For years, CMMC was a warning on a slide. Since November 2025 it is a clause in live Department of Defense solicitations, which means the question changed from "when is it coming" to "how long is the line ahead of me."
The two dates that already happened
On December 16, 2024, the CMMC program rule took effect: the framework, levels, and assessment requirements became federal regulation. On November 10, 2025, the companion acquisition rule began inserting CMMC requirements into new DoD solicitations. From that day, affected contracts require a current assessment and an affirmation in the government's system as a condition of award. The requirement broadens in phases over roughly three years.
What the levels mean, plainly
- Level 1: you handle federal contract information. Annual self-assessment. The floor.
- Level 2: you touch controlled unclassified information, the sensitive technical data of defense work. Most companies at this level need a third-party assessment from a certified assessor. This is where most of the supply chain lands.
- Level 3: the highest tier, assessed by the government itself. If this is you, you already know.
What is happening ahead of the mandate
Prime contractors are not waiting for their contracting officers. They are surveying suppliers now, asking for assessment scores and certification status, and quietly re-ranking their vendor lists by who will be eligible to receive flowed-down work. You do not need a DoD contract to feel this. If your customer holds one, their compliance becomes your requirement.
The queue is the real deadline. A Level 2 gap assessment, remediation, and a third-party assessment together take most mid-market shops six to eighteen months. The phase-in schedule does not wait for your remediation plan, and neither do certified assessors' calendars.
This quarter, in order
- Confirm which level applies to you, based on the data you actually touch, not the data you think you touch.
- Get an honest gap assessment against the 110 controls of NIST 800-171. Not a sales audit. A ranked list of findings.
- Fix the cheap, high-value items first: multi-factor authentication everywhere, tested backups, a written and rehearsed incident plan.
- Put your assessment date on the calendar before you feel ready. The date creates the readiness.