CMMC 2.0 Updates – April 2025

CMMC 2.0 Updates – April 2025: What Defense Contractors Need to Know

CMMC 2.0 Updates – April 2025

Cybersecurity Maturity Model Certification (CMMC) 2.0 is entering a pivotal stage in 2025. After years of development and revisions, the Department of Defense’s framework for securing the Defense Industrial Base is finally rolling out. As of April 2025, several new updates and clarifications have emerged – from official DoD timelines and Cyber AB guidance to industry readiness trends and support for small businesses. Defense contractors and advisors must stay informed on these developments to ensure compliance and maintain eligibility for contracts.

In this article, we provide a comprehensive overview of the latest CMMC 2.0 updates as of April 2025, including new DoD announcements, the status of the phased rollout, changes in certification processes, practical implications of the final rule, and resources available (such as proposed tax credits) to help especially small businesses with compliance. Short, digestible sections and bullet points are used to highlight key points for busy professionals.

Latest DoD and Cyber AB Announcements (April 2025)

The DoD and the Cybersecurity Accreditation Body (the Cyber AB) have recently reinforced that CMMC 2.0 is moving forward on schedule. In early 2025, DoD officials completed the Congressional review of the CMMC program rule, meaning the program is officially in effect​. However, CMMC requirements won’t start appearing in contracts until the Defense Federal Acquisition Regulation Supplement (DFARS) rule (Title 48 CFR) is finalized, which is expected by mid-2025​​. Once that second rule is effective, CMMC clauses will begin to appear in Department of Defense solicitations and contracts, kicking off a phased three-year implementation​

(detailed in the next section).

Importantly, DoD leadership has clarified the requirements for each CMMC level in the final rule. Depending on the sensitivity of information, contractors will need to meet one of three levels of cybersecurity maturity​

  • Level 1 (Foundational) – Basic safeguarding for Federal Contract Information (FCI). Self-assessment will be sufficient at Level 1​. Companies handling only FCI must implement 17 basic practices (per FAR 52.204-21) and annually affirm compliance.
  • Level 2 (Advanced) – Protection of Controlled Unclassified Information (CUI) aligned to NIST SP 800-171 (110 security controls). Third-party assessments by a CMMC C3PAO will eventually be required for most Level 2 situations​. However, the final rule allows some flexibility: during the initial phase, contractors can self-assess and affirm Level 2 compliance for new contracts​. Full third-party certification for Level 2 will be phased in over time (more on the timeline below).
  • Level 3 (Expert) – Very high security for the most sensitive CUI (aligned to NIST SP 800-172 enhanced controls). These assessments will be government-led (e.g. by the Defense Industrial Base Cybersecurity Assessment Center, DIBCAC) for the few programs that require Level 3​. Level 3 will come into play in later phases of the rollout.

Along with level requirements, the DoD has issued clarifications to reduce confusion and burden. For example, the final CMMC rule narrowed the assessment scope for “Security Protection Assets” (SPAs) – systems that provide security functions (like monitoring or threat detection tools). Under the proposed rule these had to meet all 110 controls, but the final rule now limits assessments of SPAs to only the relevant requirements, so contractors no longer must show non-applicable controls for those assets​. This change reduces unnecessary work while still verifying critical protections are in place.

Another clarification addresses external providers. If an external cloud or IT service provider handles CUI on your behalf, that provider is considered in-scope for CMMC. The rule states that any External Service Provider (ESP) that can see or handle CUI must itself meet CMMC Level 2 requirements and obtain a CMMC assessment or certification. Providers that only handle security data (like logs or configurations, termed “Security Protection Data”) have a more limited assessment scope and do not need full Level 2 certification​. And purely out-of-scope providers (no access to CUI or security data) are exempt. This clarification means contractors need to ensure that their MSPs, MSSPs, or cloud hosts are compliant – e.g. a cloud service hosting CUI must meet FedRAMP Moderate-equivalent security​.

On the Cyber AB side, updates have focused on enabling the CMMC ecosystem to start official assessments. The Cyber AB (the accreditation body managing CMMC implementation) announced that the CMMC Assessment Process (CAP) guide is now available and in effect​

. This guide standardizes how third-party assessments must be conducted, ensuring consistency across C3PAOs. The Cyber AB also updated its Code of Professional Conduct for CMMC professionals, version 2.0, which is now in force​. These steps were done in preparation for the “go live” of voluntary assessments. In fact, as of January 2025, authorized C3PAOs have been allowed to perform voluntary CMMC Level 2 assessments for contractors that are ready. The Cyber AB had pre-authorized a number of C3PAOs under the old program, and those firms went through a re-authorization for CMMC 2.0 by the effective date of the rule (Jan 2, 2025)​. Consequently, the first official CMMC assessments began in early 2025 once these C3PAOs were live.

It’s worth noting that CMMC is fully backed by DoD leadership in 2025. A recent town hall highlighted a “renewed and strengthened commitment” to CMMC implementation within the DoD​. In fact, the Pentagon signaled that CMMC requirements would start appearing in Requests for Information (RFIs) by early Q2 2025 and in actual RFPs by summer 2025​– consistent with the expected mid-2025 DFARS rule timeline. The message is clear: CMMC 2.0 is here to stay and is rapidly moving from planning into execution.

