The Cybersecurity Maturity Model Certification programme (32 CFR Part 170) is being written into DoD solicitations and contracts in four annual phases. Phase 1 began on 10 November 2025, when the DFARS acquisition rule took effect, and Phase 2 begins one year later, adding third-party (C3PAO) Level 2 certification as a condition of award.
- Status
- Phasing in
- Jurisdiction
- United States
- Area
- Cyber
- Last reviewed at source
- 28 Oct 2026
Subscriber section
What this means for contracts and financings, in 3 points for in-house teams, lenders and buyers, is free with a work email, along with the full tools and guides.
Unlock the analysis
Free. Work emails only. Unsubscribe at any time.
Official documents
- 10 Sep 2025 Final rule: DFARS Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041), effective 10 November 2025 Federal Register
- 15 Oct 2024 32 CFR Part 170: CMMC Program eCFR
Dates
- 10 Nov 2026 CMMC Phase 2 begins: Level 2 (C3PAO) certification for applicable DoD contracts
- 10 Nov 2027 CMMC Phase 3 begins
- 10 Nov 2028 CMMC Phase 4 (full implementation) begins
Add these dates to your calendar
General information as at the review date, not legal advice. Each document links to its official source.