CMMC Live: Pentagon Demands Verified Cybersecurity From Contractors

The US Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) program officially entered its enforcement phase on 10 November 2025, with enforcement of DFARS amendments requiring defence contractors and subcontractors to implement specific cyber security measures to protect sensitive information. Contractors must protect Federal Contract Information and Controlled Unclassified Information, and the DoD can mandate CMMC compliance as a condition for new defence contracts.

After eight years of self-attestation, some organisations will also be assessed by a certified third-party assessor organisation (C3PAO), depending on the information they handle.

There are three maturity levels: Level 1 requires 15 requirements and annual self-assessment; Level 2 involves 110 requirements aligned to NIST SP 800-171 and may be self-assessed or C3PAO‑assessed; Level 3 demands 110 requirements plus 24 from NIST SP 800-172 and is assessed by the Defence Industrial Base Cybersecurity Assessment Center every three years.

The implementation is staged: Phase one on 10 November 2025 covers Level 1 and Level 2 self-assessments, Phase two on 10 November 2026 adds third‑party assessments for Level 2, Phase three on 10 November 2027 introduces Level 3, and Phase four on 10 November 2028 completes full rollout across applicable contracts.