DFARS and CMMC: New Mandatory Cybersecurity Requirements for Defense Contractors

Key Points:

• DFARS and the CMMC program introduce mandatory cybersecurity verification for defense contractors that handle Federal Contract Information or Controlled Unclassified Information.
  
• The CMMC framework includes three certification levels and may require either self assessments or third party cybersecurity audits.
  
• Contractors must maintain compliance through documented security controls, system tracking in SPRS, and regular affirmation of cybersecurity practices.
  
• Early preparation helps defense contractors remain eligible for DoD contracts and maintain competitiveness within the Defense Industrial Base supply chain.

• Understanding DFARS Cybersecurity Requirements for Defense Contractors
• What Is the CMMC Program and How It Works
• CMMC Levels and Assessment Requirements
• Key Changes Introduced by the 2025 DFARS Final Rule
• Conditional and Final CMMC Certification Status
• Phased Implementation Timeline for CMMC Requirements
• Supply Chain Responsibilities and Subcontractor Compliance
• Impact of the New Requirements on Small Businesses
• How Defense Contractors Should Prepare for DFARS and CMMC Compliance
• Conclusion: Cybersecurity Compliance Is Now a Core Requirement for Defense Contracting
• DFARS and CMMC Requirements: Frequently Asked Questions for Defense Contractors

Cybersecurity has become a critical concern for the U.S. Department of Defense as cyber threats targeting government contractors continue to grow in scale and sophistication. Modern defense programs depend on a vast network of private companies that design, manufacture, and support military technologies. This network, commonly referred to as the Defense Industrial Base (DIB), includes thousands of contractors and subcontractors that handle sensitive information during contract performance. As adversaries increasingly attempt to infiltrate contractor systems to gain access to defense data, protecting this ecosystem has become a top priority for the DoD.

A major focus of these efforts is safeguarding Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). FCI generally refers to information generated for or provided by the government under a contract that is not intended for public release. CUI includes a broader category of sensitive but unclassified data that requires protection due to its relevance to national security, defense operations, or other government missions. When contractors process, store, or transmit this information, weaknesses in their cybersecurity practices can create entry points for cyber espionage or data theft. For this reason, the DoD has concluded that stronger, standardized cybersecurity requirements are necessary across the defense supply chain.

To address these risks, the Department of Defense has introduced a more structured compliance framework through the Defense Federal Acquisition Regulation Supplement (DFARS) and the Cybersecurity Maturity Model Certification (CMMC) program. DFARS clauses establish contractual cybersecurity obligations for companies performing defense work, while CMMC introduces a formal mechanism for verifying that contractors meet the required security standards. Together, these frameworks are reshaping how cybersecurity compliance is evaluated in defense contracting and are setting a new baseline for companies that want to participate in DoD procurement.

Understanding DFARS Cybersecurity Requirements for Defense Contractors

The Defense Federal Acquisition Regulation Supplement (DFARS) is a set of regulations that supplements the Federal Acquisition Regulation and governs how the Department of Defense conducts procurement. DFARS establishes specific contractual requirements that apply to companies providing products or services to the DoD. Among its many provisions, DFARS includes a framework that defines how contractors must protect sensitive government information within their information systems.

In recent years, cybersecurity requirements within DFARS have become significantly more detailed. The regulation now requires defense contractors to implement security controls, report cyber incidents, and document compliance with recognized cybersecurity standards. These obligations apply to contractor information systems that process, store, or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) during contract performance.

Several DFARS clauses form the core of the current cybersecurity compliance structure for defense contractors:

• DFARS 252.204-7012 establishes requirements for safeguarding Controlled Unclassified Information and mandates cyber incident reporting within 72 hours.
• DFARS 252.204-7020 requires contractors to perform a NIST SP 800-171 self-assessment and submit their assessment score to the Supplier Performance Risk System.
• DFARS 252.204-7021 introduces Cybersecurity Maturity Model Certification requirements into DoD contracts.
• DFARS 252.204-7025 requires contractors to provide assessment results and compliance information related to NIST SP 800-171.

A key foundation of these requirements is the cybersecurity framework defined in NIST Special Publication 800-171. This standard outlines a set of security controls designed to protect Controlled Unclassified Information within nonfederal information systems. Contractors handling CUI are expected to implement these controls and document their compliance as part of their internal security program.

For many years, contractors were allowed to rely primarily on self-attestation when confirming compliance with cybersecurity standards. However, the Department of Defense determined that self-reported compliance often failed to provide sufficient assurance that required security controls were actually implemented. This concern led to the development of additional oversight mechanisms, including the introduction of the Cybersecurity Maturity Model Certification program, which adds formal verification and assessment requirements for defense contractors.

