Last reviewed: July 1, 2026 · By The Defense Compliance Report Editorial Team

48 CFR CMMC Final Rule: What DFARS 252.204-7021 and 252.204-7025 Mean for Your Contracts

The 48 CFR CMMC final rule is the Department of Defense acquisition rule that turned the Cybersecurity Maturity Model Certification (CMMC) from a program on paper into a hard condition of award for the DoD contracts it applies to. It was published in the Federal Register on September 10, 2025 — 90 FR 43560, pages 43560–43577 — and took effect November 10, 2025.

What the rule requires of you comes down to one thing: the CMMC level and assessment type written into your specific contract. And here is the wrinkle most articles published in 2025 miss — on February 1, 2026, a separate federal overhaul quietly renumbered several of the clauses sitting right next to CMMC. We read the rule, the clause text on Acquisition.gov, and the Department of Defense deviation memos so you can see exactly what is current, what changed, and what to do about it.

Who this page is for:primes, subcontractors, and the people who own the decision — CISOs, IT directors, FSOs, compliance managers, contracts officers, and small-business owners — who just saw CMMC show up in a solicitation, a contract mod, or a prime’s flow-down notice and need to know what it actually requires.

Who this page is not for:anyone looking for a “CMMC in five minutes” explainer or a ranked list of “best” providers. This is the contract-rule page. It tells you what changed, what can block an award, and how to figure out your path before you spend money.

The bottom line, in one screen

The one honest caveat before you read further

The right CMMC provider isn’t the same for every contractor — the category you need (a C3PAO, an RPO, an MSSP, a GRC platform, or a CUI enclave) depends on your required CMMC level, whether you handle FCI or CUI, your assessment type, your cloud and IT environment, and your contract timeline. The contract clause sets your level, not a checklist.

What is the 48 CFR CMMC final rule?

“48 CFR” is simply Title 48 of the Code of Federal Regulations — the Federal Acquisition Regulation (FAR) system. DFARS is DoD’s supplement to it. So when someone says “the 48 CFR CMMC rule,” they mean the contracting side of CMMC, not the program side. The rule amends four parts of the DFARS: Part 204 (administrative and cybersecurity procedures), Part 212 (commercial products and services), Part 217 (special contracting methods), and Part 252 (the solicitation provisions and contract clauses).

One precision point worth getting right: this rule was issued by the Department of Defense. You may see “Department of War” used in some 2025–2026 materials, but the FAR and DFARS — the regulations that actually govern your contract — still use “DoD,” and that is what we use here.

48 CFR vs. 32 CFR: the two CMMC rules, side by side

This single table clears up more confusion than anything else on the page. If you only remember one thing: 32 CFR is the program; 48 CFR is the contract hook.

Sources: 32 CFR Part 170 final rule (89 FR 83092); 48 CFR CMMC final rule (90 FR 43560); eCFR 48 CFR Subpart 204.75.

When did the 48 CFR CMMC rule take effect, and what phase are we in?

The four phases each begin one calendar year after the last. DoD deliberately staged it so the assessment ecosystem — and contractors — could catch up. Here is the full chronology, including the 2026 clause overhaul that most timelines skip:

Here is how the phases translate into what actually shows up in solicitations:

Source: 32 CFR § 170.3(e). The regulation sets four phases, each beginning one calendar year after the prior phase; dates are derived from the November 10, 2025 anchor.

What changed from the proposed rule to the final rule?

If you have older notes or a saved PDF, they may describe the proposed 48 CFR rule from August 15, 2024 (89 FR 66327). A few things moved between proposed and final:

• →The final rule updated and codified the definitions at DFARS 204.7501 to align with 32 CFR Part 170, and placed them in the 252.204-7021 clause and the 252.204-7025 provision.
• →It renamed the "DoD unique identifier" to the CMMC unique identifier (CMMC UID) to match SPRS.
• →It removed certain proposed notification requirements (such as separately reporting compliance lapses to the contracting officer), relying instead on the 7012 incident-reporting clause and the annual affirmation.
• →It confirmed that subcontractors also submit affirmations and self-assessment results in SPRS, and that primes cannot view a subcontractor's SPRS record.

Which DFARS clauses should you look for?

Read your solicitation for these. This is your clause map, with current status as of July 1, 2026.

Sources: Acquisition.gov clause text for DFARS 252.204-7021, 252.204-7025 (both NOV 2025), and 252.204-7012 (MAY 2024); the DoD DFARS RFO class-deviation page. Codified regulation pages and class-deviation text can show different clause numbers during the transition.

For a full explanation of each clause and its current text, see our dedicated guides: DFARS 252.204-7021 explained, DFARS 252.204-7025 explained, DFARS 252.204-7012 explained, and DFARS 7019 and 7020 after the 2026 overhaul.

What changed on February 1, 2026 (the FAR Overhaul)?

We flag this because it is the single most common way a competing page is now out of date. Many of the top results for “48 CFR CMMC final rule” were written between September and November 2025 and still list 7019 and 7020 as active clauses. As of February 1, 2026, that is no longer accurate. Here is what actually happened — and, just as important, what did not.

