CMMC Phase I Affirmation is HERE!

The deadline is September 2025... Are you ready? 

Important clarifications provided by the DoD were recently released on the CMMC Phase I timeline and the impact on contracts after the effective date.

Check out the blog below released by our industry partner DTC Global for their insights as they break down what you are to expect with this fast approaching deadline.

 

Written by Regan Edens, Chairman of the CMMC Industry Standards Council (CISC) and Chief Transformation Officer of DTC Global, and Xavier LeMond, Director of Professional Services & Product Delivery at DTC Global.

__________________________________________________________________________

CAUTION HAZARD AHEAD CMMC Phase I Affirmation is Almost Here

By Regan Edens & Xavier LeMond, DTC Global

 

"CEIC-West was an outstanding event and Stacy Bostjanick provided important clarifications on the timeline and impact of CMMC Phase I. Mrs. Bostjanick comments confirmed the defense industrial base should look for the CMMC Phase I effective date to begin in September 2025. There are some final steps in the review and approval process for the President’s National Security Exemption for the CMMC rule language (48 CFR 252.204-7021), but this is expected without delay.

The OIARA regulatory standards create a window for the implementation of the clause for the release of the clause from June to July time frame. Then, a 60-day period delay to the effective date of the CMMC clause, DFARS 252.204-7021, beginning in August to September. The final differences between the CMMC Program Final Rule and the actual contract clause have created a great deal of confusion, so the process is explained in more detail in the article." 
- Regan Edens

 

The CMMC Phase Affirmation I timeline represents both an opportunity and a countdown clock. The decisions and preparations made over the next several weeks will not only determine your eligibility to compete for DoD contracts but also your capacity to keep them. 

What CMMC Phase I Affirmation means for your organization

As we shall explain, CMMC Phase I is likely to begin in September 2025, triggered by the effective date of the final DFARS 252.204-7021 contract clause. Don’t think “self-assessment” in CMMC Phase I is the same old email “yes” and wink in previous years.  The DoD is intentionally ratcheting down Organizations Seeking Affirmation (OSAs) to ensure they are accountable for their current status while feeling the pressure to fully meet requirements. 

Eligibility Triggers Under CMMC Phase I

CMMC Phase I introduces a set of eligibility conditions tied not only to compliance readiness but also to the timing of Request for Quotes (RFQs) or Request for Proposals (RFPs) and contract awards. These conditions are grounded in 32 CFR § 170.16 and § 170.23 and are driven by the effective date of the final DFARS 252.204-7021 rule, anticipated by the DoD to be in September 2025*. Remember that the timing of the impact of these requirements is based on YOUR or YOUR PRIME CONTRACTOR’s business development pipeline.

 

RFQs or RFPs Issued Before and After September 2025*

The DoD typically does an “end of the year” spending spree in the August to September time frame. The end-of-year awards could be subject to a clause after the effective date. If a solicitation is released prior to the effective date (September 2025*), it will not contain the DFARS 7021 clause. However, if the award occurs after September 2025*, the eligibility clause may still be added to the awarded contract.

 

Are you expecting “end of year awards” or targeting contract solicitations and awards early in FY2026?

End of year 2025 - Remember, those subcontracts will likely be released AFTER the effective date.  When are the contracts or subcontracts you seek expected to be released?

Fiscal year 2026 – Also remember, the fiscal year usually incorporates a funding delay, which funds contracts for awards in early November, and the release of solicitations picks up pace from there.

 

Confirm your readiness matches your sales pipeline for “end of year awards” or solicitations and awards early in FY2026?

Questions to ask Sales - 

• Are there any "end of year" awards expected in September? 
• What solicitations and awards are expected for projects AFTER September in the new fiscal year? 

Question to ask Production - Are we ready to PERFORM the contracts within an environment(s) that meets the Affirmation requirements?

Question to ask Supply Chain - Are we ready to hold our supply chain accountable for CMMC Phase I requirements with the appropriate documentation?

Questions to ask IT – 

• ·      What is our current SPRS Score?
• ·      Have we addressed all the prohibited POA&M Items?
• ·      Is our SPRS Score 80% (88) or better?
• ·      Do we have the appropriate, adequate, and sufficient evidence to substantiate our SPRS Score?
• ·      Are we able to complete the implementation of all 110 controls within 180 days after we “Affirm” the latest entry of the score within the SPRS system?
• ·      Is a Senior Executive willing to attest to our SPRS Score?

What is your risk to revenue without DoD contract eligibility after September?

Contract Eligible or Ineligible:  If the prime or subcontractor fails to meet the required eligibility within the 180 days, the contract will go into remediation.

 

When a new solicitation is released after the effective date, it will automatically include the DFARS 252.204-7021 clause as required by 32 CFR  § 170.

