Breaking News: CMMC 48 CFR Rule Clears Review

FINAL UPDATE: September 10, 2025, 8:30am EST

Link to the official Federal Register

————————————————————————————————

UPDATE: September 9, 2025, 10am EST – The 48 CFR CMMC Final Rule is out – Phase 1 begins 11/10/2025

Link to the public preview : https://public-inspection.federalregister.gov/2025-17359.pdf

————————————————————————————————

The long-awaited CMMC 48 CFR Rule has officially cleared regulatory review last Friday (August 29, 2025), marking one of the final steps before its formal publication in the Federal Register. Read the cleared rule here (PDF).

What Happens Next

1. Federal Register Publication (~1 week): The rule is expected to be published within days.
2. Effective Date (1–60 days later): We don’t anticipate delays; the effective date will trigger Phase 1 of the CMMC rollout. (see this blog post for the Roll Out Plan)
3. Immediate Contract Impact: From that date forward, all new DoD solicitations and contracts will include some level of CMMC requirement.

What is the 48 CFR CMMC Rule?

This rule formally embeds CMMC into the Federal Acquisition Regulation (FAR) system under Title 48 CFR. A companion rule also updates DFARS 252.204-7021, aligning contract language with the latest 32 CFR program details. Key changes include:

• Reduction from five levels to three levels of certification.
• Allowances for Plans of Action & Milestones (POAMs).
• Introduction of a waiver process for certain cases.

This update ensures that the contracting clause first introduced in 2020 reflects the CMMC 2.0 program realities.

Why This Matters

As DoD Secretary Pete Hegseth recently emphasized, “Cybersecurity is no longer optional” (Forbes). This cleared rule is the practical enforcement mechanism behind that statement. Contractors should treat this as the final countdown to compliance.

Action Item: Defense subcontractors should immediately begin assessing their CMMC readiness, because the effective date will arrive fast and new contracts will not wait.