As of November 10, 2025, the DFARS 48 CFR final rule is officially in effect, launching the phased rollout of CMMC 2.0 requirements through 2028. If your organization handles Controlled Unclassified Information (CUI), you are now expected to meet Level 2 compliance, which includes implementing all 110 controls from NIST SP 800‑171.
Where We Are Today
We are in Phase 1 (Nov 2025–Nov 2026) of the rollout. This means:
- Level 1 self-assessment is required for contracts involving Federal Contract Information (FCI).
- Level 2 self-assessment is required for contracts involving CUI.
- Some solicitations may already require third-party (C3PAO) assessments for Level 2.
The clock is ticking—DoD is enforcing these requirements now, and compliance will only get stricter in the coming phases.
Why Level 2 Matters
Any organization that processes, stores, or transmits CUI must meet Level 2 requirements. These 110 NIST controls cover access control, encryption, incident response, and more—ensuring robust protection against cyber threats and safeguarding your eligibility for DoD contracts.
Immediate Action Steps
- Conduct a Gap Analysis: Identify systems handling CUI and compare against NIST 800‑171.
- Implement Controls: Deploy technical and procedural safeguards; maintain SSP and POA&M documentation.
- Prepare for Third-Party Assessments: Demand for C3PAOs will surge—early preparation is critical.
- Ensure Supply Chain Compliance: Primes must verify subcontractor readiness.
Why Act Before 2026
Compliance is not optional—failure to meet CMMC requirements will disqualify you from DoD contracts. Early adoption reduces risk and positions your organization competitively as enforcement ramps up.
Need Help?
Navigating CMMC 2.0 and DFARS compliance can be complex. Mainstream Technologies, a highly credentialed cybersecurity firm based in Arkansas, specializes in guiding defense suppliers through NIST 800‑171 implementation and CMMC certification.
Contact Mainstream Technologies Today – Ensure you’re ready for current enforcement and the stricter phases ahead.