Under these conditions:

• The prime and any named subcontractors must meet Phase I eligibility requirements before an award is made.
• No 180-day grace period applies prior to award; eligibility must be demonstrated up front.
• Upon award, the prime contractor is bound by the DFARS 7021 clause, and subcontractor compliance becomes a mandatory condition for subcontract issuance.

For current solicitations or contract options during CMMC Phase I, DoD may grant the prime contractor a 180-day supervised period to satisfy the eligibility requirements after award; however, do not expect this consideration.

During that period:

• The prime contractor, whether required to attest or, in some cases, certify, must meet all the necessary requirements to achieve the requirements of a CMMC Level 2 status.
• All subcontractors named in the award must also comply, as mandated by 32 CFR § 170.23(a)(3), and meet the same CMMC requirements as the prime contractor.

 

Implications for Subcontractors

It's also important to note that CMMC requirements will be enforced across the supply chain. This means all subcontractors engaged in contract performance must also meet the same SPRS score threshold and documentation standards in order to be eligible for subcontract awards as required by 32 CFR § 170.23(a)(3). Their SPRS score and documentation must meet the required minimum to preserve flow-down compliance.

DFARS clause 252.204-7021 stipulates that contractors will be responsible for flowing down the CMMC requirements to their subcontractors. Prime contractors must ensure their subs meet the same CMMC eligibility thresholds, including SPRS score minimums and documentation readiness.

Prime contractors bear the responsibility of ensuring their partners, subcontractors, and suppliers meet CMMC Phase I requirements in order to be eligible for awards. If you're relying on a subcontractor to perform work involving Controlled Unclassified Information (CUI), their inability to meet CMMC readiness could jeopardize your entire organization’s eligibility.

 

 

CMMC Phase I Requirements – Minimum SPRS Score and Conditional Level  CMMC Status

For organizations that receive and develop information that qualifies as CUI, CMMC Level 2 compliance will likely be required. In CMMC Phase I, the minimum requirement is an 80% of the self-assessed score of 88. The DoD Assessment Methodology, v.1.2.1 is used to determine the score. Read and follow the document closely.

IMPORTANT: Do not presume the “scope” you used in past self-assessments matches the more recent scoping guidance provided in the CMMC Scoping Guide, v.2.13. There are critical, but subtle errors in the previous versions, and it’s very important you “forget what you knew” and closely read the latest version.

Your scope is primarily determined by the CMMC assets identified in Table 1 of the CMMC Scoping Guide, 2.13, which consist of three factors:

• ·      The assets, systems, and services you need to perform the contract;
• ·      The assets, systems, and services that are permitted to flow CUI during the performance of the contract;
• ·      The assets, systems, and services your organization needs to address the security protection requirements, which involve the processing, storing, and transmitting of security protection data. 

Take the important steps to identify and align an accurate scope based on your contract performance and clarified guidance BEFORE beginning or updating your SPRS score.

 

Your scope must match your SPRS score and the evidence that you submit to the Supplier Performance Risk System (SPRS). When all requirements for affirmation have been met, your organization is granted a Conditional Level 2 CMMC Status, butthat status is provisional or temporary, and time-bound until all the requirements have been satisfied.

This threshold assumes a self-assessment based on NIST SP 800-171, DoD Assessment Methodology v.1.2.1, and your ability to demonstrate:

1.    Implemented controls, and
2.    Documented artifacts supporting that implementation. Remember that the exact evidentiary requirements and standards apply to score and documentation as if you were undergoing a DIBCAC High Audit or an actual C3PAO assessment. Any lack of adequate or sufficient evidence should result in no score.

Now, there are certain security controls will are not permitted to be addressed as POA&M items; specifically, controls categorized as prohibited are listed in the CMMC Program’s Final under 32 CFR §170.21(a)(2)(iii). These must be fully implemented to even be eligible to submit a score for Affirmation. None of these items may be on a POA&M at any time, regardless of the timing of the solicitation, contract award, and regardless of conditional status.

Again, Conditional Level 2 CMMC Status is not a full authorization. It gives your company a 180-day window to complete the following actions:

• Fully implement all 110 NIST SP 800-171 controls,
• Remediate permissible POA&M items,
• Successfully complete a POA&M closeout assessment.

 

At the end of the 180-day window, the conditional status expires. If the organization fails to achieve full implementation and assessment closure by that deadline, it becomes ineligible to perform on the contract. This has the potential to impact contract execution and continuity of business operations.

If the prime contractor does not meet the requirements within the 180-day supervised period, the contract will go into remediation.

 

Once this phase begins, all new solicitations and contract awards will be required to include at least one of the following:

• CMMC Level 1 Self-Assessment (with FCI only), or
• CMMC Level 2 Self-Assessment (with CUI), or
• CMMC Level 2 Certification Assessment (by a C3PAO)

This requirement becomes a condition of award, meaning if your organization is not in alignment with these requirements by the time of proposal or award, you will be ineligible for contract consideration.