Phased Rollout of CMMC 2.0 (2025–2028 Timeline)

To address concerns about a “big bang” implementation, the DoD is phasing CMMC requirements into contracts over several years. The final rule outlines a four-phase rollout (over roughly three years) so that contractors have time to adapt​​. Below is a summary of each phase and what it means:

  • Phase 1 – “CMMC Self-Assessment Phase” (Begins ~Early/Mid 2025): This phase starts once the DFARS (48 CFR Part 204) CMMC rule is finalized (expected by Q2 2025)​. In Phase 1, new DoD solicitations will include CMMC Level 1 or Level 2 requirements but only require a self-assessment and affirmation of compliance at those levels . In other words, companies don’t need a certification yet, but they must attest that they meet the required security controls for the level relevant to the contract. This effectively forces contractors to implement NIST SP 800-171 (for Level 2) and perform a self-assessment before bidding on new work. The DoD has indicated that CMMC self-assessments under this program will be more rigorous than the old DI​B self-assessments – they are based on the CMMC criteria rather than the old DoD scoring method, with a minimum score of 88/110 required to affirm compliance​. (For context, 110 represents all NIST 800-171 controls implemented; 88/110 corresponds to implementing about 80% of them, with Plans of Action & Milestones for the rest.) As of Feb 28, 2025, the Supplier Performance Risk System (SPRS) has been updated to accept CMMC Level 2 self-assessment entries​, which is where contractors will officially submit these self-attestations.
  • Phase 2 – “Third-Party Certification for Level 2” (Begins ~Early/Mid 2026): Approximately one year after Phase 1 starts, the DoD will begin requiring formal CMMC Level 2 certifications for new contracts containing CUI​. At this point, simply self-attesting to Level 2 will no longer be enough for those solicitations – you will need to have passed a C3PAO assessment and obtained a CMMC L2 certificate to bid. Contractors expecting to work on contracts with CUI in 2026 should plan to undergo a third-party CMMC assessment by early 2026 to remain eligible​. (Level 1 requirements, for contracts with only FCI, will continue to be self-assessment throughout CMMC 2.0.) This phase ramps up the demand for certified assessments across the Defense Industrial Base.
  • Phase 3 – “Apply to Contract Extensions + Introduce Level 3” (Begins ~Early/Mid 2027): One year after Phase 2, CMMC requirements tighten further. In Phase 3, the DoD will start requiring CMMC Level 2 certification not just for new contracts, but also as a condition to exercise options or extend existing contracts (if those contracts were awarded after CMMC requirements became effective)​. This ensures that by this time, even contracts awarded in 2025/2026 must get their contractors certified before continuing into option years. Additionally, CMMC Level 3 requirements will begin appearing in select solicitations for the highest sensitivity programs starting in Phase 3​. Only a very small number of contractors will need Level 3 (the Pentagon estimates “much fewer” companies at Level 3, as opposed to thousands at Level 2​), but Phase 3 marks the first time an Expert Level (L3) certification could be mandated in an RFP.
  • Phase 4 – “Full Implementation” (Begins ~Early/Mid 2028): One year after Phase 3, CMMC will reach full operational status. From this point onward (mid-2028), all new DoD contracts that involve CUI or FCI will include CMMC requirements​. Also, exercising any option or extending any contract (regardless of when it was awarded) will require the contractor to meet the stipulated CMMC level​. In short, by Phase 4 CMMC will be fully woven into DoD contracting – no eligible defense contract will be exempt. The DoD expects that by the end of 2027, CMMC requirements will be virtually universal, concluding the rollout​. This phased approach was deliberately designed to give contractors time to comply, especially smaller businesses, while still moving the needle on security. The entire rollout spans roughly 3 years (2025 to 2028). In fact, DoD officials estimate it may take up to 7 years for all active defense contracts to have CMMC in place, due to the staggered nature of contract awards and renewals​. The key takeaway is that CMMC is not a one-time deadline but a graduated ramp-up. We are currently (April 2025) on the cusp of Phase 1 – expecting the DFARS rule any week now – which means the era of “voluntary” compliance is ending. By summer 2025 many new RFPs will include at least a requirement to self-attest to CMMC controls​, and one year later third-party certifications will start to become mandatory for contract awards.

Tip: Even if a contract hasn’t yet mandated a CMMC certification, contractors should implement the required controls as soon as possible. The DoD emphasizes that NIST SP 800-171 compliance is already required today under existing regulations​, and many prime contractors are flowing down CMMC requirements to their subcontractors ahead of the rule. In other words, don’t wait until 2026 or 2027 to act – the phased rollout is meant to prevent disruption, but procrastinating could still cost you business in the near term.

