Share on LinkedInShare on LinkedIn

ARTICLE · 19 NOVEMBER 2025

DoD Begins Phased Implementation Of CMMC Final Rule: Key Actions For Contractors

Akin
Akin
Contributor
Akin

Akin

Akin is a global law firm with more than 1,100 lawyers and advisors who pride themselves on...

View firm profile
Explore more from Akin

On November 10, 2025, the Department of Defense (DoD), also referred to as the Department of War (DoW), officially began rolling out its Cybersecurity Maturity Model Certification (CMMC) Final Rule...

United StatesGovernment, Public Sector

On November 10, 2025, the Department of Defense (DoD), also referred to as the Department of War (DoW), officially began rolling out its Cybersecurity Maturity Model Certification (CMMC) Final Rule, marking the start of the program's phased implementation. CMMC requirements may now appear in new DoD solicitations, contract awards and option exercises.

Contractors should act now to:

  • Achieve and maintain the required CMMC level—eligibility for DoD contracts now depends on certification aligned with the sensitivity of information handled.
  • Identify whether your organization handles Controlled Unclassified Information (CUI) or Federal Contract Information (FCI) and where it resides—understanding CUI data flows is essential to determining the applicable CMMC level and scope of assessment for both CUI and FCI.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

See more popular content from