# DoD Phases CMMC Contract Requirements

The Department of Defense began phasing Cybersecurity Maturity Model Certification (CMMC) requirements into applicable contracts in November 2025, with implementation scheduled across three years. An assessment gap reported among small defense manufacturers—post-assessment scores averaged 133 points below companies’ self-reported readiness—highlights the risk of relying on internal estimates alone. Suppliers handling controlled unclassified information (CUI), including subcontractors subject to flow-down requirements, may need six months or more to prepare; procurement teams should account for documented readiness and remediation in contract planning and supplier risk reviews.

- Defense suppliers should map CUI flows, establish a documented gap baseline, and begin remediation early to reduce the risk of losing work on applicable DoD contracts.
- Prime contractors should assess whether subcontractors handling protected information are subject to CMMC flow-down requirements and factor supplier readiness into sourcing and performance-risk decisions.
- SSE, a CMMC Registered Provider Organization, offers preparation and gap-assessment support; the listed contacts are (314) 439-4700 and info@sseinc.com.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 23, 2026

### Government Entities
- U.S. Department of Defense (DoD)

### Vendors
- SSE (Registered Provider Organization providing CMMC preparation and gap-assessment support)

### Sources
- [Small Defense Manufacturers Face a Cybersecurity Reality Check | Quality Magazine](https://www.qualitymag.com/articles/100021-small-defense-manufacturers-face-a-cybersecurity-reality-check) - Quality Magazine