What Is the CMMC Program and How It Works

The Cybersecurity Maturity Model Certification (CMMC) is a cybersecurity verification framework created by the Department of Defense to ensure that contractors properly protect sensitive government information. The program establishes measurable security requirements that companies must meet in order to work on DoD contracts that involve Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). Instead of relying only on contractor statements of compliance, the CMMC framework introduces structured assessments to verify that required cybersecurity practices are actually implemented.

The Department of Defense developed the CMMC program after identifying weaknesses in the previous compliance model. Many contractors reported compliance with NIST security standards, but subsequent reviews revealed gaps between documented policies and actual system protections. These findings raised concerns about the exposure of sensitive defense information within the Defense Industrial Base. The CMMC framework was introduced to create a more consistent and verifiable approach to cybersecurity compliance.

CMMC works in coordination with existing regulatory and technical standards. DFARS clauses incorporate CMMC requirements into defense contracts, while NIST cybersecurity publications define the underlying security controls. In practice, this means contractors must implement security practices based on NIST standards and then demonstrate compliance through CMMC assessments. This structure links regulatory requirements, security controls, and certification processes into a unified compliance model.

Component	Role in the Cybersecurity Framework
CMMC	Certification framework used to verify contractor cybersecurity maturity
DFARS	Contract regulations that require cybersecurity compliance in DoD contracts
NIST SP 800-171	Security control standard used to protect Controlled Unclassified Information
NIST SP 800-172	Additional security requirements for higher risk environments

The CMMC program evaluates whether a contractor’s systems and processes are capable of protecting sensitive information during contract performance. Depending on the type of information involved and the level of risk, contractors may need to complete either a self-assessment or a formal review conducted by an authorized third party. These assessments help the Department of Defense confirm that contractors maintain an appropriate level of cybersecurity readiness before they are allowed to handle government data.

CMMC Levels and Assessment Requirements

The CMMC framework uses a tiered structure to define cybersecurity requirements for defense contractors. Each level corresponds to the sensitivity of the information that a contractor handles and determines how compliance must be assessed. The required level is specified in the solicitation and contract and applies to contractor information systems that process, store, or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).

The three certification levels include the following:

• Level 1. This level focuses on protecting Federal Contract Information. Contractors must implement basic cyber hygiene practices and conduct an annual self-assessment. The goal is to ensure that companies follow fundamental security procedures when handling government contract data.
• Level 2. Level 2 applies to systems that process or store Controlled Unclassified Information. Contractors must implement security controls aligned with NIST SP 800-171. Depending on the contract requirements, compliance may be confirmed through a self-assessment or through a third party assessment performed by a Certified Third Party Assessment Organization (C3PAO).
• Level 3. The highest level applies to programs that involve more sensitive national security information. Assessments at this level are conducted by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). Level 3 requires additional security practices that extend beyond the controls defined in NIST SP 800-171.

CMMC certifications remain valid for a defined period depending on the level. Level 1 assessments must generally be updated every year. Levels 2 and 3 typically remain valid for up to three years if the contractor maintains compliance. In addition to completing assessments, contractors must also provide periodic affirmations that their systems continue to meet the required cybersecurity standards throughout the contract lifecycle.

Key Changes Introduced by the 2025 DFARS Final Rule

The 2025 DFARS final rule represents a major step in integrating the Cybersecurity Maturity Model Certification program into the defense acquisition framework. The rule formally embeds CMMC requirements into DoD solicitations and contracts, meaning cybersecurity compliance is no longer optional or based only on internal reporting. Instead, contractors must demonstrate verified compliance with the required CMMC level before they can receive or continue performing certain defense contracts.

One of the most important updates is that CMMC is now a mandatory contractual requirement. When a solicitation involves the handling of Federal Contract Information or Controlled Unclassified Information, the contract will specify the CMMC level that applies to the contractor’s information systems. Contract eligibility, option exercises, and performance extensions may depend on maintaining a current CMMC status.

The rule also introduces new mechanisms for tracking and verifying cybersecurity compliance across contractor systems:

• CMMC Unique Identifier (UID). Each contractor information system that undergoes a CMMC assessment receives a unique identifier. This identifier allows the Department of Defense to track assessment results for specific systems that process, store, or transmit FCI or CUI.
• Supplier Performance Risk System (SPRS). Assessment results and compliance records are stored in SPRS. Contracting officers use this system to verify whether a contractor maintains a current CMMC status before making award decisions.
• Affirming official requirements. Contractors must designate an affirming official who is responsible for confirming that the organization continues to comply with the applicable cybersecurity requirements. This official must periodically submit formal affirmations of ongoing compliance.