Changes in the Certification Process and Requirements

CMMC 2.0 introduced several changes to simplify and clarify the certification process compared to the earlier (CMMC 1.0) model. Here are some of the key changes in requirements and processes that contractors should be aware of:

  • Streamlined Model – 3 Levels instead of 5: CMMC 1.0’s five levels have been collapsed into three tiers in CMMC 2.0 (Level 1 “Foundational”, Level 2 “Advanced”, Level 3 “Expert”). Levels 2 and 4 from the old model were eliminated​. This makes the model easier to understand and aligns it more directly with existing standards (Level 2 maps to NIST 800-171, and Level 3 adds on NIST 800-172 enhanced controls). The vast majority of defense contractors will fall under Level 1 or Level 2 – with Level 1 being basic safeguarding of FCI (17 controls) and Level 2 being the 110 controls for CUI. Only the most sensitive programs will demand Level 3 (and those requirements will be akin to advanced persistent threat countermeasures).
  • Self-Assessment vs Third-Party Certification: Under CMMC 2.0, Level 1 is self-assessment only, and even Level 2 allows for annual self-assessments in some cases (particularly during Phase 1 of rollout or for less critical contracts)​. This is a significant change from CMMC 1.0, which would have required third-party audits at multiple levels. The final rule explicitly permits self-assessments “when appropriate” for Level 2 in the initial rollout​, although eventually third-party certification will be the norm for Level 2. Self-assessments must follow CMMC criteria now, not just the DoD’s previous scoring methodology​. Organizations will need to affirm compliance annually for self-assessment levels (and, per DFARS 252.204-7020, may be subject to DoD spot-checks). For third-party assessments (Level 2 in later phases, and any Level 3), certification is valid for three years before a new assessment is required (similar to ISO certifications).
  • Allowance of Limited POA&Ms: CMMC 1.0 was going to require 100% of controls to be in place with no exceptions at assessment time. CMMC 2.0 introduces some flexibility: companies can still achieve certification even if they have a few remaining gaps, as long as those are documented in Plans of Action & Milestones (POA&Ms) and are not the most critical controls. The DoD has indicated a minimum score (e.g. 88/110 for Level 2) for certification with POA&Ms​. In practice, this means you could be missing up to ~22 of the NIST 800-171 controls at the time of the audit if those missing items are lower priority, you have firm plans to remediate them, and you meet the scoring threshold. However, only “limited circumstances” allow this – high-weight requirements like multifactor authentication or access controls likely cannot be on a POA&M​

No POA&M is allowed for Level 3 at assessment (given its critical nature). Bottom line: CMMC 2.0 is somewhat more forgiving, but contractors should still strive to close all security gaps; reliance on POA&Ms is only a short-term cushion.

No CMMC-Unique Controls – Alignment with NIST Standards: One complaint about CMMC 1.0 was that it added extra “CMMC unique” practices and maturity processes on top of NIST 800-171, which created new overhead. CMMC 2.0 eliminated those CMMC-unique controls and focuses on existing federal standards. Level 2 = all 110 controls of NIST SP 800-171 (which DoD contractors were already supposed to be following), and Level 3 = 800-171 plus a subset of NIST SP 800-172 advanced techniques. This streamlining means if you comply with NIST guidance, you’re essentially meeting CMMC. It also reduced the total number of items to assess (no more separate maturity processes). The DoD believes this alignment will “reduce the number of security practices assessed” while still improving security​

  • Official Assessment Process and Governance: As mentioned, the CMMC Assessment Process (CAP) guide is now the authoritative playbook for how C3PAOs must conduct assessments​. This includes steps for planning, scoping, evidence evaluation, and reporting results. For contractors, this means the audit experience should be standardized regardless of which C3PAO you use. The CAP also clarifies roles on an assessment team (Lead Assessor, assessors, etc.) and how findings are documented. The Cyber AB, through its CAICO arm, has also enforced that all assessors must be trained, certified, and background-checked before participating on official assessments​. (Assessors need to pass the Certified CMMC Professional or Assessor exams and undergo a Tier 3 background investigation for security eligibility​.) This ensures a professional and trustworthy assessment ecosystem. From the contractor perspective, expect your C3PAO team to consist of certified professionals (CCP) and certified assessors (CCA) who will request extensive evidence of your security practices. They will follow the CAP steps methodically, so there should be no surprises if you’ve prepared using the CMMC assessment guides.
  • Scope Boundary Clarifications: The final CMMC rule and accompanying guidance clarified what systems and assets fall in scope of an assessment. We touched on this earlier – for instance, Security Protection Assets (like your SIEM or security appliances) only need to meet relevant controls, not every control​. Also, enclave approaches are allowed: You can limit CUI to a defined environment and just get that enclave assessed, rather than your entire enterprise, as long as other networks don’t handle CUI. This is a common strategy to reduce scope (e.g., set up a separate CUI IT environment with higher security, while keeping corporate IT separate). The rule’s clarification on external/cloud providers means you also need to factor in those dependencies in your scope. If you use an MSP for IT support that will see CUI, that MSP needs to be ready to show its own compliance​. If you use cloud SaaS for CUI data, it should be FedRAMP Moderate or equivalent​. All these details help contractors determine the boundaries of what the C3PAO will examine, so you can properly prepare system security plans, network diagrams, and policies for just the in-scope assets.

