Cybersecurity Maturity Model Certification (CMMC)
Meet New CMCC Requirements to Secure Your Contract Eligibility
The era of optional cybersecurity standards is over. With the final CMMC rules now in effect, Department of Defense (DoD) solicitations can require formal certification or self-assessment based on the maturity level you handle. Whether your organization stores Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), you need a clear path forward — or risk losing contract eligibility.
Duffy Compliance helps your team translate evolving regulation into a practical, defensible cybersecurity posture so you can focus on executing for your programs, not chasing compliance after the fact.
What Is CMMC and Why Does It Matter Now?
- What is CMMC? CMMC (Cybersecurity Maturity Model Certification) is the Department of Defense’s program that enforces cybersecurity standards across its supply chain. It maps to NIST SP 800-171 (and, in some cases, supplemental requirements from NIST SP 800-172) to ensure contractors handling sensitive data meet rigorous controls.
- Why does it matter now? With CFR 48 now officially published (effective November 10, 2025), CMMC requirements can legally be included in contracts and solicitations — making compliance a condition to bid or be awarded DoD contracts.
- Phased rollout approach: The DoD is employing a multi-phase schedule spanning from 2025 to 2028 to incrementally require self-assessments and third-party certifications based on the sensitivity of the work.
- Flow-down obligations: Even when your contract does not yet list CMMC explicitly, your prime or upstream partners may require it — so being proactive is critical.
CMMC Levels & Assessment Types
| LEVEL | Data Type / Risk | Assessment Approach | Key Notes / POAM Rules |
|---|---|---|---|
| Level 1 | FCI (Federal Contract Information) | Self-assessment / attestation | None of the controls are POAM-eligible under Level 1. |
| Level 2 | CUI (Controlled Unclassified Information) | Mix of self-assessment or third-party (C3PAO) certification, depending on contract | Most contracts will require full certification; limited POAM eligibility (max 180 days) for select controls. |
| Level 3 | Highly sensitive CUI or advanced programs | Certification via DIBCAC (leveraging 800-172 enhancements) | Rare, for programs handling high-risk technologies. |
Level 1 – FCI (Federal Contract Information)
Assessment Approach
Self-assessment / attestation
Key Notes / POAM Rules
None of the controls are POAM-eligible under Level 1.
Level 2 – CUI (Controlled Unclassified Information)
Assessment Approach
Mix of self-assessment or third-party (C3PAO) certification, depending on contract
Key Notes / POAM Rules
Most contracts will require full certification; limited POAM eligibility (max 180 days) for select controls.
Level 3 – Highly sensitive CUI or advanced programs
Assessment Approach
Certification via DIBCAC (leveraging 800-172 enhancements)
Key Notes / POAM Rules
Rare, for programs handling high-risk technologies.
Notes / Caveats:
- Level 1 self-attestation requires annual reaffirmation via SPRS.
- Certification for Level 2 is valid for 3 years, but annual affirmations and evidence submissions are required.
- Certain security assets (SPAs) will only be assessed against “relevant” controls instead of all controls in the final rule.
- Prime contractors may require compliance earlier than the phased deadlines — supply chain readiness is now a competitive differentiator.
What You Need to Know About the Implementation Timeline
-
November 10, 2025 — Phase 1 begins
Contracts may start including Level 1 and Level 2 self-assessment requirements for FCI and CUI work. -
November 10, 2026 — Phase 2
Level 2 third-party (C3PAO) certification becomes a default requirement for many contracts, approximately 50%. (Currently postponed pending DoW review.) -
November 10, 2027 — Phase 3
Level 3 (DIBCAC) assessments roll out for a subset of high-sensitivity programs. 50-75% of DoD contracts will need third-party certification. -
November 10, 2028 — Phase 4 / Full Implementation
All relevant contracts, renewals, and option periods will require the appropriate CMMC maturity level.
Now — No time to wait
Because assessment windows and audit scheduling often take months, waiting until the requirement shows up could be too late.
Early preparation gives you a buffer and competitive edge.
Duffy Compliance Is Your CMMC Advantage
- Security-first strategy
We don’t treat CMMC as a checkbox. We embed regulatory reality into strategy, so your posture isn’t just compliant — it’s resilient. - Gap-to-audit methodology
We assess your current state, prioritize what must be remediated, and build toward auditability — so you’re ready when assessors arrive. - Supply chain readiness
We help you not just certify your own systems, but ensure your subcontractors are aligned — protecting your award chances upstream. - Agile continuous compliance
Compliance doesn’t end at certification. We support long-term monitoring, audit-ready documentation, and sustainability of controls. - Deep industry experience
Our team has navigated the evolving defense landscape for years — and we stay on top of rule changes, of which CFR-48 is one of the biggest.
What Are Your Next Steps?
- Risk / readiness assessment
A rapid snapshot of your current posture vs. CMMC requirements, to identify gaps. - Roadmap development & resource planning
A prioritized plan with timelines, resourcing, remediation phases, and evidence gathering. - Implementation sprints
Iterative remediations, controls documentation, monitoring tooling, and evidence generation. - Audit prep & mock accreditation assessments
Internal dry runs, review of artifacts, control validation — before the official audit. - Certification & post-certification support
We assist during the audit, help you respond to findings, and maintain continuous compliance afterward.
Hint: If you plan to bid on DoD contracts in 2026 or beyond, your safe bet is preparing now for full Level 2 certification — particularly given that many prime contractors will demand it even before it becomes universally required.