CMMC Final Rule: A Guide for DoD Subcontractors

The post summarizes the DoD’s CMMC final rule (effective November 10, 2025), explaining the three certification levels (Level 1 for FCI, Level 2 for CUI requiring a C3PAO assessment, and Level 3 for the most sensitive CUI), the phased rollout and prime contractor flow-down verification requirements, the assessment scoring/conditional certification process, and immediate preparation steps (determine level, conduct gap analysis, create POA&M, and engage vendors) to avoid losing access to DoD contracts.