CMMC Now Effective: Phase 1 Begins

CMMC Acquisition Rule Now Effective – Today 10 November 2025 CMMC Phase 1 Begins! 

As of today, the 48 CFR Parts, 204, 212, 217, and 252: Cybersecurity Maturity Model Certification (CMMC) Acquisition Rule is officially effective, granting Government Program Managers (PMs) the authority to enforce the 32 CFR Part 170 CMMC Program within DoD contracts. This means that new or modified contracts may now include DFARS 252.204-7021, which specifies the required CMMC Level — whether Level 1, Level 2 Self-Assessment, Level 2 Certification Assessment, or Level 3.

Today also marks the start of CMMC Phase 1 (Nov 10, 2025 – Nov 9, 2026), focused on Level 2 Self-Assessments. The goal of Phase 1 is to ensure all contractors have completed or begun their self-assessment and are actively working toward Phase 2, which begins in November 2026 and introduces mandatory CMMC Level 2 Certification Assessments conducted by accredited Certified 3^rd Party Assessing Organizations (C3PAOs).

DoD has clarified that Phase 2 Certification Assessments are required when CUI categories fall under the National Archives CUI Registry (archives.gov/cui/registry/category-list). However, PMs may choose to require a C3PAO assessment during Phase 1 if CUI categories in the contract warrant it. Contractors should first contact their Program Manager (PM) or Contracting Officer Representative (COR) to confirm which CMMC level applies to their contract and the expected compliance timeline. Subcontractors must coordinate with their Prime contractor to determine their flow-down obligations. While Phase 1 takes effect today, implementation remains at the PM’s discretion, and some contracts may continue requiring only DFARS 252.204-7012 and 252.204-7019 at this stage.

Once your requirement is confirmed:

1. Complete your self-assessment if not already completed.
2. Remediate deficiencies identified during your self-assessment (e.g. gap assessment) to reach 110.
3. If applicable, begin planning and scheduling with a C3PAO to conduct a CMMC Level 2 certification audit in preparation for Phase 2.

Contact Peerless today for help with your self-assessment, remediation planning and engineering projects, or to connect with trusted C3PAOs listed in the Cyber AB Marketplace once you are CMMC ready. Let us support you in getting audit-ready and certified.

Don't get left behind. Get Peerless.