Department of Defense CMMC compliance infographic highlighting phased implementation timeline and resource challenges, CMMC June 2025 updates.

DoD Addresses Challenges to Make CMMC a Reality: CMMC June 2025 Update

Introduction

As the Department of Defense (DoD) continues the phased rollout of the Cybersecurity Maturity Model Certification (CMMC), defense contractors across the United States are facing both opportunities and challenges. With a defense industrial base (DIB) consisting of approximately 220,000 to 300,000 companies, the transition to CMMC 2.0 is one of the largest and most significant cybersecurity compliance undertakings in U.S. history. This article explores the major challenges facing CMMC implementation, details on the phased rollout and compliance timeline, contractor responsibilities, enforcement updates, and best practices to ensure readiness and contract eligibility.

The Scale of the Challenge: CMMC Across the Defense Industrial Base

Implementing CMMC across such a vast and diverse group of companies poses a considerable challenge for the DoD. Estimates indicate that:

  • 220,000 to 300,000 companies are part of the defense supply chain and must meet CMMC requirements.

  • Of these, about 80,000 companies will need to comply with CMMC Level 2, which focuses on the protection of Controlled Unclassified Information (CUI).

  • Approximately 1,500 companies will require CMMC Level 3 certification, the highest standard for protecting critical national security information.

The CMMC framework is tiered to match the level of cybersecurity risk associated with the data handled. Level 1 focuses on Federal Contract Information (FCI), Level 2 addresses CUI, and Level 3 is designed for organizations managing the most sensitive data or critical programs2024-22905.

Bottleneck: Limited Assessment Resources

A significant bottleneck in the CMMC rollout has been the limited number of Certified Third-Party Assessment Organizations (C3PAOs):

  • Currently, only 50 to 60 C3PAOs are available to conduct Level 2 and Level 3 certification assessments.

  • Demand for certified assessments far exceeds the current capacity, particularly as the phased implementation brings more contracts under CMMC requirements.

The DoD recognizes this constraint and is actively exploring ways to expand the pool of assessors, streamline pre-assessment processes, and enhance training for C3PAOs. However, until capacity increases, contractors should plan for potentially lengthy lead times for official certification assessments.

CMMC June 2025 Update, CMMC Final Rule: Phased Implementation in 2025

Background and Evolution

The CMMC program was established to strengthen cybersecurity across the DIB. Initially proposed in 2019 to move away from a self-attestation model, the CMMC has since undergone multiple revisions, public comment periods, and internal reviews to create a more streamlined, risk-based, and practical compliance framework. The CMMC Final Rule was published in December 2024, setting the stage for mandatory phased implementation starting in 20252024-22905.

The Four-Phase Rollout

The CMMC Final Rule is being deployed through a structured, four-phase implementation plan:

  1. Phase 1: Focuses on self-assessments for Level 1 and Level 2. Contractors are required to conduct annual self-assessments for Level 1 and triennial self-assessments for Level 2, submitting results into the Supplier Performance Risk System (SPRS).

  2. Phase 2: Introduces C3PAO certification assessments for Level 2. Only companies that achieve a passing assessment from a C3PAO will be eligible for certain contracts.

  3. Phase 3: Begins government-led Level 3 (DIBCAC) assessments for critical programs and organizations that handle high-value assets.

  4. Phase 4: Full CMMC implementation, requiring all applicable defense contracts to meet the designated CMMC level as a condition of award and contract renewal2024-22905.

Each phase is expected to last about one year, with full implementation anticipated by 2028.

Contractor Readiness: Keys to Compliance

Required Actions for Defense Contractors

Contractors must take proactive steps to maintain eligibility for DoD contracts as CMMC requirements are phased in. Essential actions include:

  • Understanding the CMMC Level Required: Each contract will specify the minimum CMMC level required. Contractors should review solicitation documents carefully to determine if Level 1, Level 2, or Level 3 compliance is necessary.

  • Defining Assessment Scope: Identify which systems and assets process, store, or transmit FCI (for Level 1) or CUI (for Level 2/3). Proper scoping is critical to focus resources and limit assessment boundariesScopingGuideL2Scope_Level2_V2.0_FINAL…ScopingGuideL3.

  • Maintaining Documentation: Develop and regularly update the System Security Plan (SSP) to describe security boundaries, controls, and relationships between systems. Maintain an asset inventory and accurate network diagrams.

  • Accurate SPRS Entries: Ensure that all assessment scores and affirmations are entered into the Supplier Performance Risk System (SPRS) and kept up to date.