CMMC 2.0 has made the path to certification a bit more flexible and clear. Companies should leverage these changes: for example, if you’re a small business, you might choose to implement a CUI enclave with only the necessary systems to make certification easier (a tactic many are pursuing). You should also conduct rigorous self-assessments using the official CMMC criteria as a dress rehearsal, addressing any shortfalls before engaging a C3PAO. And remember, the elimination of extra CMMC-unique requirements means if you are truly following NIST SP 800-171, you are well on your way to CMMC Level 2 – there aren’t hidden extras. The main difference will be proving it via an audit.

Industry Adaptation and Trends in April 2025

One quarter into 2025, how is the defense industry responding to CMMC 2.0? We’re seeing a mix of proactive early adopters and those still catching up. Here are some notable trends as of April:

  • Major Contractors Are Getting Ready Early: Large defense contractors and integrators are not waiting for the last minute. Many prime contractors and big suppliers have been positioning themselves to meet CMMC 2.0 requirements well ahead of enforcement​. They are investing in in-house cybersecurity improvements and even developing new service offerings for others. For instance, integrators and IT providers such as CDW-G are building CMMC advisory services and secure cloud enclave solutions that align with CMMC Level 2 requirements​. These “CMMC-ready” enclaves or managed services can be offered to subcontractors or customers to help them comply. Essentially, a segment of the industry is turning CMMC compliance into a market opportunity – by creating compliant environments and tools, they can reassure government clients and also sell these solutions downstream.
  • Assessments Have Begun (Voluntarily): Although CMMC is not yet mandatory in contracts, a number of organizations have already undergone voluntary third-party assessments in early 2025. Some companies wanted to be first out of the gate to achieve certification as a competitive differentiator. Notably, some external service providers themselves pursued CMMC assessments to prove their readiness​. For example, there were reports of cloud and SaaS vendors getting Level 2 assessed early so that they can advertise CMMC-compliant platforms to DIB customers. This early wave is partly a legacy of the “Joint Surveillance” program in 2022–2023, where Defense auditors and C3PAOs jointly assessed a few companies as a pilot. Those companies have now been able to convert those results into official CMMC certifications with minimal extra effort. The momentum is building – as soon as the Cyber AB authorized C3PAOs in January, those assessors have been ramping up capacity and signing contracts with DIB companies wanting audits. In fact, some government agencies (outside DoD) have even started asking for CMMC Level 2 certification or scheduled assessments as a condition for certain contracts​. This shows the market is treating CMMC seriously even before the DFARS mandate drops.

One example of early adoption: In March 2025, Xometry – a manufacturing marketplace company – announced it became one of the first to achieve CMMC Level 2 certification under the new framework. The company underwent a C3PAO audit and received a perfect score, demonstrating full compliance with all 110 security controls​. Achievements like this underscore that CMMC audits are no longer hypothetical – real companies are getting certified and gaining an edge in cybersecurity and contract readiness.

  • No Further Delays – “Phased” is the Extension: A common question in the industry was whether small businesses or anyone might get an extension or waiver as deadlines approach. The consensus from DoD is no – beyond the built-in phased rollout, no additional relief is expected​. The phased approach is the accommodation for small firms. Because Phase 1 allows self-attestations and true enforcement is delayed until Phase 2/3, DoD feels that’s sufficient to ease companies in. So, contractors should not bank on CMMC being postponed or watered down. One cybersecurity manager was quoted emphasizing that no further deadline extensions are anticipated and organizations must treat the current timeline as firm​. If anything, DoD is signaling urgency (e.g. by inserting requirements in RFIs already) to push companies to prepare sooner rather than later. In short, the clock is ticking now.
  • Small and Mid-Sized Suppliers Are Seeking Help: For many smaller defense contractors, building an internal CMMC capability is challenging. A trend in April 2025 is that a lot of SMBs in the DIB are turning to outside experts and MSPs for help​. Companies that lack dedicated IT security staff are engaging Registered Provider Organizations (RPOs) and consultants to perform gap assessments, write policies, and implement tools aligned to CMMC. There’s also a rise in usage of secure managed services (“CMMC-as-a-Service”) – for example, subscribing to a pre-hardened cloud enclave or outsourced IT environment that comes with most 800-171 controls in place​. This allows a small business to meet requirements without building everything from scratch. We are seeing “CMMC compliance packages” being offered that include documentation templates, security monitoring, and even pre-negotiated assessor engagements. While larger firms productize these services, the smallest contractors are also pooling resources – some industry groups and consortiums are facilitating shared compliance resources for their members.
  • Reality Check on Readiness: Despite the above efforts, the overall readiness of the DIB is still a concern. Studies show a gap between perception and reality in cybersecurity compliance. A late-2024 survey of 300 defense contractors found that over 75% believed they were compliant with DoD’s security requirements based on self-assessments, yet their average SPRS score was -12 out of 110​. (Under the DoD’s scoring method for 800-171, a perfect implementation yields 110, and certain missing controls incur heavy penalties, hence negative scores are possible.) This revealed that many companies overestimate their preparedness – they might think “we have this covered” but in formal scoring they fall woefully short. The main reason: self-assessments were often done informally or without rigorous checking of evidence​. With CMMC’s third-party validation coming, this complacency is being shattered. As audits begin, contractors are quickly discovering if they truly meet the requirements. The smart players are using the remaining time in 2025 to do thorough gap analyses (often by engaging professionals to do a mock CMMC audit) and remediate weaknesses. Common problem areas have been multi-factor authentication, incident response plans, and documentation of security processes – things that might have been skipped but will be scrutinized in an assessment.
  • Competitive Pressure from Prime Contractors: Another trend is pressure within the supply chain. Large primes (like Lockheed Martin, Raytheon, Leidos, etc.) that are ready for CMMC are pressuring their subcontractors to get ready as well. In some cases, primes are already mandating that subcontracts include NIST 800-171 or future CMMC compliance as a condition. A Leidos executive publicly stated that **cyber compliance “isn’t going away” and will be “a requirement to be able to bid on and continue to operate on contracts”, urging subs to act now​. We can expect primes to increasingly favor suppliers who have a CMMC certification (or at least can prove 800-171 compliance). Thus, getting certified early can be a market differentiator – it signals to primes that you’re low-risk and can be trusted with sensitive data. The Xometry example above is a case in point: by trumpeting their CMMC Level 2 certification, they position themselves as a secure partner for defense and aerospace projects.

