September 2025

On July 22, 2025, the Department of Defense took a major step toward finalizing its long-anticipated 48 CFR (DFARS) rule implementing the Cybersecurity Maturity Model Certification (CMMC). The rule was officially submitted to the Office of Information and Regulatory Affairs (OIRA) for interagency review.

This submission marks the last checkpoint before the rule is published in the Federal Register and becomes binding on contractors. Once cleared by OIRA, DoD can move forward with inserting the updated DFARS requirements into new solicitations and contracts.

What Comes Next

• OIRA Review: OIRA cleared it on August 25, 2025. 
• Federal Register Publication: The rule will be published in the Federal Register along with an official effective date. Federal regulations generally become enforceable within 1 to 60 days of publication.
• Contract Implementation: Contractors can expect DFARS clauses referencing the CMMC requirements to begin appearing in solicitations as early as late 2025.

Why It Matters

This milestone carries real implications for defense contractors. Once the rule takes effect, companies that lack a CMMC-certified environment may find themselves ineligible to win or execute DoD contracts. It won’t be enough to have plans in place—contracting officers will need assurance that sensitive Department of Defense work is performed within a secure, certified environment.

For many small and mid-sized businesses, this could mean the difference between maintaining a foothold in the Defense Industrial Base or being locked out of future opportunities. Companies that have delayed compliance run the risk of being passed over in favor of competitors who are audit-ready.

Final Thought

For defense contractors, this is the clearest signal yet that CMMC compliance is no longer optional or “someday.” With the rule in OIRA’s hands, the countdown to enforcement has begun. Contractors handling Controlled Unclassified Information (CUI) should ensure their NIST 800-171 controls are implemented, documented, and verifiable inside a certified environment.