CMMC Final Rule: Key Takeaways for Defense Contractors

On September 10, 2025, the Department of Defense (DoD) completed the Cybersecurity Maturity Model Certification (CMMC) rulemaking process. CMMC comprises two regulatory regimes. 32 C.F.R. Part 170 establishes the CMMC program requirements (the Program Rule), and the September 10, 2025 final rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) (the DFARS Rule) establishes DFARS policies, contract clauses, and other provisions to implement the Program Rule. This Advisory discusses key takeaways for DoD prime contractors and subcontractors.

CMMC Overview

• Effective Date/Phase 1 Start Date: In accordance with 41 U.S.C. § 1707, the DFARS Rule takes effect on November 10, 2025 (60 days after publication). Phase 1 of the four-phase process for implementing CMMC begins that same day.¹
• Applicability: Subject to the four-phase implementation process and absent a waiver, CMMC applies to all DoD solicitations and contracts (other than contracts exclusively for commercially available off-the-shelf items) that require contractors to store, process, or transmit federal contract information (FCI) or controlled unclassified information (CUI) on contractor information systems.²
• Implementation: DoD will implement CMMC through a four-phase process:

• CMMC Levels and Assessments: As shown in the chart below, CMMC requirements are divided across three levels with the following security and assessment requirements. The DoD program office or requiring activity is responsible for identifying applicable CMMC requirements and determining for Level 2 whether a self-assessment or a C3PAO certification assessment is required. Solicitations will specify the requirements in DFARS 252.204-7025.

• Scoping: A critical requirement for CMMC compliance is identifying the contractor information systems that must be included in the CMMC assessment. For Level 1, information systems that store, process, or transmit FCI are in scope. Specialized Assets (i.e., assets that can process, store, or transmit FCI but cannot be fully secured) are outside the CMMC Level 1 scope. Scoping for Levels 2 and 3 is more complex and requires, among other things, identifying which assets store, process, or transmit CUI; which assets can, but are not intended to, store, process, or transmit CUI; and the nature of the assets.
• External Service Providers (ESPs): Many contractors of all sizes rely to some extent on ESPs, including cloud service providers (CSPs). Whether an ESP is within scope and the nature of the assessment turns on certain considerations, and most importantly whether the ESP stores, processes, or transmits CUI or Security Protection Data. If a DoD contractor uses a CSP to store, process, or transmit CUI, then the CSP must comply with requirements in DFARS 252.204-7012, including meeting Federal Risk and Authorization Management Program (FedRAMP) moderate baseline requirements. FedRAMP authorizations are likely to be increasingly important for CSPs and contractors. The Program Rule states that if a contractor is “using a FedRAMP Authorized CSP (at the FedRAMP Moderate or higher baseline),” then the contractor “is not responsible for the CSP’s compliance,” but if the CSP does not have a FedRAMP authorization, the contractor “is responsible for determining if the CSP meets the requirements for FedRAMP Moderate equivalency.”³
• Subcontractors: Prime contractors and higher-tier subcontractors must flow down CMMC requirements to lower-tier subcontractors that will store, process, or transmit FCI or CUI on unclassified contractor information systems.⁴ The prime contract’s CMMC requirements and the nature of the information a subcontractor will store, process, or transmit during performance using those information systems will dictate subcontractor CMMC obligations. Prime contractors and subcontractors must address CMMC requirements during subcontract negotiations, and that includes considering risk-shifting provisions.

Key Implications

• Contract Eligibility: Current and prospective DoD contractors that are not already CMMC compliant at levels they anticipate needing to compete in DoD procurements must come into compliance to be eligible for award of DoD contracts and to retain existing contracts if DoD includes CMMC requirements as a condition of exercising an option period. Ensuring Supplier Performance Risk System (SPRS) profiles are current is critical because contracting officers will rely on information in SPRS rather than compliance representations in proposals.⁵
• Enforcement Risks: Current and prospective contractors must ensure not only initial but also continuous compliance with CMMC requirements and close out POAMs in a timely manner. Noncompliance can lead to contract disputes and False Claims Act liability. Express certification requirements increase liability risks.
• Impact on Existing Information Security Requirements: CMMC does not affect other information security requirements. Thus, defense contractors must continue to comply with cyber incident reporting requirements in DFARS 252.204-7012, among other requirements.

© Arnold & Porter Kaye Scholer LLP 2025 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.