The industry’s adaptation in April 2025 is in motion but uneven. The top tier of contractors are full steam ahead – many could likely pass a CMMC audit today. A middle tier is scrambling to catch up, leveraging outside help and allocating budget for compliance. And a bottom tier still lags, perhaps hoping this will blow over or struggling to find resources; these firms are at risk of being left behind when CMMC becomes a prerequisite. The next 6-12 months will be crucial – we will likely see a flurry of activity as thousands of contractors work to raise their cybersecurity to acceptable levels. The defense market is treating cybersecurity maturity as a differentiator now, not just an obligation, which is exactly the culture change DoD hoped for.

C3PAO Capacity and Assessor Developments (CAICO Updates)

One concern as CMMC rolls out is whether there will be enough authorized assessors to handle the demand. Early 2025 has seen significant progress on this front:

  • Growth in Authorized C3PAOs: The Cyber AB began authorizing Third-Party Assessment Organizations in late 2024 for the January 2025 launch. By that time, a small number of C3PAOs were fully ready to go (those that had been part of the earlier program and passed their own assessments). Since then, the Cyber AB has been approving more C3PAOs on a rolling basis. **Projections suggest the number of authorized C3PAOs will reach the “triple digits” (100 or more) by May 2025​. This is a rapid expansion, considering only a couple dozen were in the pipeline a year prior. An influx of new assessor organizations – including well-known cybersecurity firms and audit companies – should help meet the upcoming demand for certifications. The AB’s online Marketplace will list all authorized C3PAOs (as of Jan 2025 it began displaying those that achieved full authorization​). For contractors, this means more choice of assessment providers and presumably more competition (which could help moderate the cost of assessments).
  • Certified Assessors and Training: The Cyber AB’s training arm, the Cybersecurity Assessor and Instructor Certification Organization (CAICO), has been busy certifying individuals to perform CMMC audits. All CMMC assessment team members must now be formally certified (as a CMMC Professional or Assessor) and complete required training​. Over 2023–2024, CAICO rolled out the Certified CMMC Professional (CCP) and Certified CMMC Assessor (CCA) programs. By April 2025, a growing pool of assessors have passed the exams and met experience requirements. The Cyber AB has also instituted a Tier 3 security clearance requirement for assessors​, which has introduced some delays – recent guidance noted background checks for assessors are taking at least 6 months​. This means some assessor candidates are waiting for clearance adjudication before they can be fully active on teams. Nonetheless, the number of cleared, certified assessors is increasing steadily, and with many C3PAOs aiming to have multiple teams, the ecosystem is scaling up. The AB expects that by the time third-party certifications are required in contracts (2026), there will be ample assessor capacity.
  • Joint Surveillance Conversions: The DoD’s DIBCAC has helped augment capacity by performing “Joint Surveillance” assessments (voluntary assessments done jointly with C3PAOs as observers) for early adopters. Those joint assessments essentially gave C3PAOs on-the-job training. As of 2025, many of those C3PAOs are now fully authorized, and the companies they assessed under joint surveillance have been issued CMMC certificates without needing a re-audit. This was a one-time boost that allowed about 20 companies to get a head-start and helped test the assessment process. Going forward, all assessments will be purely by C3PAOs (DIBCAC will shift to its role of performing Level 3 audits and some spot-checks of Level 2 via DoD audits mandated by DFARS 7020).
  • Tools for Assessors (and OSCs): The assessment process is also being streamlined with tools. The CMMC eMASS module (Enterprise Mission Assurance Support Service) is one such tool being used internally to track assessments and results. C3PAOs and the DoD have defined templates for reporting and a Certificate of CMMC Status template was released​, so companies know what documentation they receive upon passing. The AB has cautioned companies not to misuse CMMC logos or “certification marks” in marketing until official guidance is given​– organizations should simply show their certificate as proof. For the defense contractors (referred to as OSCs – Organizations Seeking Certification), these developments mean the process is becoming more defined and consistent. You will get a formal certificate valid for 3 years, and the C3PAO will upload your status to the DoD’s database.

