The wait is finally over, and U.S. Department of Defense (DoD)
contractors need to be prepared. On September 10, 2025, DoD posted
afinal rulethat will officially make
Cybersecurity Maturity Model Certification (CMMC) a reality for
many contractors starting November 10, 2025. The program is
designed to address longstanding contractor cybersecurity
vulnerabilities that have led to losses of sensitive government
information and financial harm to the government. In full effect,
the CMMC will apply to over 300,000 entities across a wide range of
industries, from construction to healthcare and beyond, with few,
if any, exceptions.
CMMC Program Overview
The CMMC program, developed over several years, is designed to
protect DoD's information security systems and intellectual
property. The program will apply to DoD contractors, outside of
solely commercial off-the-shelf items (COTS), whose information
systems store government-controlled unclassified information (CUI)
and
