The Department of Defense began the phased rollout of the Cybersecurity Maturity Model Certification, or CMMC, program today, Nov. 10, marking the end of its voluntary phase, MeriTalk reported Thursday.
The CMMC program is one of the DOD’s key measures to protect sensitive information from cyberattacks and data breaches. Discover other initiatives addressing growing cyber threats and challenges at the Potomac Officers Club’s 2026 Cyber Summit, scheduled for May 21.
What Is the Cybersecurity Maturity Model Certification Rule?
The CMMC rule, formally published in the Federal Register in September, amends the Defense Federal Acquisition Regulation Supplement and introduces mandatory cybersecurity standards for defense contractors. The program was revised in 2021 as CMMC 2.0, reducing complexity and assessment levels.
The DOD’s Office of Small Business Programs launched a pulse survey to gauge contractor readiness and gather input on compliance challenges. Despite industry concerns, particularly from small businesses, CMMC compliance is now mandatory for defense contractors managing sensitive data.
What Are the Three CMMC Certification Levels?
CMMC comprises three certification tiers, each aligned with the sensitivity of government data. Level one requires 15 basic safeguards for federal contract information. Level two mandtes all 110 National Institute of Standards and Technology Special Publication 800-171 controls for protecting controlled unclassified information. Level three adds enhanced NIST SP 800-172 measures to defend against advanced threats.
What Are the Four Phases of DOD’s CMMC Implementation?
The DOD plans to roll out the program in four phases over a three-year period. Phase one (the current phase) requires contractors to complete level one or two self-assessments for eligible solicitations. Phase two will mandate level two certifications, while phase three will focus on level three certifications. Phase four will require all applicable CMMC standards for contract awards. During phases two and three, the department may allow certification delays until an option period.