Assessor availability is expected to be an ongoing challenge in the near term, simply because tens of thousands of companies will need Level 2 certifications within the next 2-3 years. Even with 100+ C3PAOs, if each can do, say, 50 assessments a year, that might be 5,000 certifications per year capacity – which means a multi-year queue to get everyone certified. The DoD estimates around 8,350 medium and large companies will ultimately require CMMC Level 2 third-party certifications​ (and an even larger number of small companies handle CUI as well). Given this scale, contractors are advised to schedule their assessments as early as feasible once they are ready​. If you wait until an RFP drops to seek certification, you might find that assessors are booked up for months. By developing a relationship with a C3PAO and targeting a timeframe, you can secure a slot and avoid last-minute scrambles. It’s also wise to monitor the Cyber AB Marketplace for newly authorized C3PAOs – new entrants might have more availability.

One positive note: the increase to triple-digit C3PAOs suggests a healthy competitive market. Prices for assessments should theoretically become competitive. Some assessors might specialize (for example, some may focus on small manufacturers vs. large integrators, etc.). As a company seeking certification, you will be able to request quotes and timelines from multiple C3PAOs. The Cyber AB is also maintaining oversight – any complaints or inconsistent assessment results can be addressed through their quality assurance to ensure no assessor is too lax or too harsh. Ultimately, assessor capacity is ramping up in time for the wave of demand, but companies should still plan ahead to get in the queue.

Small Business Support and Resources

Achieving CMMC compliance can be resource-intensive – a fact not lost on policymakers. Small businesses (e.g. under 50 employees) often face the steepest hurdles, lacking dedicated IT security staff and budget. As of April 2025, there are a few initiatives and resources aimed at helping smaller defense contractors:

  • Proposed Tax Credit for CMMC Costs: Lawmakers have introduced the “Small Business Cybersecurity Act of 2024” which, if passed, would create a tax credit to offset CMMC compliance costs for the smallest contractors​. The draft bill, sponsored by Rep. Scott Fitzgerald, proposes allowing companies with 50 or fewer employees to claim up to $50,000 in tax credits for expenses related to cybersecurity improvements and CMMC assessments​. This credit could cover things like consulting support, tools, and the C3PAO audit fee. Essentially, it’s meant to reimburse up to half of an estimated $100k cost that a typical small business might incur to get to Level 2​. DoD officials, including CIO for Cybersecurity Stacy Bostjanick, have voiced support for this tax credit idea as a means to defray costs​. As of April 2025, the bill is still in draft form and unlikely to be enacted immediately (it may be rolled into broader tax legislation later)​. Nonetheless, its consideration is a sign that Congress and DoD recognize the cost burden on small firms. If it passes in the future, it could significantly ease the financial pain of compliance for mom-and-pop defense suppliers. Small businesses should keep an eye on this legislation in case it becomes available for tax year 2025 or 2026.
  • Allowable Costs and Reimbursement: Even without a tax credit, remember that cybersecurity costs for contract compliance are allowable expenses in DoD contracts. Under existing procurement rules, investments a contractor makes to meet security requirements (like CMMC) can often be wrapped into their overhead rates or even directly charged to contracts (with contracting officer approval). While not as straightforward as a tax credit, this means a portion of your compliance cost can be recouped in your contract pricing. Additionally, some DoD programs (e.g., the Defense Logistics Agency or DCMA initiatives) have on occasion provided grants or reimbursements for cybersecurity enhancements, particularly to small and mid-size companies in critical supply chains. It’s worth inquiring with your DoD customer or the Office of Small Business Programs if any such support is available for your sector.
  • Project Spectrum and Training Resources: The DoD’s Office of Small Business Programs (OSBP) runs Project Spectrum, which is a portal providing free cybersecurity tools, tutorials, and self-assessment guides for contractors​. Project Spectrum includes a CMMC Level 1 compliance guide, sample policies, and a tool called “CMMC Pathfinder” to help companies chart a path to compliance​. Small businesses new to CMMC should leverage these free resources as a starting point. Additionally, Procurement Technical Assistance Centers (PTACs) – recently rebranded as APEX Accelerators – around the country have been holding workshops and one-on-one consulting sessions on CMMC readiness. Industry associations (like NDIA chapters, AFCEA, etc.) have also been hosting webinars to educate companies on what CMMC requires. Many of these resources are low or no cost. Essentially, there is an ecosystem of information out there to help demystify CMMC for those who can’t afford high-priced consultants.
  • State and Local Initiatives: Some U.S. states have launched programs to assist local defense suppliers with cybersecurity. For example, states like Maryland have tax credit programs for cybersecurity purchases, and Virginia and Michigan have run grant-funded mentoring for CMMC compliance. Check if your state has a defense industry support office – they might offer free vulnerability assessments or training subsidies. While not national policy, these localized efforts can be a lifeline for small shops gearing up for CMMC.
  • Cyber Insurance and CMMC: An indirect form of support is coming from the cyber insurance industry. Insurers are increasingly aware of CMMC and in some cases, having a CMMC certification (or at least attesting to 800-171 controls) can favorably impact your cyber insurance premiums. Some insurance providers also offer risk engineering services – like free security scan tools or incident response training – which can help with CMMC preparation. While this isn’t a government resource, it’s worth noting as a benefit of compliance: achieving CMMC might lower your cyber risk profile, which in turn could reduce insurance costs or make it easier to get coverage.

