Overview

• DoD’s final DFARS rule adds CMMC clauses to contracts and subcontracts, requiring program offices to identify the applicable level in solicitations and contracting officers to confirm current status in SPRS before award.
• CMMC establishes three tiers of verification, with Level 1 relying on annual self-assessment, Level 2 generally requiring third‑party assessment, and Level 3 requiring a government‑led assessment.
• The rollout phases in over multiple years, emphasizing Level 1 and Level 2 self‑assessments in year one, expanding Level 2 third‑party certifications in year two, introducing Level 3 assessments in year three, and applying CMMC across applicable contracts in year four.
• Contractors at Levels 2 and 3 can receive conditional status with approved POA&Ms for up to 180 days, while contracts solely for commercial off‑the‑shelf items remain exempt.
• Offerors must post Level 1 or Level 2 self‑assessment results in SPRS and submit CMMC unique identifiers for systems handling FCI or CUI, with false statements risking enforcement under the False Claims Act as seen in the Aerojet Rocketdyne case.