoD may also require Level 3 (DIBCAC) |
| 3 | “Begins one calendar year following the start date of Phase 2.” | Level 2 (C3PAO) for all applicable awards and option exercises on contracts awarded after the effective date; DoD plans Level 3 (DIBCAC) for all applicable awards, which it may defer to an option period |
| 4 | “Begins one calendar year following the start date of Phase 3.” | “DoD will include CMMC Program requirements in all applicable DoD solicitations and contracts,” including option periods on contracts awarded before Phase 4 |
Because the acquisition rule took effect on November 10, 2025, the one-year spacing places the phase starts at November 10 of 2025, 2026, 2027 and 2028. Those four dates are derived from the relative language; the rule text does not print them. The phrases “DoD intends”, “DoD plans” and “may” in the text give DoD discretion, particularly over deferring requirements to option periods.
Common mistakes
- Treating the phases as fixed calendar dates. The text sets relative starts and gives DoD discretion over option periods, so the contract itself is the authority on what applies.
- Merging the two rules. The program rule defines the levels; the acquisition rule is what places requirements in contracts. Citing one without the other leaves out half the picture.
- Assuming a Level 2 self-assessment suffices everywhere. From Phase 2 onward, the text adds Level 2 (C3PAO) for award, and Phase 3 makes it the default for applicable awards.
- Assuming existing contracts are exempt. Phases 1 and 4 both refer to option periods on contracts awarded earlier.
Related programs
| Item | Where it fits | Guide |
|---|---|---|
| DFARS 252.204-7021 | The contract clause that requires a contractor to maintain a current CMMC status level | DFARS 7021 |
| CMMC Level 3 | The DIBCAC-assessed level named in Phases 2 and 3 | CMMC Level 3 |
| C3PAO | The third-party assessor behind Level 2 (C3PAO) status | CMMC C3PAO |
| CMMC assessment process | How an assessment proceeds | CMMC CAP |
FAQ
Is the CMMC final rule in effect?
Yes. The program rule (32 CFR Part 170) took effect on December 16, 2024, and the DFARS acquisition rule took effect on November 10, 2025, which started Phase 1.
When is full implementation?
Phase 4, when DoD will include CMMC requirements in all applicable solicitations and contracts, begins one calendar year after Phase 3. Counting from the November 10, 2025 effective date, that is November 2028, a date derived from the rule’s relative language.
Does it apply to existing contracts?
Not automatically. The text allows CMMC requirements on option periods of contracts awarded earlier, at DoD’s discretion, so existing contracts can be affected when an option is exercised.
Which version of NIST SP 800-171 does it use?
Revision 2. The eCFR text current on 2026-10-01 (section 170.14) says the Level 2 requirements are identical to those of NIST SP 800-171 Revision 2, which has 110 requirements.
Sources
- eCFR, 32 CFR 170.3, ecfr.gov section 170.3, checked 2026-10-29. Level 2 and NIST SP 800-171 Revision 2: section 170.14 in the same part, checked 2026-10-29.
- Federal Register, DFARS Case 2019-D041 final rule, document 2025-17359, 90 FR 43560, federalregister.gov 2025-17359, checked 2026-10-29.
- Federal Register, CMMC Program final rule, document 2024-22905, published October 15, 2024, federalregister.gov 2024-22905, checked 2026-10-29.
