Last updated: September, 2025
It’s the question many businesses and contractors want answered — is CMMC required now?
This is critical information for any entity who works with or is pursuing work for the U.S. Department of Defense (DoD).
Currently, CMMC, or the Cybersecurity Maturity Model Certification program, is indeed required for organizations that do business with the DoD. With compliance for SaaS becoming increasingly important for government entities and businesses of all sizes, the CMMC 2.0 timeline has been advanced in response to industry requests for an updated and enhanced program. The final CMMC Program Rule was released on October 15, 2024, and the final Defense Federal Acquisition Regulation Supplement (DFARS) rule was published on September 10, 2025, with an effective date of November 10, 2025. This verifies that defense contractors comply with protections for federal contract information and controlled unclassified information to bolster ongoing protections for cybersecurity threats.
Ultimately, the CMMC is designed to safeguard sensitive information, thwart ongoing threats, and support public trust while ensuring DoD contractors and subcontractors meet essential cybersecurity requirements.
What is CMMC?
CMMC is an acronym for Cybersecurity Maturity Model Certification. The U.S. Department of Defense (DoD) established CMMC. CMMC improves and checks the cybersecurity of contractors and subcontractors in the defense industrial base (DIB).
In a time when data breaches threaten people, businesses, and governments, strong cybersecurity measures are essential. Cyber-attacks are growing, from ransomware to state-sponsored spying. This rise pushes the need for a flexible and standard cybersecurity framework.
Due to these threats, the DoD has required that their contractors achieve CMMC. This tiered model understands that different organizations have different risks. CMMC adjusts its requirements to fit each one. It works to ensure that cybersecurity practices align with the specific nature of the information an organization handles.
At its core, CMMC sets forth a set of requirements from the guidelines in NIST 800 – 171 that companies must adhere to. This guarantees the protection of controlled unclassified information (CUI).
What are the different CMMC levels?
CMMC requirements span three maturity levels: Level 1, Level 2, and Level 3.
Each level introduces a progressively sophisticated set of cybersecurity practices. CMMC requirements vary depending on the level of certification needed:
Level 1 (Foundational):
- Implement 15 practices from FAR 52.204-21
- Annual self-assessment
- Senior company official affirmation
- No POA&M allowed; all practices must be fully implemented
Level 2 (Advanced):
- Implement 110 practices aligned with NIST SP 800-171
- Annual self-assessment for non-critical CUI
- Triennial third-party assessment for critical CUI
- Plan of Action and Milestones (POA&M) allowed for certain practices; must be closed out within 180 days of a conditional CMMC status date
Level 3 (Expert):
- Implement 134 requirements including full implementation of NIST SP 800-171 plus a subset of NIST SP 800-172 requirements
- Government-led assessments (DIBCAC)
- POA&M allowed, must be closed out within 180 days
What is the current status of CMMC?
CMMC is no longer a future concept. It is now a binding requirement for the defense industrial base. The U.S. Department of Defense has finalized its rule making, making CMMC a legal and contractual reality.
The CMMC Clock Starts on November 10, 2025
The CMMC Program Rule started in late 2024. But for contractors, the key action is the CMMC Acquisition Rule, published on September 10, 2025. This rule becomes effective on November 10, 2025, and it’s the most important date on your calendar.
This rule gives the DoD the authority to include CMMC requirements in contracts, making compliance a condition.
CMMC Phased Rollout is Beginning Now
While CMMC is now a legal requirement, the DoD is implementing it gradually over a three-year period.
- Starting November 10, 2025: CMMC requirements will begin to appear in select new DoD solicitations and contracts. This initial phase will focus on Level 1 and some Level 2 self-assessments.
- Gradual Expansion: Over the next three years, the DoD will expand the number of contracts that include CMMC. Contracting officers can ask for third-party assessments for certain contracts immediately. So, don’t assume you have extra time.
- Full Implementation by Late 2028: By then, all DoD contracts that handle sensitive unclassified information will need to comply with CMMC.
What should DoD contracts do now about CMMC?
Contractors can no longer afford to wait. The clock is ticking, and the following actions are critical to remain eligible for DoD work:
- Assess Your Status: You must document your CMMC status in the DoD’s Supplier Performance Risk System (SPRS). Without an up-to-date entry, you will be ineligible for new contracts that require CMMC.
