The wait is over. The Department of Defense has taken the decisive step that contractors have been anticipating: the CMMC Final Rule under 48 CFR has successfully cleared regulatory review. With this milestone, the last barrier to embedding CMMC directly into defense contracts has been removed. That means the appearance of CMMC requirements in solicitations is now just weeks away, not years down the road. 

What the 48 CFR Rule Changes

For the last year, CMMC has existed as a policy framework under 32 CFR Part 170, defining program levels, waiver rules, and assessment requirements. But policy alone doesn’t make compliance enforceable. 

That authority comes from 48 CFR, which updates multiple parts of the Defense Federal Acquisition Regulation Supplement (DFARS) to give contracting officers the green light to write CMMC requirements into federal solicitations and awards. 

With this rule finalized, CMMC shifts from guidance to a hard requirement for contractors across the Defense Industrial Base. In fact, according to the CMMC, “Contract officers will begin including certification requirements as soon as it goes into effect, starting with self-assessments and some Level 2 third-party assessments”. Source

Here’s What Happens Next 

• Federal Register Publication: The final rule will be published within about a week. 
• Effective Date: Publication will specify an effective date, anywhere from 0 to 60 days later. 
• First Solicitations: Most likely, CMMC requirements will appear in contracts by late October 2025. Even in the most conservative scenario, they will show up no later than early 2026. 

What Contractors Should Do Now

If you’re part of the defense supply chain, preparation can’t wait. Contractors should: 

• Revisit your SSPs, POA&Ms, and objective evidence to ensure they’re accurate and audit-ready.
• Map your practices to CMMC levels (especially NIST SP 800-171 for Level 2).
• Engage your subcontractors — primes will be held accountable for supply chain readiness.
• Budget and plan for a C3PAO-led third-party assessment if required. 

Competitive Advantage for Early Movers

CMMC is about compliance and credibility. Contractors that achieve certification early will: 

• Be eligible for more DoD opportunities. 
• Gain trust from primes and program officers.
• Avoid costly delays when solicitations mandate certification. 

Final Thought

With the 48 CFR Final Rule through review and awaiting Federal Register publication, CMMC is imminent. Defense contractors who act now by aligning controls, preparing documentation, and validating their supply chain will be ready to compete. Those who wait may find themselves locked out. 

The countdown to CMMC in contracts has started. Is your organization ready?