Overview

• DoD’s final DFARS rule published on September 10 directs contracting officers not to award to offerors lacking the required current CMMC status, per 48 C.F.R. § 204.7502.
• The rollout starts with Level 1 and Level 2 self-assessments in year one, expands to Level 2 third‑party certifications in year two, adds Level 3 government assessments in year three, and reaches full coverage for FCI/CUI contracts by year four.
• Offerors must post CMMC self‑assessment results in SPRS, affirm continuous compliance, and provide CMMC unique identifiers for systems that process, store, or transmit FCI or CUI.
• Prime contractors must flow down CMMC clauses to subcontractors receiving FCI or CUI and confirm subcontractor status before award, with contracts for commercially available off‑the‑shelf items excluded.
• For Levels 2 and 3, conditional status may be used for up to 180 days to close POA&Ms, with industry facing Level 2 scheduling backlogs of about eight weeks, low readiness rates, and heightened False Claims Act exposure for misstatements.