As entrepreneurs, we’re used to managing everything from driving growth and managing teams to navigating the complexities of running a business. CMMC compliance is one of those essential but often overwhelming tasks. For those of us with a company that’s part of the Department of Defense (DoD) supply chain, a new and critical requirement has arrived — the Cybersecurity Maturity Model Certification (CMMC) 2.0. More than a simple regulation, it’s a new standard for how we do business in the federal marketplace.
First, a Plain-English Explanation of CMMC 2.0
CMMC is the DoD’s way of moving from a “trust me” system of cybersecurity to a “show me” model. It’s a unified framework to ensure every single company in the supply chain is a strong link that can withstand cyberattacks. CMMC’s goal is to safeguard federal contract information (FCI) and controlled unclassified information (CUI):
- FCI: This information is not highly sensitive, but it’s not for public release. Some examples include contract award notices, invoices and general correspondence.
- CUI: This is information created or possessed by the government that can cause serious damage if compromised or leaked. Engineering data, project specifications, technical drawings and operational schedules fall under this category.
The CMMC 2.0 is the DoD’s official cybersecurity rulebook. It sets the minimum requirements that any business must meet to work on DoD contracts. Instead of just trusting companies to have good security, CMMC requires them to prove it through assessments. CMMC compliance means achieving the security level necessary for the sensitive information they handle. Levels run from basic to expert.
The “Why” Behind CMMC
The FBI reported over $16 billion in losses from cybercrime in 2024, which is 33% higher than the previous year. For a business, this can translate to lost revenue from operational downtime and the high cost of data recovery and forensic analysis, as well as reputational damage and legal liabilities. A single ransomware attack can cripple a small supplier for weeks.
Information security has been a high-risk area since 1997, and by the government’s own admission, it’s a long-standing and systemic problem. Federal agencies have recorded more than 32,200 incidents in 2023. This shows that, even with massive resources, the government is vulnerable to cyberattacks. CMMC is the logical next step, as it helps secure the entire industrial base.
The Official Timeline of the CMMC Rollout
After years of discussions, the CMMC rollout now has a concrete schedule. It formally started on November 10, 2025, which means new DoD contracts will require CMMC compliance from that date onward.
The program has two regulations. The 32 CFR establishes various CMMC policies and requirements, and we have been required to comply with it since December 2024. The second rule, the 48 CFR, has only been in effect since November 10. It covers standardized contract language and acquisition policies
The rollout is phased, which gives us some breathing room but also a firm deadline.
- Phase 1 (November 2025 to November 2026): For new contracts, the DoD will require us to perform a Level 1 or Level 2 self-assessment. This is our chance to do an honest internal review before the mandatory audits begin.
- Phase 2 (November 2026 to November 2027): A year later, things get more serious. This is when formal certification assessments for Level 2, which are conducted by third-party auditors, may become a mandatory requirement.
- Phase 3 (November 2027 to November 2028): This is when the highest-level requirements for the most critical programs kick in, with Level 3 assessments being added to solicitations.
- Phase 4 (Starting November 2028): The grace period is over. At this point, CMMC compliance will be expected across all applicable DoD contracts.
My 4-Step Game Plan for Getting Ready
From what I’ve gathered, waiting is not a viable strategy. A proactive approach is essential to stay on top of the CMMC requirements. Here’s the simplified roadmap I’m using to prepare my business.
1. Identify Your Required Level
If your company only provides commercially available, off-the-shelf products and never handles sensitive data, you might not need certification. However, if you handle FCI, you’ll likely need to achieve Level 1. You must reach Level 2 if you’re a subcontractor with access to any CUI.
2. Conduct an Honest Gap Analysis
Once you know your target level, compare your existing cybersecurity measures against the CMMC requirements. A self-audit will show you where you’re going strong and where you need to invest.
For example, the standard may require you to control the use of removable media, such as USB drives. Determine if you have a policy for it. Do you have technical controls to enforce it? The answer will be yes, no or partially.
3. Document Everything
This is when you move from doing security to proving it. You’ll need to create evidence for your assessment, which boils down to two key documents.
- System Security Plan (SSP): This is your company’s security rulebook. For each control, the SSP should describe how you’re meeting the requirement.
- Plan of Action and Milestones (POA&M): This is your project plan for closing gaps. For every “no” or “partially implemented” in your gap analysis, the POA&M documents what you will do about it, who is responsible and the deadline for getting it done.
Be intentional when documenting. For example, when you perform your gap analysis for Level 2, measure your practices against a specific government standard. Review the security details and requirements for safeguarding controlled unclassified information to understand what CMMC compliance means for you.
4. Communicate With Your Partners
The framework applies to your entire supply chain. Ask your critical suppliers if they’re aware of CMMC. Review your master service agreements and consider adding clauses that require your subcontractors to meet the same cybersecurity standards you do.
Reframing CMMC as a Foundation for Future Growth
It’s natural to view CMMC compliance as another regulatory burden, but I believe that’s a limited perspective. At its core, it’s a roadmap to better cybersecurity. The practices we implement to comply will make our businesses more resilient against all cyber threats, not just those related to our DoD work. It’s an excellent foundation for sustainable growth in an increasingly digital world.
