Understanding the 48 CFR Rule: How CMMC Requirements Will Be Enforced in DoD Contracts

For years, the Cybersecurity Maturity Model Certification (CMMC) lived in a world of drafts, delays, and speculation. Now, however, there are two key rules underpinning the CMMC program. The first is the foundational  32 CFR Part 170, which went into effect in December 2024 and formally established the CMMC framework.

The second is the Department of Defense’s (DoD’s) final 48 CFR multi-part rule, which outlines how CMMC requirements will be incorporated into contracts via DFARS clauses and initiates the phased implementation process defined in the 32 CFR rule.

In short: the 32 CFR CMMC rule is what will be enforced, and the 48 CFR CMMC rule is how it will be enforced. Together, these rules signal contractual enforcement of CMMC requirements in DoD contracts. In this article, we’ll further detail what the 48 CFR CMMC rule is, what it means, and how to prepare for compliance now. 

What is the 48 CFR CMMC Rule?  

The 48 CFR CMMC rule, published in proposed form in August 2024, formally established the CMMC framework. It outlines the requirements for each maturity level, defines roles like C3PAOs, and sets expectations for how compliance is measured.  

As of July 22, 2025, it advanced to the next stage of the rulemaking process: Office of Management and Budget (OMB) final review. After OMB approval, the rule was published in the Federal Register on September 10, 2025, with a specified effective date of November 10, 2025. At that point, CMMC transitioned from policy to practice by showing up in real DoD solicitations and contracts. 

What to Expect in DoD Contracts With the 48 CFR Final Rule 

Starting from the effective date of the 48 CFR rule, CMMC requirements will be included in all DoD contracts and solicitations, following a phased implementation timeline (outlined below). Here’s what that means: 

• Prime contractors will need to demonstrate the required CMMC level—Level 1, Level 2 (Self-Assessment), or Level 2 (C3PAO)—at the time of contract award.
• Subcontractors will also be required to meet the appropriate CMMC level, depending on the sensitivity of the information they handle.
• Contract clauses will clearly spell out CMMC requirements and flow-down obligations. 

Since the official publication of final 48 CFR rule, CMMC compliance is no longer optional or considered a “good to have” measure if you’re bidding on a DoD contract. It is now required for anyone handing federal contract information (FCI) and/or controlled unclassified information (CUI). Failing to meet your required CMMC level will mean you cannot bid, renew, or continue certain contracts. 

The DoD has outlined three levels of certification: 

• Level 1: Self-Assessment: For companies handling only FCI.

• Level 2: C3PAO Assessment: For organizations handling CUI. Requires an independent assessment by an accredited Certified Third-Party Assessor Organization (C3PAO).
• Level 3: Government-Led Assessment: For the highest sensitivity contracts, including NIST 800-172 controls.

CMMC Phased Implementation Timeline and Requirements 

What DoD Contractors Should Do Now to Stay Ahead of the CMMC Enforcement Timeline 

With the 48 CFR rule recently finalized, CMMC compliance will become a contractual requirement, and even though CMMC enforcement will roll out in phases, you shouldn’t wait to act. With more than 300,000 contractors expected to require certification and fewer than 80 accredited C3PAOs, capacity will be tight from day one. 

Waiting until the clause appears in your contract is not a strategy. By then, you could be competing for limited assessor availability alongside hundreds of other contractors trying to hit the same deadline. With enforcement on the horizon, now is the time to prepare in the following ways: 

• Determine your required CMMC level based on contract data sensitivity. 
• Perform a gap assessment against NIST SP 800-171 or FAR 52.204-21. 
• Ensure your SPRS score is current and backed by documented evidence. 
• Begin remediation efforts now, especially for Level 2 (C3PAO) organizations. 
• Engage with a C3PAO or qualified third-party advisor for readiness support. 

Schellman offers CMMC assessment and certification services across this entire lifecycle—from readiness and remediation support to official C3PAO assessments. 

Moving Forward with CMMC Compliance 

CMMC is no longer an idea on the horizon. It is now part of the contract language that determines whether you can win or keep DoD work. For those who act early, compliance will be a competitive advantage. For those who wait, it could be a barrier to entry. Whether you need a readiness assessment or full certification, starting now gives you a strategic advantage, especially as demand for assessment services grows. 

As one of the select accredited C3PAOs for CMMC, Schellman has been preparing for this moment from the start. We have already helped defense contractors and suppliers assess their gaps, implement necessary controls, and navigate the NIST 800-171 and 800-172 requirements that underpin CMMC. Contact us today to learn more about CMMC compliance, assessment, certification, or how we can help. 

In the meantime, check out our insightful CMMC blogs, which highlight important information that will impact many of our clients: 

• What DoD Contractors Need to Know About the 32 CFR CMMC Rule and Its Effect on Vendors
• What to Know About the CMMC Final Rule: Key Changes and How to Prepare
• FedRAMP Moderate Equivalency Explained: What CSPs Need to Know