Home - Blank Rome LLP

Register to receive insights and analyses on breaking news and trends across varying industries.
<a class="link-primary mt-4" href="/subscribe">Subscribe</a>

Philadelphia, PA

New York, NY

Wilmington, DE

Cincinnati, OH

Princeton, NJ

Los Angeles, CA

Houston, TX

Tampa, FL

Shanghai

South Florida

Pittsburgh, PA

Washington, D.C.

Chicago, IL

Orange County, CA

Dallas, TX

Boston, MA

After years of drafts and interim measures, the Department of Defense (“DOD”) has issued the&nbsp;<a href="https://www.govinfo.gov/content/pkg/FR-2025-09-10/pdf/2025-17359.pdf">final Defense Federal Acquisition Regulation Supplement (“DFARS”) rule</a>&nbsp;implementing the Cybersecurity Maturity Model Certification (“CMMC”) program. This long-awaited development cements CMMC as a contractual requirement and clarifies key aspects of the rule’s certification, compliance, and oversight requirements.

core/paragraph

core/heading

Under the final rule, every solicitation where a contractor may store, process, or transmit Federal Contract Information (“FCI”) or controlled unclassified information (“CUI”) will be assigned a CMMC level. Solicitations involving just FCI will have a CMMC Level 1 requirement. Solicitations involving non-Defense CUI will have a CUI Level 2 Self-Attestation requirement. Solicitations involving Defense CUI will have a CUI Level 2 third-party certification (i.e., C3PAO) requirement. Solicitations involving particularly sensitive DOD programs will have a Level 3 requirement. Level 3 requires an assessment by the Defense Industrial Base Cybersecurity Assessment Center.

To read the full post, visit our&nbsp;<a href="https://governmentcontractsnavigator.com/2025/09/10/this-is-not-a-drill-department-of-defense-issues-long-awaited-final-cmmc-dfars-rule/">Government Contracts Navigator</a>&nbsp;blog.

Cybersecurity

ADG Cybersecurity & Data Privacy

Michael J. Montalbano

Government Contracts

Blog Post

Publications

This Is Not a Drill: Department of Defense Issues Long-Awaited Final CMMC DFARS Rule

This Is Not a Drill: Department of Defense Issues Long-Awaited Final CMMC DFARS Rule

Offices

Stay Connected

Slide Menu

Slide Search

This Is Not a Drill: Department of Defense Issues Long-Awaited Final CMMC DFARS Rule

Offices

Stay Connected