DoD Releases Long-Awaited Final Rule Implementing Cybersecurity Maturity Model Certification Contract Clause
On September 10, 2025, the Department of Defense (DoD) published the long-awaited final rule implementing the Cybersecurity Maturity Model Certification (CMMC) program into the Defense Federal Acquisition Regulation Supplement (DFARS). The rule takes effect on November 10, 2025, marking the date when contracting officers may begin inserting CMMC clauses into new solicitations and contracts.1 The DFARS rule aligns with the CMMC program rule issued under Title 32 in December 2024,…