 

CMMC Phase I doesn't just apply to new contracts after September*. If your current contract includes option periods, the government may retroactively apply the CMMC requirement during the execution of those options, particularly for high-priority programs. That means even legacy awards may fall under the same scrutiny.

 

Understanding the Reliability of the August-September 2025* Start Date

How firm is the August-September 2025* estimated start date for CMMC Phase I? 

Many organizations are asking the same question. Why would Mrs. Bostjanick believe the effective date will be in September? While the next steps were described by her during her address at CEIC-West, the federal rulemaking process also incorporates additional activities outside the normal rulemaking.

After a proposed rule’s public comment period ends, the Office of Information and Regulatory Affairs (OIRA), a division of the Office of Management and Budget (OMB), reviews and reconciles public feedback before finalizing the rule. This reconciliation process typically takes 60 to 90 days, depending on the number and complexity of comments. Within this process, the rule will be reviewed for final consideration for the National Security Exemption.

The CMMC Final Rule (32 CFR Part 170) was published on October 15, 2024, and became effective on December 16, 2024. However, the DFARS clause that activates CMMC requirements in DoD contracts—DFARS 252.204-7021, under 48 CFR Part 204 (DFARS Case 2019-D041), requires its own rulemaking cycle.

OIRA formally began the final rule drafting process for DFARS 252.204-7021 on April 9, 2025.

 

Understanding the Reliability of the August-September 2025* Start Date

How firm is the August-September 2025* estimated start date for CMMC Phase I? 

Many organizations are asking the same question. Why would Mrs. Bostjanick believe the effective date will be in September? While the next steps were described by her during her address at CEIC-West, the federal rulemaking process also incorporates additional activities outside the normal rulemaking.

After a proposed rule’s public comment period ends, the Office of Information and Regulatory Affairs (OIRA), a division of the Office of Management and Budget (OMB), reviews and reconciles public feedback before finalizing the rule. This reconciliation process typically takes 60 to 90 days, depending on the number and complexity of comments. Within this process, the rule will be reviewed for final consideration for the National Security Exemption.

The CMMC Final Rule (32 CFR Part 170) was published on October 15, 2024, and became effective on December 16, 2024. However, the DFARS clause that activates CMMC requirements in DoD contracts—DFARS 252.204-7021, under 48 CFR Part 204 (DFARS Case 2019-D041), requires its own rulemaking cycle.

OIRA formally began the final rule drafting process for DFARS 252.204-7021 on April 9, 2025.

 

Timeline Calculation for Phase I Start

• Issuance Period: Assuming the standard 60–90 day reconciliation timeline from April 9, 2025, the DFARS rule could be issued between June 8 and July 8, 2025.
• Effective Date Delay: Once issued, federal rules usually include a 60-day delay before becoming enforceable, allowing contractors and agencies time to prepare.
• If issued on June 8, the effective date would be August 7, 2025.
• If issued on July 8, it would take effect by September 6, 2025.
• Mrs. Bostjanick’s comments sustain the later September timeframe.

 

The September 2025* estimate for CMMC Phase I is not arbitrary; it falls squarely within the projected window for the final rule’s effective date and applies to both new contracts and option years of existing awards when CMMC clauses are added. It allows organizations to plan for the earliest likely start. Given that some awards or solicitations may be timed to coincide with the effective date, assuming a September 2025* enforcement window provides a more conservative, risk-aware planning target.

 

Immediate Preparation Is Critical

Waiting until the September 2025* enforcement date is a gamble. Achieving an SPRS score of 88+ requires not just implementation but evidence gathering, policy development, and ongoing documentation—tasks that often involve multiple stakeholders across IT, legal, HR, and operations.

Once a contract is awarded, the 180-day remediation clock starts ticking. If your team isn’t already on the path to implementing and tracking control status, you could find yourself under contract and out of time.

Additionally, the DoD can retroactively require CMMC status for option periods on existing contracts during any Phase, increasing compliance pressure.

Last but not least, be aware that the DoD may require Level 2 (C3PAO) for select contracts, even in Phase I, accelerating the need for third-party certification.

 

The Bottom Line

CMMC Phase I isn't just a compliance milestone; it's a strategic threshold. For your organization, it's the line between being eligible to compete and being left behind. The 180-day clock is not generous. Think of it as a buffer for the prepared, not a cushion for the unready.

Success in CMMC Phase I will depend on urgency, clarity, and action – start now.

  

* = The projected September 2025 start date for CMMC Phase I is an estimate based on the OIARA rulemaking process and Mrs. Bostjanick’s comments at CEIC-West during the Q&A period.

 

© 2025 DTC Global, LLC All rights reserved.