# DoD Implements CMMC Contract Requirements

The Department of Defense’s CMMC rollout is governed by the program rule in 32 CFR Part 170, effective December 16, 2024, and the DoD acquisition rule, DFARS Case 2019-D041, effective November 10, 2025, which incorporates CMMC requirements into covered solicitations and contracts and began the phased rollout. DoD contractors and subcontractors must check each applicable solicitation and contract for the required CMMC status, obtain the corresponding assessment, and maintain that status for the contract’s duration.

- Companies pursuing DoD work should review each solicitation and contract to determine the CMMC status and assessment required for that procurement.
- Prime contractors should account for applicable CMMC requirements in subcontracting, since covered subcontracts are also in scope.
- Because the acquisition rule is in effect and the phased rollout has begun, contractors should align their assessment status with the requirements of each active or prospective contract.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 29, 2026

### Government Entities
- U.S. Department of Defense (DoD)

### Sources
- [CMMC Final Rule: Two Rules and Four Phases — CASRAI](https://casrai.org/guides/cmmc-final-rule) - CASRAI