What happened
A practitioner piece published by DataBreachToday makes the case that the Cybersecurity Maturity Model Certification is now a contracting reality rather than a future concern. The Department of Defense states that phased implementation has begun, with Phase 1 running from November 10, 2025 through November 9, 2026, focused primarily on Level 1 and Level 2 self-assessments. The first phase is not approaching. It is more than halfway through.
The article, drawing on interviews with Skip Chapman of Fortra and Marc Zurcher of Coalfire, argues that CMMC is usually delegated to IT or security teams when the decisions it forces are executive ones. Chapman frames the question bluntly: if a company handles Federal Contract Information or Controlled Unclassified Information, it must be compliant or risk losing its DoD business. Zurcher advises starting with revenue, because a business that cannot make money cannot survive, however good the mission.
The piece also notes that civilian agencies are adding CMMC language to contracts, and that federal CUI obligations can reach subcontractors, university research facilities and state and local government work. Levels are tiered: Level 1 for basic safeguarding of FCI, Level 2 for CUI, aligned to NIST SP 800-171 Revision 2, and Level 3 for higher risk programs, tied to NIST SP 800-172.
Why this is a GRC story
Scope is the budget. Under 32 CFR 170.19 the assessment scope must be specified before assessment, and DoD Level 2 scoping guidance explains how asset categories inform the boundary. Organisations that contain CUI in a small well governed enclave face far less work than those where it has spread across systems, users and locations. Scoping is the highest leverage activity available, and it is cheap next to remediation.
The governing constraint is evidence, not controls. Many organisations already run controls that would satisfy a large share of the requirements. What they cannot do at short notice is prove it. Evidence collection is an operating routine rather than a project phase, so it has to be designed early and owned by someone whose day job is not the assessment.
Contract terms can move faster than the government timetable. Existing contracts can be modified at any time to add CMMC requirements, and the obligation begins when that modification lands. Prime contractors are free to impose earlier deadlines on suppliers, so a roadmap that waits for a formal clause will be overtaken.
Framing decides funding. Presented as an IT checklist, certification competes with every other IT cost and usually loses. Presented as revenue protection with a named executive sponsor and monthly reporting, it behaves like the business continuity issue it is.
What to watch
Watch the contracts rather than the framework. The signal that matters is a CMMC clause or a prime contractor readiness questionnaire, not a policy update. Watch too whether assessment capacity becomes a bottleneck, since a fixed pool of authorised assessors meeting a large population of contractors resolves in the assessors' favour.
For defence suppliers in the middle of this, the first step is small and unglamorous: map where CUI actually lives and who touches it. Without that map, every estimate, budget and timeline that follows is a guess dressed up as a plan.
Attribution: Analysis based on DataBreachToday and related public reporting. This article is original commentary, not a repost of the source material.