A defense supplier’s cybersecurity claim would need an evidentiary trail under the CMMC program rule finalized on October 15, 2024. The Pentagon specified how contractors and subcontractors would demonstrate that they protected sensitive government information—and how they would affirm that the protection continued after an assessment.
The final rule established the revised Cybersecurity Maturity Model Certification program in Title 32 of the Code of Federal Regulations, with an effective date of December 16. It addressed federal contract information and controlled unclassified information held on contractor systems. The industrial concern was that valuable defense information could be exposed without ever residing on a classified military network.
The revised model had three levels. At Level 1, contractors would assess their own basic protection of federal contract information. Level 2 addressed controlled unclassified information, with either self-assessment or an independent assessment depending on the requirement. Level 3 added a government assessment through the Defense Industrial Base Cybersecurity Assessment Center. The program therefore did not impose the same external audit on every participating company.
Pentagon officials described several changes intended to reduce the burden of an earlier design. Two transitional levels disappeared. The department also dropped a separate evaluation of process maturity and 20 CMMC-specific requirements that were outside the relevant National Institute of Standards and Technology standards. The emphasis shifted toward assessing implementation of the security requirements themselves.
That simplification responded to an industrial problem as well as an administrative one. Small and medium-sized companies had told the department that the original approach could be difficult to achieve with their resources. Officials wanted stronger protection without driving away the suppliers whose technology, parts and expertise the military needed.
The final framework still imposed boundaries. Certain deficiencies at Levels 2 and 3 could receive conditional status through a plan of action and milestones. Allowed deficiencies had to be corrected and verified within 180 days; the mechanism was not an indefinite extension for every missing security requirement. Annual affirmations also made continued compliance a responsibility beyond the initial assessment event.
The economic stakes were substantial. In its October 30 major-rule report, GAO summarized Defense Department estimates of roughly $4 billion in annualized total costs using a 7 percent discount rate, or $4.23 billion using 3 percent. Those were regulatory estimates, not a procurement appropriation or actual spending already recorded. The department also determined that the rule would significantly affect a substantial number of small entities.
Publication did not make the revised certification requirement universal across defense contracts that October. Applying the program through acquisition clauses required a separate rule. That final acquisition rule was published on September 10, 2025, and took effect November 10, 2025. Keeping those milestones separate explains why the program could be legally established in 2024 while its contractual rollout was still ahead.
The 2024 decision gave industry a firmer definition of the evidence it would need to produce. Its success would depend on two outcomes together: more reliable protection of defense information and an assessment system that capable suppliers could actually navigate.
Sources
- Cybersecurity Maturity Model Certification (CMMC) Program; Final Rule — Department of Defense / Federal Register · 2024-10-15.
- DOD Simplifies Process for Defense Contractors to Comply With Cybersecurity Rules — Department of Defense · 2024-10-17.
- Department of Defense: Cybersecurity Maturity Model Certification (CMMC) Program — Government Accountability Office · 2024-10-30.
- Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements — Department of Defense / Federal Register · 2025-09-10.