- Address Compliance Gaps: For Levels 2 and 3, the final rule permits a conditional certification. You can use a Plan of Action & Milestones (POA&M) to fix any deficiencies. This is just a temporary solution. To achieve full certification, you must complete the necessary security practices.
- Check Your Supply Chain: Prime contractors must make sure all subcontractors dealing with sensitive data meet the needed CMMC level. The CMMC clause must be “flowed down” to every tier of the supply chain.
Has CMMC Been Finalized?
Yes. CMMC is no longer a proposed framework. The CMMC final rule was published in the Federal Register on Oct. 15, 2024.
On September 10, 2025, the 48 CFR CMMC rule was published in the Federal Register. On November 10, 2025, the rule officially goes into effect. From that day forward, some level of CMMC will be included in all DoD solicitations and contracts as a condition of contract award.
Is CMMC Only for DoD?
While the CMMC was designed specifically for the U.S. Department of Defense, the model’s champion has said that other federal agencies are also considering CMMC implementation. Regardless of the CMMC timeline, it is clearly a strong set of security standards designed to ensure both accountability and resilience to cyber threats and could be applicable to numerous agencies and businesses.
What Companies Need CMMC Compliance?
The Cybersecurity Maturity Model Certification program is a strong form of CMMC compliance designed for any company, contractor, or subcontractor that will “process, store, or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on unclassified contractor information system.” CMMC compliance is a must for companies working with the DoD while broader SaaS compliance is critical for businesses and organizations across industries.
There are limited exemptions for contracts exclusively for commercially available off-the-shelf items or for those below the DoD’s micro-purchase threshold of $10,000.
What is an RPO?
RPO stands for Registered Practitioner Organization. This organization offers cybersecurity consulting and advisory services to defense contractors. They help these contractors get ready for CMMC. The Cyber Accreditation Body (Cyber-AB) authorizes RPOs to provide these services.
The key thing to understand is that RPOs cannot perform a CMMC assessment or issue a certification. Their role is to help an organization get ready for the assessment, not to conduct it.
What is the difference between an RPO and C3PAO?
An RPO and a C3PAO serve very distinct roles in the CMMC ecosystem.
- RPO (Registered Practitioner Organization): Provides advisory and preparation services. They help a company conduct a gap analysis, develop a System Security Plan (SSP), and put in place the security practices needed for a CMMC assessment.
- C3PAO (Certified Third-Party Assessment Organization): Performs the official, independent CMMC assessment. A C3PAO is the only entity that can verify that a company meets the CMMC requirements and issues a certification.
The separation of these roles is intentional to prevent conflicts of interest. An organization that helps a company improve its security posture (RPO) can’t be the same one that assesses its compliance (C3PAO).
Why is an RPO needed for CMMC?
Defense contractors face significant challenges in navigating the complexities of CMMC compliance. While a do-it-yourself approach might seem appealing, partnering with a RPO offers distinct advantages in preparing for a CMMC audit with a C3PAO.
Challenges of DIY CMMC
Undertaking CMMC preparation internally often leads to:
- Lack of Expertise: CMMC requirements are extensive and nuanced. Internal teams may lack the specialized knowledge and experience to accurately interpret and implement all controls.
- Resource Strain: The time and effort required for CMMC readiness can divert valuable internal resources from core business operations.
- Risk of Non-Compliance: Misinterpretations or incomplete implementations can result in audit failures, leading to delays in contract awards and potential loss of business.
- Limited Objectivity: An internal perspective may miss critical gaps or areas of non-compliance due to familiarity bias.
Benefits of an RPO Partnership
An RPO brings a wealth of expertise and a structured approach to CMMC preparation, ensuring a smoother audit process and higher likelihood of success. Key benefits include:
- Specialized Expertise: RPOs employ cybersecurity professionals with deep knowledge of CMMC, enabling them to provide accurate guidance and implement the necessary controls.
- Streamlined Processes: RPOs have established methodologies and tools to efficiently assess an organization’s current cybersecurity posture, identify gaps, and implement corrective actions.
- Reduced Burden on Internal Teams: By outsourcing CMMC preparation, defense contractors can free up their internal teams to focus on their primary responsibilities.
- Objective Assessment: An RPO provides an unbiased evaluation of an organization’s readiness, identifying weaknesses that might be overlooked internally.
- Audit Confidence: With an RPO’s guidance, organizations can approach their CMMC audit with a C3PAO with greater confidence, knowing they have met the stringent requirements.
