The Department of Defense’s CMMC 48 CFR final rule has cleared regulatory review, the final hurdle before publication in the Federal Register. Once published, CMMC Phase 1 will officially begin, and CMMC requirements will appear in Department of Defense solicitations and contracts.
This milestone is more than procedural. It marks the transition from anticipation to implementation, where certification will determine eligibility to compete in the defense marketplace.
Clearing review does not yet make the rule effective, but it does signal certainty. CMMC will move forward. Once publication occurs, contracting officers will have explicit authority to include CMMC requirements in both solicitations and awarded contracts.
For the defense industrial base (DIB), this means:
This milestone is where the distinct but complementary roles of Coalfire and Coalfire Federal come into sharp relief:
Coalfire (Advisory): Helps contractors prepare for certification with readiness services, gap analysis, and compliance program support. Learn more about Coalfire’s CMMC advisory services.
Coalfire Federal (Assessment): As an accredited C3PAO, conducts impartial third-party assessments required under CMMC. Coalfire Federal does not assess Coalfire advisory clients, ensuring full compliance with impartiality requirements. Explore Coalfire Federal’s CMMC assessment services
By keeping advisory and assessment functions separate, Coalfire and Coalfire Federal together provide the defense industrial base with clarity, capacity, and trust during this critical transition.
With the CMMC final rule now cleared for publication, the path is set for Phase 1 and for CMMC requirements to appear in contracts. Contractors face an inflection point: eligibility to compete for defense contracts will soon depend on certification.
CMMC is no longer a future consideration. It is becoming a present requirement.
CMMC certification will soon determine eligibility in the defense marketplace. Whether you are preparing your program or ready to certify, now is the time to act. Whether you are just beginning your journey or ready for certification, we can help. Reach out to talk to an expert today.
The Department of Defense’s final rule for CMMC, published under 48 CFR, confirms that CMMC requirements will now appear in DoD solicitations and contracts. Once effective, contracting officers will have the authority to include CMMC clauses, making certification a condition for eligibility. Learn more about the CMMC final rule and its impact on contractors.
CMMC Phase 1 begins once the final rule is published in the Federal Register. From that point, contracting officers can include CMMC language in solicitations and awards. Contractors handling Controlled Unclassified Information (CUI) should expect CMMC Level 2 certification to be mandatory for most new contracts. Read about preparing for CMMC Phase 1 certification readiness.
CMMC requirements apply to the entire supply chain. Prime contractors are responsible for ensuring their subcontractors meet the required CMMC level. This flow-down requirement means all subcontractors that handle Federal Contract Information (FCI) or CUI must comply. See how Coalfire Federal supports CMMC certification across all supply chain tiers.
Assessment capacity is limited, and the number of accredited C3PAOs is small. Contractors that have not yet begun readiness planning may face scheduling delays as demand increases. Organizations that start early gain a competitive advantage and avoid bottlenecks.
CMMC Phase 1 begins on November 10, 2025, allowing contracting officers to include CMMC language in select solicitations. During this phase, contractors must complete Level 1 or Level 2 self-assessments to qualify for eligibility.
Phase 2 (Nov 2026–Nov 2027) will require third-party Level 2 certifications for applicable contracts. Phases 3 and 4 introduce Level 3 oversight, with full adoption expected by November 2028. Each phase increases certification rigor and expands the number of contracts that require compliance. Learn more about the CMMC phases here.