What was eliminated (7019) and what moved (7020 → 240-7997). DFARS 7019 was the provision that required contractors to post a “Basic” NIST SP 800-171 self-assessment score in SPRS. Under the RFO Part 40 / DFARS Part 240 deviation text, that older standalone Basic-assessment mechanism is not carried forward in the same 7019/7020 form. DFARS 7020 — DoD’s authority to run Medium and High assessments — moved to the new DFARS Part 240 and is now numbered 252.240-7997. For CMMC solicitations, the CMMC-specific status, CMMC UID, self-assessment-result, and affirmation obligations now sit in the 252.204-7025 provision and the 252.204-7021 clause.

What did not change — and why it matters more than the renumbering. Your underlying obligations are intact. If you handle CUI, you still implement all 110 NIST SP 800-171 Revision 2 requirements, still maintain a System Security Plan (SSP), still report cyber incidents within 72 hours under 7012, and still self-assess or obtain a C3PAO assessment as your contract specifies. The DoD did not weaken enforcement here. It removed a parallel, pre-CMMC self-attestation mechanism and elevated CMMC as the primary path.

What must be current in SPRS before award?

Here is what needs to be in order:

One nuance people miss: SPRS stores assessment and scoring information — assessment date, score, scope, CAGE code, SSP name, confidence level — but you do not perform the assessment inside SPRS. Here is the regulation-stated obligation versus where you actually confirm it:

Getting that last row wrong is how contractors assume they are “in SPRS” when the required result is not actually there.

How do Level 1, Level 2 (Self), Level 2 (C3PAO), and Level 3 differ?

Source: 32 CFR Part 170 (§ 170.14 for the model; §§ 170.15–170.18 for assessment mechanics). NIST SP 800-171 Rev. 2 supplies the 110 Level 2 requirements; NIST SP 800-172 supplies the Level 3 enhanced subset.

For the full comparison of self-assessment vs. third-party paths, see our CMMC self-assessment vs. C3PAO guide and CMMC levels overview.

Does the 48 CFR rule require a C3PAO assessment?

• →When Level 2 (Self) may be enough: some CUI-handling contractors are permitted to self-assess when the contract specifies Level 2 (Self). You cannot self-select this path if the clause requires Level 2 (C3PAO) — the fill-in decides.
• →When a C3PAO is the wrong first hire:if your evidence is not assessment-ready, booking a scarce C3PAO slot early usually means paying for readiness twice. In DoD’s own framing, the assessment verifies what you have already implemented — it is not where implementation happens. The sequence that saves money is readiness first, assessment when ready, and the two kept appropriately separate: a C3PAO must manage strict conflict-of-interest and impartiality requirements for Level 2 certification assessments, so the firm that remediates your environment generally cannot also serve as your C3PAO for that same engagement.

The DCR 48 CFR Award-Eligibility Action Matrix

This is the asset we built because no single competing page had it: a map from each rule and clause to the trigger, the evidence you need, what can block or slow your award, and the provider category that usually comes first. We assembled it by reading the Federal Register final rule, cross-checking 32 CFR Part 170, and confirming the current clause text on Acquisition.gov.

Methodology: We read the 48 CFR final rule (90 FR 43560), compared it against 32 CFR Part 170, and confirmed clause text for 7012, 7021, and 7025 on Acquisition.gov, plus the February 2026 RFO deviations. We did not rank named providers or verify any provider’s Cyber AB Marketplace status on this page.

Who does DoD estimate the rule actually affects?

Here is that estimated Year-4 mix, reframed for a decision instead of a headline:

Source: DoD’s regulatory flexibility analysis in the CMMC rulemaking, published with the final rule. The 337,968 total and 229,818 small-entity figure are stated in that analysis; DoD notes the assessment mix is an estimate that will shift with program-office discretion.

The phase-in was also deliberately gentle on small business early: DoD estimated only 1,104 small entities affected in year one, rising to 5,565 in year two and 18,554in year three. Two honest reads of this data: first, if you are small and handle only FCI, your likely path is a Level 1 self-assessment, not a six-figure certification. Second, “small” and “later” are not “exempt” — most impacted entities are small, and the requirement is coming for the majority of the base. The winning move is to know your number, not to assume you are outside the rule.

What does the 48 CFR rule mean for subcontractors and flow-down?

Who sets a subcontractor’s level? For the prime, the program office or requiring activity sets it. For subcontractors, the prime (or the next higher-tier contractor) determines it using the scoping rules, based on the information being flowed down. There is a practical catch: a prime cannotsimply look up a subcontractor’s status in SPRS, so primes have to verify compliance independently, contractually.

If you are a prime building a supplier-verification request, ask for what confirms status — without ever collecting sensitive data:

What is conditional CMMC status, and can it support an award?

