Watch the Deep Dive of this post
The CMMC Final Rule is Here: Cybersecurity Verification Becomes Contract Eligibility
The landscape of defense contracting has fundamentally shifted. The final rule implementing the Cybersecurity Maturity Model Certification (CMMC) program into the Defense Federal Acquisition Regulation Supplement (DFARS) is the most significant restructuring of cybersecurity obligations in the defense industrial base to date. It took effect on November 10, transforming cybersecurity from a mere technical concern into a core compliance and legal requirement.
For virtually all companies that create, receive, process, or store Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), CMMC is now a binding contract requirement. Cybersecurity assurance is no longer considered just a best practice; it is a legal condition of participating in the defense marketplace, directly tied to contracting rights and award eligibility. By the time it is fully phased in, the new rule is expected to affect over 300,000 contractors.
Eligibility is Now Verification
CMMC certification is now a prerequisite for contract eligibility. Contractors must meet four primary obligations, demonstrating compliance before award and maintaining it throughout the contract performance.
- Reporting: Contractors must enter their current CMMC status for each unique identifier (UID) into the Supplier Performance Risk System (SPRS).
- Continuous Compliance: The required CMMC level must be maintained for the entire life of the contract.
- Identification: The CMMC UID for each covered information system must be provided to the contracting officer.
- Affirmation: An annual affirmation of continuous compliance must be maintained for each CMMC UID.
An offeror will be ineligible for award, whether a contract, task order, or delivery order, if they do not have a current CMMC status entered in SPRS at the required level and a current affirmation of continuous compliance in SPRS. This applies to every system that processes, stores, or transmits FCI or CUI during the performance of the award.
Understanding the CMMC Levels
The final DFARS rule operationalizes this framework, requiring different assessment levels based on the sensitivity of the information handled. The technical requirements are drawn from underlying National Institute of Standards and Technology (NIST) frameworks.
- CMMC Level 1: This baseline level requires contractors to implement 15 basic safeguarding practices. It mandates an annual self-assessment with results entered into SPRS.
- CMMC Level 2: This level incorporates the full set of 110 NIST SP 800-171 controls, which address issues like physical protection, access control, and system integrity. It requires a third-party assessment (C3PAO) every three years for certain acquisitions, or a self-assessment every three years for select programs.
- CMMC Level 3: Applying to contractors handling the most sensitive CUI, this level requires 134 controls derived from both NIST SP 800-171 and NIST SP 800-172. This level requires a Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) certification assessment every three years.
The Rise of False Claims Act Risk
The requirement for frequent and explicit representations to the government—through SPRS postings and annual affirmations—significantly heightens legal risk under the False Claims Act (FCA).
The rule requires an “affirming official” to submit an annual certification of continued compliance. Because these postings and affirmations are affirmative claims made to the government, if they are found to be false, incomplete, or misleading, they may be actionable under the FCA, particularly given the Department of Justice’s Civil Cyber-Fraud Initiative.
Immediate Steps for Contractors
Although the US government anticipates a three-year phased rollout, preparation should begin now. By Year Four, every new solicitation involving FCI or CUI will require at least a Level 1 self-assessment.
Contractors should immediately begin by determining the appropriate CMMC level for the information their systems handle, especially if it qualifies as CUI. Mapping systems accurately and documenting how information flows through the organization and to subcontractors is essential.
Prime contractors carry additional responsibility: they must ensure subcontractor compliance at the appropriate CMMC level before awarding a subcontract. Since the Department of War does not have a centralized tool for sharing subcontractor CMMC status electronically, primes must work directly with their suppliers for verification.
Ultimately, contractors must develop a robust documentation system, integrate internal audits around annual affirmations, and educate their affirming officials, who will need clear visibility into how continuous compliance is maintained. The decisive shift in cybersecurity management across the defense industrial base demands early attention from every contractor.
CMMC, Cybersecurity, Defense Contractors, DFARS, Compliance, Controlled Unclassified Information, SPRS, False Claims Act, NIST, Third-Party Assessment, Contract Eligibility, marketus