On September 9, 2025, the Department of War (formerly DoD) announced that the final Defense Federal Acquisition Regulation Supplement (DFARS) rule implementing the Cybersecurity Maturity Model Certification (CMMC) program cleared OIRA and is scheduled for publication in the Federal Register.

Lot’s of acronyms, what does all that mean?

Bottom Line Up Front:

No waivers, no shortcuts—if a contracting officer includes CMMC and you don’t have certification, you don’t compete.

More Detail: The DoD required compliance with NIST SP 800-171 under DFARS since December 31, 2017. For organizations that took it seriously, you’ve already been building and auditing against these controls. For everyone else, the era of self-attestation and “pencil whipping” is officially over. With the final DFARS rule now published, CMMC doesn’t add new requirements—it enforces the ones that have been law for nearly a decade.

Enforcement With Teeth

This is the real change:

• What You Did Yesterday: Post a self-attested SPRS score and hope nobody asked questions.
• What You Do Now (effective Nov 2025): Pass a CMMC assessment or risk disqualification.
• If you falsify findings? The Department of Justice is waiting with the False Claims Act because enforcement fines are in the Millions of Dollars.

Again…No waivers, no shortcuts—if a contracting officer includes CMMC and you don’t have certification, you don’t compete.

“Can” vs. “Will”: Understanding the Nuance

This is where many contractors in the SMB space get confused.

• DFARS clause text: If the clause is in your contract, certification is required. There is no “may” or “can” in the clause itself.
• Rollout policy (Phase 1): Beginning with the rule’s effective date (~Nov 9, 2025), contracting officers can choose to include CMMC in solicitations. That discretion is real—some solicitations may hold off, while others will include it immediately.
• Later phases: Discretion fades. As the rollout progresses, contracting officers will be required to include CMMC in all applicable solicitations. At that point, no contracts involving CUI or FCI will be awarded without certification.

Key point: The clause is always mandatory if present. The only nuance is when and where it gets inserted—and with the final rule now published, expect contracting officers to start exercising that discretion right after the effective date.

No “Get-Out-of-Jail-Free” Cards: Sole Source ≠ Exemption

Another misconception is that sole-source awards provide a loophole. That’s not true. Whether competitive or sole-source, compliance is required to win and keep the work.

Updated Timeline to Watch

• July 22, 2025 — DoD submitted the final rule to OIRA.
• Aug 25, 2025 — OIRA cleared the rule.
• Sept 10, 2025 — Federal Register publication.
• Nov 9, 2025 — Rule becomes effective (60 days post-publication).
• After Nov 9, 2025 — Contracting officers may begin including CMMC in solicitations at their discretion (Phase 1).
• 2026 forward — Phased rollout shifts inclusion from discretionary to mandatory across DoD.

What Contractors Should Do Now

1. Audit your SPRS scores – Ensure they’re accurate, not aspirational.
2. Plan for C3PAO Level 2 assessments – Especially if you create, store, or process DoD CUI.
3. Get your supply chain ready – Primes will demand proof from subcontractors.
4. Stop banking on waivers, delays, or sole-source exemptions – none will save you.

CMMC is not a new security framework. It’s the same NIST SP 800-171 requirements that have applied since 2017. The difference is that now, with the final DFARS rule published and effective Nov 2025, meaningful enforcement is here.

BACK TO BLOGS