Above all, small businesses should not be discouraged by CMMC 2.0’s demands. The framework was intentionally streamlined to be achievable by organizations of all sizes. Yes, there is a cost and effort, but the phased rollout and available resources give smaller contractors extra time and help. The DoD’s message has consistently been that they want all suppliers, large and small, to improve cybersecurity, and they are looking for ways to minimize barriers. The onus is on each company to take advantage of the help available (be it guidance, tax relief down the line, or using the flexibilities like POA&Ms for less critical items). In the long run, investing in cybersecurity will not only keep you eligible for contracts but also protect your business from the growing threats in the cyber realm – an outcome that is especially vital for small companies that might not survive a serious breach.

Practical Implications and Next Steps

With the CMMC 2.0 final rule in effect and requirements set to hit contracts imminently, what should defense contractors be doing now? Here are practical implications of these updates and some recommended next steps:

  • Treat CMMC as a Contract-Eligibility Requirement: CMMC compliance is moving from “good idea” to must-have for winning DoD contracts. The DoD has flatly stated that if you do not get certified, you will not be able to win DoD work going forward​. This means cybersecurity is now a go/no-go factor in procurements – similar to having the right quality certifications or financial controls. Companies should elevate CMMC preparation to the same priority as proposal development or product deliverables because without the certification, there may be no contract to perform. This is a shift in mindset: security compliance is now directly tied to revenue in the defense sector.
  • Mark Key Dates and Plan Backwards: Knowing the timeline is essential. If you plan to pursue DoD contracts in late 2025 or 2026 that involve CUI, you should target achieving CMMC Level 2 certification by mid-2025 to mid-2026 depending on the contract schedule. It can easily take 6-12 months of preparation to be ready for an assessment (for an average contractor) and then another few months to schedule and pass the audit​. So, work backwards from when you need the cert. For example, if you anticipate a big contract in Q4 2025 requiring CMMC, you’d want to be audit-ready by summer 2025. Build a compliance roadmap with milestones: policy updates, technical upgrades, employee training, mock audit, C3PAO engagement, etc. Use the phased rollout to your advantage – Phase 1 allows self-attestation, so aim to be compliant enough to self-attest asap, then pursue the formal certification in Phase 2.
  • Leverage Self-Assessments and SPRS Reporting Now: Even before the DFARS rule hits, many contractors already have a DFARS 252.204-7019 obligation to self-assess against NIST 800-171 and submit a score to SPRS. Take that seriously as a springboard into CMMC. As of Feb 2025, the SPRS system is updated for CMMC-style self-assessments​, which likely means you’ll affirm implementation of all controls or note POA&Ms. Make sure your SPRS score is honest and up-to-date. A high SPRS score (ideally 110) will both instill confidence in primes/DoD and reduce surprises in a CMMC audit. Companies should perform a gap analysis using the CMMC Assessment Guide or hire a CMMC Registered Practitioner to do an informal audit. Identify gaps and start closing them one by one. Document everything – CMMC assessors love to see well-organized documentation (System Security Plans, incident response plans, asset inventories, etc.).
  • Budget and Invest in Cybersecurity: The reality is that achieving CMMC compliance may require investment – in technology tools (for things like access control, encryption, log management), in possibly new hires or consultants, and in the assessment cost itself. Company leadership should budget for these expenses now, perhaps as part of FY25 internal budgets or indirect rates. Keep receipts and clear records of these costs, as they may be eligible for future tax credits or at least can be justified in your pricing proposals to DoD. Remember that investing in cybersecurity has intrinsic benefits too: you are strengthening your defenses against cyber incidents that could otherwise be devastating. Downtime, ransomware, or loss of intellectual property can be far more costly than the preventative measures.
  • Consider Shared Services or Enclaves: If you have limited IT resources, consider outsourcing some of the security functions or using secure enclaves as mentioned. For instance, if meeting all 110 controls in your current IT environment is too daunting, you could subscribe to a secure cloud environment specifically set up for CUI handling – numerous providers offer “CMMC compliant cloud” where much of the infrastructure controls are inherited. This can simplify your compliance (you’d then focus mainly on the procedural and user controls). Ensure however that any provider you choose will itself be CMMC compliant (per the external provider rules). Alternatively, segment your network so only a portion deals with CUI and secure that portion heavily. Strategies like these can reduce scope, cost, and timeline to compliance.
  • Schedule an Early C3PAO Engagement: Even if you’re not ready for the formal assessment yet, it’s wise to reach out to one or more C3PAOs early. Many C3PAOs offer pre-assessment consulting or readiness checks (some for a fee, some as part of scoping the actual audit work). Getting on their radar means when you are ready to schedule the certification audit, you already have a relationship. As noted earlier, demand for C3PAOs will be high – those who engage early will have more flexibility. Also, different C3PAOs might have different lead times; by talking to a few, you can gauge availability. When you do contract for an assessment, clarify timelines, what happens if you need a re-assessment (in case you fail the first time), and whether there are travel costs, etc. Being clear up front avoids surprises.
  • Stay Informed on Updates: CMMC is now in execution, but that doesn’t mean there won’t be further guidance or tweaks. Keep an eye on official channels like the DoD CIO’s CMMC page, the Cyber AB’s website (news section and Town Hall webinars), and reputable industry news. For example, the FAR Council is also working on a FAR rule for CUI security across all federal contracts, which could extend similar requirements outside DoD​. Any changes in NIST guidance (like updates to SP 800-171 or the release of 800-171 Rev.3 in the future) could also flow into CMMC requirements eventually. By staying informed, you can anticipate and adapt to changes. Consider joining industry working groups or forums on CMMC to share lessons learned and hear about best practices.
  • Embrace the Security Benefits: Lastly, while CMMC can feel like a compliance checkbox, remember the underlying intent – to improve cybersecurity and protect sensitive data from adversaries. The defense industry faces constant cyber threats (espionage, IP theft, ransomware). Implementing CMMC’s practices will significantly harden your organization. Use this initiative as a catalyst to build a culture of cybersecurity among your employees. Train them on security awareness, incident reporting, and best practices. Develop an incident response plan and drill it. These efforts not only satisfy CMMC requirements but will reduce the likelihood of a breach that could jeopardize your business and national security. In the long run, companies that integrate strong cybersecurity will be more resilient and trusted in the marketplace.