  • Using C3PAO Services: For Level 2 and above, schedule assessments with certified C3PAOs, prepare documentation in advance, and resolve any Plan of Action and Milestones (POA&M) items promptly.

Asset Categorization for Scoping

For CMMC Level 2 and 3, contractors must categorize assets into the following groups:

  • CUI Assets: Systems that process, store, or transmit Controlled Unclassified Information.

  • Security Protection Assets: Devices or systems providing security functions (e.g., firewalls, SIEMs).

  • Contractor Risk Managed Assets: Capable of handling CUI but not intended to do so, managed with risk-based controls.

  • Specialized Assets: Includes government-furnished equipment, IoT devices, OT systems, and test equipment.

  • Out-of-Scope Assets: Do not process, store, or transmit CUI and are physically/logically separated from in-scope systemsScopingGuideL2Scope_Level2_V2.0_FINAL…ScopingGuideL3.

Properly documenting and defending the categorization of each asset is essential for successful certification.

CMMC Final Rule and Compliance Timeline Updates

Recent Communications and Webinars

Throughout June 2025, the DoD has hosted several communications, webinars, and workshops to:

  • Educate contractors on the value of third-party C3PAO assessments.

  • Clarify evolving timelines and mandatory dates for compliance.

  • Share best practices and answer common questions from the DIB community.

Contractors are strongly advised to participate in these events and monitor official sources, including the DoD CMMC website and the Federal Register, for the latest updates.

Key Compliance Deadlines

  • December 16, 2024: CMMC Final Rule effective date.

  • 2025 and beyond: Phased implementation with milestone deadlines for self-assessment, third-party certification, and government-led assessments.

Missing compliance deadlines can result in loss of contract eligibility, suspension of ongoing work, and potential financial penalties.

Enforcement: Legal and Regulatory Accountability

Consequences of Non-Compliance

The DoD has emphasized that legal enforcement and accountability will be key features of the CMMC program under the Final Rule. Contractors found misrepresenting their CMMC status—such as falsely claiming certification or failing to maintain required practices—may face:

  • Civil penalties under the False Claims Act (FCA).

  • Contract termination or non-renewal.

  • Suspension or debarment from future DoD contracts.

  • Mandatory investigations and settlements for fraudulent claims2024-22905.

Maintaining accurate documentation, submitting timely updates to SPRS, and using certified assessment organizations is essential to avoid these risks.

Key Elements of the CMMC Compliance Process

Level 1: Self-Assessment for FCI

  • Applies to contractors handling only Federal Contract Information (FCI).

  • Involves 15 basic safeguarding requirements based on FAR 52.204-21.

  • Self-assessment is required annually, and results must be submitted into SPRS.

  • No Plan of Action and Milestones (POA&M) allowed; all 15 controls must be fully met for compliance2024-22905AssessmentGuideL1.

Level 2: Enhanced Security for CUI

  • Applies to organizations handling Controlled Unclassified Information.

  • Based on the 110 requirements in NIST SP 800-171 Rev. 2.

  • Requires a self-assessment or, for many contracts, a C3PAO certification every three years.

  • If not all controls are met, a POA&M may be used to document remediation steps, but all requirements must be closed within 180 days.

  • Affirmation of compliance must be submitted annually via SPRS2024-22905AssessmentGuideL2.

Level 3: Highest Assurance for Critical Programs

  • Reserved for organizations supporting critical national security programs or managing high-value assets.

  • Involves additional requirements from NIST SP 800-172, plus prerequisite C3PAO certification for Level 2.

  • Government-led assessment by DCMA DIBCAC required every three years.

  • Continuous annual affirmations and prompt closure of any POA&M items are required for contract eligibility2024-22905ScopingGuideL3.

Addressing the Assessment Resource Shortage

The DoD is taking steps to address the resource bottleneck created by a limited number of C3PAOs:

  • Training and Accreditation: More organizations are being approved as C3PAOs to expand assessment capacity.

  • Guidance Documents: The DoD has released updated scoping guides, assessment guides, and webinars to help contractors prepare and minimize pre-assessment delays.

  • Scheduling Flexibility: Contractors are encouraged to plan assessments early and maintain ongoing readiness, as lead times may remain lengthy through 2026.

Best Practices for Contractor Readiness

1. Start Early

Begin the compliance process as soon as possible—even if not yet mandated by a specific contract. Early preparation reduces the risk of delays and allows time to address gaps.

2. Maintain Accurate Records

Keep comprehensive records of all security controls, policies, incident response plans, training materials, and asset inventories. All evidence must be in final, approved form for assessment purposes.