- Cost-Effectiveness: While there’s an upfront investment, partnering with an RPO can prevent costly audit failures, delays, and potential loss of contracts in the long run.
- Continuous Improvement: Many RPOs offer ongoing support, helping organizations maintain compliance and adapt to evolving CMMC requirements.
How to choose the right RPO?
Selecting the right RPO is crucial for successful CMMC preparation. Consider the following factors:
- Accreditation and Certification: Ensure the RPO is officially recognized and accredited by the Cyber AB.
- Experience and Expertise: Look for RPOs with a proven track record in CMMC compliance and a deep understanding of the DIB’s unique cybersecurity challenges.
- Methodology and Tools: Evaluate their approach to CMMC readiness, including their assessment processes, implementation strategies, and the tools they utilize.
- Client Testimonials and References: Seek feedback from other companies who have worked with the RPO to gauge their effectiveness and client satisfaction.
- Communication and Collaboration: Choose an RPO that prioritizes clear communication, transparency, and a collaborative working relationship.
- Cost and Value: While cost is a factor, prioritize value over the lowest price. A reputable RPO can prevent costly compliance failures in the long run.
Why Choose Trava Security as Your RPO
Trava Security stands out as an ideal RPO partner for CMMC compliance due to several key differentiators:
- Deep CMMC Expertise: Trava’s team comprises seasoned cybersecurity professionals with extensive knowledge of CMMC requirements and the intricacies of the DoD ecosystem.
- Proven Methodology: Trava utilizes a structured and efficient methodology for CMMC readiness, from initial assessment to control implementation and audit preparation.
- Proactive Approach: Trava goes beyond just meeting compliance checkboxes. They focus on building a sustainable cybersecurity posture that protects your organization long-term.
- Dedicated Support: Trava provides personalized support and guidance throughout the entire CMMC journey, ensuring you’re always informed and confident in your compliance efforts.
- Cost-Effective Solutions: Trava offers competitive pricing models that provide significant value, helping you achieve CMMC compliance without compromising your budget.
- Focus on the DIB: Trava understands the specific needs and challenges of defense contractors, offering tailored solutions that address the unique requirements of the DIB.
Learn more about Trava’s CMMC Compliance service.
Upgrade Your Cybersecurity Posture With Trava Security
CMMC compliance and SaaS compliance are hot topics for a reason: Data privacy matters now more than ever. Cybersecurity attacks and challenges are more prevalent than ever. Cybersecurity and compliance are needed now more than ever. Fortunately, there are also more resources for small- and medium-sized businesses looking to enhance or manage both new and existing cybersecurity programs and initiatives.
Trava Security offers elite compliance and cybersecurity services designed for growth companies, including compliance as a service, compliance readiness, penetration testing, cybersecurity due diligence, vulnerability assessments, and more. Whether you are looking to contract with the U.S. Department of Defense or simply want to upgrade your cybersecurity and compliance programs and services, we can help you achieve compliance and certification.
CMMC Compliance FAQ
Is CMMC required now?
Yes. As of November 10, 2025, CMMC (Cybersecurity Maturity Model Certification) will be a contractual requirement in new Department of Defense (DoD) solicitations and contracts. Full rollout will continue through 2028.
Who needs CMMC certification?
Any contractor or subcontractor that processes, stores, or transmits Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) for the DoD must be CMMC compliant. The only exceptions are contracts for commercially available off-the-shelf (COTS) items and purchases under $10,000.
What are the CMMC levels?
CMMC has three levels:
- Level 1 (Foundational): Basic cybersecurity practices, annual self-assessment.
- Level 2 (Advanced): 110 NIST SP 800-171 practices, mix of self-assessments and third-party assessments.
- Level 3 (Expert): Highest level, government-led assessments, includes NIST SP 800-172 practices.
What happens if my company is not CMMC compliant?
Without the required CMMC certification, your company will be ineligible for new DoD contracts that include cybersecurity requirements. Compliance is also required throughout the supply chain.
How can a Registered Practitioner Organization (RPO) help with CMMC?
An RPO can’t issue certification but can prepare your organization by identifying compliance gaps, building a security plan, and guiding you through audit readiness — increasing your chances of passing the official CMMC assessment.
Is there a resource available for CMMC updates?
For more information on CMMC, including a list of RPO and C3PAO providers, visit the Cyber AB website at https://cyberab.org/.