The rule also updates several key definitions to improve consistency across the regulatory framework. Terms related to CMMC status, compliance validation, and contractor responsibilities have been clarified to align with the broader CMMC program regulations. In addition, the scope of the requirements has been more clearly defined. The cybersecurity obligations apply specifically to contractor information systems that handle FCI or CUI in performance of the contract rather than to an organization’s entire enterprise environment.

Conditional and Final CMMC Certification Status

The CMMC framework allows contractors to hold either a conditional or a final certification status depending on the outcome of their cybersecurity assessment. This approach provides limited flexibility for organizations that are close to full compliance but still have a small number of issues that must be resolved.

A conditional CMMC status may be granted when an assessment identifies minor gaps that do not prevent the contractor from protecting sensitive information. In these situations, the contractor must document the remaining issues in a Plan of Action and Milestones (POA&M). This document outlines the specific deficiencies, the actions required to correct them, and the expected timeline for completion.

Contractors with conditional status are given up to 180 days to address the remaining deficiencies listed in the POA&M. During this period the company must implement the required corrective actions and demonstrate that the identified gaps have been resolved. If the contractor fails to complete the required remediation within the allowed timeframe, the conditional status may expire.

To obtain final CMMC certification, contractors must close all POA&M items and fully meet the cybersecurity practices required for the applicable CMMC level. Once these requirements are satisfied, the contractor receives a final certification status that remains valid for the defined certification period.

Contracting officers rely on the CMMC status recorded in the Supplier Performance Risk System when evaluating contractor eligibility. A contractor must maintain a current status at the required level in order to receive contract awards, exercise options, or continue performance on certain DoD contracts.

Phased Implementation Timeline for CMMC Requirements

The Department of Defense introduced a phased implementation approach to allow contractors time to adapt to the new cybersecurity requirements. Instead of applying the CMMC program to all defense contracts at once, the DoD is gradually expanding its use across solicitations and contracts that involve sensitive information.

The implementation timeline generally follows several stages:

• Initial phase. During the first years of the rollout, CMMC requirements appear only in selected contracts. Program offices decide which procurements will include the certification requirement.
• Expansion phase. As more contractors complete assessments and the certification ecosystem grows, the number of solicitations that include CMMC requirements gradually increases.
• Full implementation. After the transition period, CMMC requirements are expected to apply to all applicable DoD contracts where contractors process, store, or transmit Federal Contract Information or Controlled Unclassified Information.
• COTS exemption. Contracts that involve only commercially available off the shelf items are generally excluded from CMMC requirements. This exception helps reduce unnecessary compliance burdens for suppliers that provide standard commercial products.

Supply Chain Responsibilities and Subcontractor Compliance

CMMC requirements apply not only to prime contractors but also to subcontractors that handle Federal Contract Information or Controlled Unclassified Information during contract performance. When subcontractors process, store, or transmit this data, the applicable CMMC level must be flowed down through the subcontract.

Prime contractors are responsible for ensuring that their supply chain complies with the required cybersecurity standards. This means primes must verify that subcontractors meet the appropriate CMMC level before sharing sensitive information or awarding subcontracts.

Prime contractors are now responsible for:

• verifying subcontractor CMMC status
• ensuring proper flowdown of requirements
• protecting FCI and CUI across the supply chain
• maintaining documented cybersecurity compliance

Another challenge is the limited transparency of compliance data. Contractors cannot directly access another company’s records in the Supplier Performance Risk System. As a result, subcontractors often need to provide evidence of their CMMC status when working with prime contractors. These requirements reinforce cybersecurity expectations across the entire Defense Industrial Base supply chain.

Impact of the New Requirements on Small Businesses

The new cybersecurity requirements may create additional challenges for small defense contractors. Many small businesses that participate in the Defense Industrial Base do not have large internal IT teams or dedicated cybersecurity specialists. Implementing the required security controls, preparing for assessments, and maintaining compliance documentation may require new investments in technology, training, and external support.

To reduce immediate pressure on contractors, the Department of Defense introduced a phased rollout of the CMMC program. During the early stages of implementation, the certification requirement appears only in selected contracts. This approach allows companies more time to understand the requirements, strengthen their cybersecurity practices, and prepare for future assessments.

Another factor that helps reduce the compliance burden is the exclusion for contracts that involve only commercially available off the shelf items. Contractors that supply standard commercial products without handling Federal Contract Information or Controlled Unclassified Information are generally not subject to CMMC certification requirements.