3. Conduct Regular Gap Assessments

Periodically review systems against the latest NIST SP 800-171 or NIST SP 800-172 requirements. Use internal audits or third-party consultants for objective evaluations.

4. Engage Qualified Experts

Leverage certified professionals, including CMMC-Registered Practitioners (RPs) and C3PAOs, to interpret requirements, review documentation, and conduct mock assessments.

Utilize cmmc.live AI services

5. Stay Informed

Monitor the DoD CMMC website, Federal Register, and industry alerts for regulatory changes, assessment process updates, and official deadlines.

6. Leverage Technology Solutions

Consider cybersecurity platforms and tools that automate evidence collection, policy management, and incident tracking to streamline the compliance process.

The Role of the Supplier Performance Risk System (SPRS)

SPRS is the official DoD system for storing CMMC assessment results, affirmations, and compliance data. All contractors must:

  • Enter self-assessment or third-party assessment results into SPRS as required by contract type.

  • Annually reaffirm compliance status in SPRS to maintain contract eligibility.

  • Ensure all data in SPRS is accurate, complete, and up-to-date2024-22905.

Flow-Down Requirements to Subcontractors

CMMC requirements are not limited to prime contractors. Subcontractors that process, store, or transmit FCI or CUI must also:

  • Achieve the minimum CMMC level specified by the prime contract.

  • Provide affirmation and assessment results via SPRS.

  • Maintain compliance throughout the period of performance.

This flow-down obligation requires clear communication between primes and subs to ensure the entire supply chain remains compliant2024-22905.

Documentation: The Heart of CMMC Compliance

One of the most common sources of audit failure is insufficient or outdated documentation. Key documents include:

  • System Security Plan (SSP): Describes system boundaries, environments, and security control implementation.

  • Asset Inventory: Lists all systems, hardware, and software in the assessment scope.

  • Network Diagrams: Visually depicts network boundaries and data flows.

  • Policies and Procedures: Address incident response, access control, training, and other critical areas.

Contractors should ensure all documentation is current, comprehensive, and readily available for assessorsAssessmentGuideL2ScopingGuideL2.

Common Challenges and Pitfalls

Despite best efforts, many contractors encounter these common challenges:

  • Underestimating Scope: Failing to identify all in-scope assets, especially cloud services and external providers.

  • Inadequate Separation: Not physically or logically separating in-scope and out-of-scope assets.

  • Incomplete POA&Ms: Not tracking or resolving outstanding security requirements within 180 days.

  • Misrepresenting Status: Falsely claiming compliance or certification, risking legal action under the False Claims Act.

Proactive gap analysis and internal reviews can help avoid these issues.

DoD’s Ongoing Support and Guidance

The DoD continues to provide extensive support for contractors navigating CMMC requirements, including:

  • Comprehensive guidance documents on scoping, assessment, and documentation.

  • Training sessions and webinars for both primes and subcontractors.

  • Publicly accessible FAQs, templates, and example documents on the DoD CMMC website.

Contractors are encouraged to utilize these resources and seek clarification when needed.

The Road Ahead: What to Expect in 2025 and Beyond

June 2025 represents a critical juncture for the defense industry. Key takeaways include:

  • Full CMMC implementation is on track for 2028, but major deadlines will arrive annually as each phase begins.

  • Contractors must remain vigilant in maintaining compliance, updating documentation, and affirming status in SPRS.

  • Assessment resource shortages may persist, but the DoD is committed to expanding capacity and improving guidance.

Conclusion: Staying Ready and Accountable

The CMMC Final Rule marks a transformative shift in how the DoD and its supply chain approach cybersecurity. While the scale of the challenge is immense, the stakes are even higher. Protecting sensitive defense information is now a shared responsibility, with clear requirements, escalating enforcement, and strong support from the DoD.

Contractors who act early, document thoroughly, and seek certified assessment services will be best positioned to maintain contract eligibility and protect national security interests. Staying informed, engaging with official resources, and building a culture of cybersecurity are not just recommendations—they are essential steps for success in the evolving defense landscape.

For the latest guidance, tools, and updates, visit the official DoD CMMC portal at https://dodcio.defense.gov/CMMC/Documentation/.

References:

Federal Register: 32 CFR Part 170 – CMMC Final Rule2024-22905

DoD CMMC Documentation and GuidanceScopingGuideL2AssessmentGuideL2

NIST SP 800-171 Rev. 2

DoD CMMC Official Website