Treat conditional status as a countdown, not a workaround. A Plan of Action and Milestones (POA&M) is a document that lists your open items, the resources to fix them, and scheduled completion dates. You reach Finalstatus by closing out a valid POA&M inside the window — closeout is performed by you (for self-assessed levels), your C3PAO (for Level 2 C3PAO), or DIBCAC (for Level 3). Miss the 180 days and the CMMC status expires, which can put a current award and future eligibility at risk. Note too that not every requirement is POA&M-eligible; some must be fully implemented before any status is issued. For the full rules, see our Conditional Level 2 and POA&M closeout guide.

What contracts are excluded, delayed, or phased in?

The 48 CFR rule does not mean every DoD transaction instantly carries the same CMMC requirement. During the phase-in, whether the clause appears depends on the program office’s determination; after the phase-in completes, use broadens to all applicable contracts involving FCI or CUI on contractor systems — with one clear exclusion: acquisitions solely for commercially available off-the-shelf (COTS) items. The COTS definition is aligned with FAR 2.101, so this is a specific, checkable boundary.

• →Watch the “commercial vs. solely COTS” trap.A contract can be “commercial” under FAR Part 12 and still carry a CMMC requirement. The exclusion is narrow — it applies only when the acquisition is exclusivelyfor COTS items. Do not assume “we sell commercial products” means “we are exempt.”
• →Existing contracts, options, and modifications. A contracting officer can, at their discretion, add CMMC requirements when exercising an option or modifying a contract. That is why a lapsed SPRS status or affirmation can matter on a contract you already hold, not just on a new bid.
• →“Small business” is not a blanket exemption.As DoD’s own estimates show, most impacted entities are small businesses. The right posture for a small DIB supplier is not “we’re too small to matter” — it is to read the clause, confirm your FCI/CUI scope, and verify your SPRS status. Being small usually changes your level, not your obligation to check.

The fastest compliant next step after reading the 48 CFR rule

1. Find DFARS 252.204-7025 in the solicitation.
2. Identify the required CMMC level and assessment type in the fill-in.
3. Confirm whether DFARS 252.204-7021 is in the contract or expected at award.
4. Confirm whether the work involves FCI, CUI, or solely COTS.
5. Identify the systems that will process, store, or transmit FCI/CUI.
6. Verify your current SPRS status, CMMC UID, and affirmation.
7. Match the gap to a provider category — RP/RPO, MSP/MSSP, GRC platform, CUI enclave, or C3PAO.

That last step is where most of the money is won or lost. Our CMMC Path Framework exists to route you to the right category — never a ranking, never compliance advice — based on the facts above.

This is editorial category routing based on verified regulatory facts — not a ranking, an endorsement, or compliance advice. The category you actually need depends on your contract.

Common mistakes that cost a bid or slow an award

The costliest CMMC mistakes are usually not failed controls — they are misreadings of the rule. Contractors lose time and eligibility by confusing the two rules, assuming every Level 2 path needs a C3PAO, missing an SPRS or affirmation requirement, or treating conditional status as permanent. Here are the ones we see most often:

• ×Reading the 32 CFR program rule as if it set your contract deadline (the 48 CFR clause does).
• ×Treating 7012 / 7019 / 7020 as identical to the CMMC clauses 7021 / 7025.
• ×Relying on 7019/7020 clause numbers that were eliminated or renumbered on February 1, 2026.
• ×Ignoring the 252.204-7025 fill-in and self-selecting a level.
• ×Missing a current annual affirmation in SPRS.
• ×A missing or mismatched CMMC UID.
• ×Assuming Level 2 always means C3PAO.
• ×Booking a C3PAO before remediation and evidence are ready.
• ×Treating conditional status as a long-term posture instead of a 180-day countdown.
• ×Accepting a subcontractor's verbal assurance instead of contractual evidence.
• ×Sending CUI to a supplier before verifying the required status path.
• ×Reading "commercial" as "solely COTS."
• ×Using NIST 800-171 Revision 3 language as if it controlled CMMC Level 2 today.

How we verified this page

This page is built from primary-source rule text and official program materials — not vendor marketing. We verified the 48 CFR DFARS final rule, the 32 CFR CMMC program rule, the relevant clause text, the phased-implementation schedule, the NIST publication mappings, and the February 2026 clause changes as of the last-verified date below. We did not evaluate named providers on this page.

What we did not verify here:any named provider’s Cyber AB Marketplace status, provider pricing, provider success claims, or customer outcomes. We publish no reviews, ratings, or “best provider” awards on this page, and we imply no endorsement by Cyber AB, DoD, DIBCAC, or NIST.

Last verified: July 1, 2026. Regulatory dates, DFARS clause text, SPRS procedures, and NIST mappings should be re-verified before each major CMMC phase change — the next is Phase 2 on November 10, 2026.

Frequently asked questions about the 48 CFR CMMC final rule

Your next move

You now know what the 48 CFR CMMC final rule is, when it took effect, which clauses control, what changed in 2026, and what can block an award. The one thing a general page can’t do is tell you yourrequired level, scope, and path — that comes from your clause and your FCI/CUI handling. Don’t buy the wrong kind of help to solve a problem you haven’t scoped.