After years of waiting, the U.S. Department of Defense (DoD) posted to the Federal Register for public inspection on Sept. 9, 2025, a final rule implementing the Cybersecurity Maturity Model Certification 2.0 (CMMC 2.0) standards into the Defense Federal Acquisition Regulation Supplement, formally published on Sept. 10, 2025. CMMC 2.0 is a fundamental shift in how the DoD approaches and implements cybersecurity requirements for controlled defense information.

The requirements are effective Nov. 10, 2025, and pertain to all DoD contractors and subcontractors. Defense contractors should ensure compliance with the standards as soon as possible to maintain eligibility to compete for DoD contracts and perform subcontracts, as well as avoid bid protests and/or civil False Claims Act allegations.

Read on to learn more about the final rule and its implications.