The DoD released the final CMMC rule on September 10, 2025, effective November 10, 2025. DoD subcontractors handling CUI must obtain a Level 2 certification via a third-party C3PAO assessment, requiring a perfect score of 110/110 (or at least 88 for a conditional cert). With only ~82 certified C3PAOs for potentially 80,000+ contractors needing Level 2, a severe bottleneck is expected — making early preparation critical. Key preparation areas include technology (SIEM, endpoint protection), documented processes, and a System Security Plan. Prime contractors will enforce flow-down requirements, meaning subs must be certified to remain in the supply chain.