Even with these accommodations, small businesses should begin preparing early. Companies that wait until certification becomes mandatory across most defense contracts may face delays or lose opportunities. Conducting early gap assessments and strengthening cybersecurity practices can help small contractors remain competitive in the evolving defense procurement environment.

How Defense Contractors Should Prepare for DFARS and CMMC Compliance

Defense contractors should take a proactive approach to preparing for DFARS cybersecurity requirements and CMMC certification. Because compliance may affect contract eligibility, companies should begin reviewing their current cybersecurity practices and identifying areas that require improvement.

A structured preparation process can help contractors reduce risk and avoid delays during future assessments. Key preparation steps include:

• identifying information systems that process, store, or transmit Federal Contract Information or Controlled Unclassified Information.
• conducting a gap analysis based on the security controls defined in NIST SP 800-171.
• determining which CMMC level applies to the organization or specific contracts.
• preparing for a third party assessment if the required level includes external certification.
• registering and maintaining assessment results in the Supplier Performance Risk System.
• implementing continuous monitoring of cybersecurity controls and system security practices.
• training employees on cybersecurity responsibilities and updating internal security policies.

By addressing these areas early, contractors can strengthen their cybersecurity posture and position themselves for successful participation in future Department of Defense procurement opportunities.

Conclusion: Cybersecurity Compliance Is Now a Core Requirement for Defense Contracting

Cybersecurity compliance is becoming a fundamental requirement for companies that want to work with the Department of Defense. The integration of the CMMC program into DFARS regulations means that contractors must now demonstrate verified cybersecurity practices when handling Federal Contract Information or Controlled Unclassified Information. In many cases, maintaining the required CMMC level will directly affect a company’s eligibility to compete for or continue performing DoD contracts.

As defense procurement continues to evolve, contractors will need to implement long term cybersecurity programs rather than treat compliance as a one time requirement. Organizations must maintain documented security practices, perform regular assessments, and ensure that their information systems remain aligned with the applicable standards. Proactive preparation will help companies avoid delays during certification and maintain their position in the defense market.

Navigating the complex federal contracting environment often requires experienced guidance. Price Reporter has been helping businesses establish and grow their government contracting operations since 2006. With more than 19 years of experience and support provided to over 1000 companies, the team assists contractors in understanding regulatory requirements, managing GSA contracts, and building sustainable government business strategies.

DFARS and CMMC Requirements: Frequently Asked Questions for Defense Contractors

What is the relationship between DFARS and the CMMC program?

DFARS establishes the contractual cybersecurity requirements that apply to companies working with the Department of Defense. These regulations define how contractors must protect sensitive government information such as Federal Contract Information and Controlled Unclassified Information. The CMMC program provides the certification framework used to verify that contractors actually meet those requirements. In other words, DFARS creates the rules while CMMC confirms that companies are following them.

Which defense contractors must comply with CMMC requirements?

CMMC requirements apply to contractors that process, store, or transmit Federal Contract Information or Controlled Unclassified Information during contract performance. The required certification level depends on the type of information involved and the sensitivity of the work being performed. Prime contractors as well as subcontractors may need to meet the required level if they handle this data. Companies that only supply commercial products and do not access government information may not be subject to the same requirements.

What is the difference between CMMC Level 1, Level 2, and Level 3?

The three CMMC levels reflect increasing levels of cybersecurity maturity. Level 1 focuses on basic cyber hygiene and applies to contractors that handle Federal Contract Information. Level 2 introduces more advanced security controls aligned with NIST SP 800-171 and applies to contractors that process Controlled Unclassified Information. Level 3 applies to the most sensitive defense programs and involves additional security requirements with assessments conducted by the Defense Industrial Base Cybersecurity Assessment Center.

How does the CMMC certification process work?

The certification process begins with identifying which contractor systems handle Federal Contract Information or Controlled Unclassified Information. Companies must then implement the required cybersecurity controls and prepare for an assessment. Depending on the CMMC level, the assessment may be a self evaluation or a review conducted by an authorized third party assessment organization. The results are recorded in the Supplier Performance Risk System and contracting officers use this information during procurement decisions.

How should defense contractors prepare for DFARS and CMMC compliance?

Preparation usually starts with identifying all information systems that handle sensitive government data. Contractors should then conduct a gap analysis against the security controls defined in NIST SP 800-171 to determine where improvements are needed. Companies may also need to establish internal cybersecurity policies, monitoring procedures, and employee training programs. Taking these steps early helps organizations avoid delays when certification becomes a requirement for contract eligibility.