CMMC

Cybersecurity Maturity Model Certification · US Department of Defense (DoD) · Official site

US DoD framework requiring defense contractors to achieve cybersecurity maturity certification as a prerequisite for federal contracts. The program rule (32 CFR 170) took effect December 2024 and the DFARS contract clause began phasing in from November 2025; Phase 2 (third-party assessment) was suspended in July 2026 pending policy review.

Timeline

No changes recorded yet.

Sources we monitor

• Federal Register — CMMC (32 CFR 170) checked 5 hours, 58 minutes ago
• eCFR — 32 CFR 170, section versions checked 6 hours, 44 minutes ago