Timeline

CMMC requirements are being phased into contracts over time. The 32 CFR Part 170 final rule became effective on December 16, 2024.

Phase-In

CMMC requirements will appear in new contract solicitations progressively. The DoD has stated it will begin including CMMC requirements in select contracts, ramping up over time.

Key dates to track:

• 32 CFR Part 170 — Final rule effective December 16, 2024
• 48 CFR (DFARS) — The acquisition rule that puts CMMC into contracts. When this is finalized, CMMC requirements will start appearing in solicitations.
• Phase-in period — The DoD plans a phased rollout, starting with self-assessment requirements and progressively requiring C3PAO certification assessments.

Check Current Status

The enforcement timeline has shifted multiple times. Before making compliance investment decisions, verify the current status of the 48 CFR DFARS rule and any DoD guidance on phase-in timing.

What This Means for Planning

Don’t wait for the DFARS rule to start preparing. The 110 requirements are already contractually required under DFARS 252.204-7012 and DFARS 252.204-7020. CMMC adds the verification mechanism — it doesn’t change what you need to do, it changes how you prove you did it.

Companies already reporting SPRS scores against NIST 800-171 Rev 2 are doing the same work CMMC will assess. The difference is that a C3PAO will now verify it independently.