Conclusion

As of April 2025, the CMMC 2.0 program is transitioning from planning to reality. The DoD has finalized the rules, set a phased timeline for enforcement, and through the Cyber AB, enabled the ecosystem of assessors to begin work. Companies in the Defense Industrial Base should now be taking concrete steps to ensure they meet the required maturity level when the time comes. This includes digesting the latest program updates (like those discussed above) and adjusting compliance strategies accordingly.

The key updates through April 2025 – including the phased rollout schedule​, clarifications on scope​, the start of voluntary assessments, and the proposed small business support measures​– all point to an overarching theme: CMMC is achievable with proper planning and the government is trying to make it attainable, but it will not be optional. Organizations that act early, invest wisely, and utilize available resources will put themselves in the best position to thrive in the new compliance environment. Those that delay risk scrambling later or losing out on contracts to more prepared competitors.

In the coming months, we will likely see CMMC requirements appearing in more and more solicitations, initial batches of companies proudly announcing their certifications, and possibly refinements in guidance as lessons are learned. It’s an evolving landscape, but the foundational requirements are now set. Compliance is no longer a question of “if” or “when” – it’s happening now. For defense contractors and their partners, the focus should be on execution: get your security house in order, undergo an assessment when ready, and then you can confidently demonstrate to DoD (and prime contractors) that you can be entrusted with sensitive information.

CMMC 2.0 represents a significant raising of the bar for cybersecurity in the defense supply chain. By staying informed on updates and proactively working toward certification, companies can not only avoid being left behind but can use their compliance as a selling point. In an era of increasing cyber threats, this is a necessary evolution. As Matt Travis, CEO of the Cyber AB, aptly put it: not getting CMMC certified is simply not an option if you want to continue doing business with the DoD​. The good news is that with the right approach and support, achieving CMMC compliance is within reach for organizations of all sizes. Now is the time to double-down on those efforts – the “flashing red light” of urgency is here​, and the sooner a company reaches the finish line, the sooner it can refocus on its core mission of delivering for the warfighter, with cybersecurity confidence as a new competitive advantage.

Get FREE CMMC Level 1 for all your employees

Sources:

  • Department of Defense & Federal Register – CMMC 2.0 Final Rule and Program Updates​

defensescoop.com

  • Blank Rome LLP – “DoD Issues Final CMMC Rule” (NatLawReview) – Implementation timeline and rule changes​

natlawreview.com

  • DefenseScoop – “Final rule for CMMC goes into effect” – DoD statements on phased rollout and scope​

defensescoop.com

​PreVeil – “Countdown to Compliance: CMMC Timeline” – Timeline overview and expert quotes​

preveil.com

​FedTech Magazine – “Major Contractors Close In on CMMC Readiness” – Industry readiness and trends as of April 2025​

fedtechmagazine.com

​GlobeNewswire – Xometry CMMC Level 2 Certification Announcement – Example of early adopter success​

globenewswire.com

  • SMPL-Compliance Blog – “Tax Credit Proposal for Small Businesses” – Details on the proposed Small Business Cybersecurity Act​

smpl-c.com

  • Cyber AB Town Hall Highlights (Ardalyst) – Updates on assessor capacity and DoD commitment​

tesseract.ardalyst.com

  • National Defense Magazine – “Few Companies Ready for CMMC, Study Finds” – Statistics on industry readiness gaps​

nationaldefensemagazine.org

  • NDIA/CMMC Webinar (Sept 2024) – Notes on new self-assessment scoring and requirements​

ndia.org

  • DoD CIO CMMC Portal – Official announcements (SPRS self-assessment, etc.)​

dodcio.defense.gov