Preparing For CMMC In 2025

After years of anticipation and a series of delays, implementation of the U.S. Department of Defense's Cyber Maturity Model Certification Program (CMMC) is rapidly approaching. Though CMMC is not expected to enter into effect until early-to- mid 2025, DOD contactors can start taking steps now to ensure a smooth transition into this new regulatory era.

On October 15, 2024, DOD published a final rule, which builds on prior CMMC rulemaking and crystalizes its requirements ahead of CMMC's phased rollout to DOD contractors and subcontractors.

Importantly, publication of the Final Program Rule does not immediately implement the DOD's CMMC contract requirements. Instead, the trigger for CMMC's implementation for contractors is tied to a separate CMMC rule, known as the "CMMC Clause Rule," which is currently at the proposed rule stage and will likely not be finalized until sometime in 2025. However,