District Tech Group | Security Made Simple

If your company works with the Department of Defense — or wants to — there's something you need to know: the rules just changed.

As of November 10, 2025, a new cybersecurity requirement called CMMC is now legally enforceable in DoD contracts. It's been in the works for years, and now it's real. If you handle government information and you're not compliant, you can't bid on new contracts. It's that simple.

Here's what it means, what's required, and what you should be doing right now.

So What Is CMMC?

CMMC stands for Cybersecurity Maturity Model Certification. It's the DoD's way of making sure every company in the defense supply chain — from large prime contractors down to small subcontractors — is actually protecting sensitive government information.

Two types of information are at the center of this:

FCI (Federal Contract Information) — basic information related to government contracts.
CUI (Controlled Unclassified Information) — more sensitive data like technical specs, personnel records, or export-controlled material.

If your business touches either of these — even as a subcontractor — CMMC applies to you.

The Three Levels — Which One Do You Need?

CMMC has three certification levels based on how sensitive the information you handle is:

Level 1

You handle basic FCI. Requires an annual self-assessment. 15 basic security controls. Most companies can handle this in-house.

Level 2

You handle CUI. This is where most defense contractors land. Requires 110 security controls based on NIST 800-171. Starting November 2026, you'll need a certified third-party assessor (C3PAO) to verify your compliance — not just a self-assessment.

Level 3

You handle the most sensitive CUI. Requires a direct government assessment. Only applies to a small group of high-priority contractors.

If you're not sure which level applies to you, that's the first thing to figure out — and it starts with knowing what kind of information your contracts involve.

The Timeline: What's Happening and When

Here's the four-phase rollout you need to know:

Phase1

Now (November 10, 2025)

CMMC requirements are appearing in new DoD contracts. Level 1 and Level 2 self-assessments are required at the time of contract award. No certification = no contract.

Phase2

November 10, 2026

Level 2 third-party assessments (C3PAO) become required. Self-assessment alone won't cut it for most CUI contracts. This is the date most contractors are racing toward.

Phase3

November 10, 2027

Level 3 government assessments begin rolling in.

Phase4

November 10, 2028

Full mandatory compliance across the entire defense supply chain. No waivers. No exceptions.

The clock is running. And November 2026 is closer than it looks.

Here's the Problem: Almost Nobody Is Ready

This is where it gets serious.

As of Phase 1 going live, only 431 organizations across the entire defense industrial base had achieved final CMMC Level 2 certification. The DoD estimates roughly 80,000 companies will need it. That's less than 1% of contractors actually ready.

431

Certified

~80,000

Need Certification

<1%

Ready

And it's not just the certification itself — the foundational work isn't done either. Fewer than half of defense contractors have completed a System Security Plan (SSP) or implemented all 110 NIST 800-171 controls. These aren't optional extras. They're prerequisites.

The companies that wait until 2026 to start will be scrambling for assessors, rushing remediation, and potentially losing contracts in the process.

What You Should Be Doing Right Now

Whether you're a prime contractor or a small subcontractor, here's the sequence:

Figure out your level.

Do you handle FCI, CUI, or both? What level will your contracts require? If you don't know, find out immediately.

Run a gap assessment.

Compare your current security posture against the CMMC requirements. Where are you falling short? This is your roadmap.

Build your documentation.

Get your System Security Plan (SSP) and Plan of Action & Milestones (POA&M) in order. Assessors will ask for these.

Remediate the gaps.

Implement the controls you're missing — access management, incident response, data protection. This takes time. Budget 6–12 months minimum for Level 2.

Check your subcontractors.

If you're a prime, CMMC flows down. You're responsible for ensuring any subcontractor handling FCI or CUI is also compliant. Start those conversations now.

Book your C3PAO early.

Certified third-party assessors are already in high demand. If you need a Level 2 assessment by November 2026, you can't wait until summer 2026 to schedule it.

Not Sure Where You Stand? Start Here.

At SignalShield, we offer a $500 Cybersecurity Gap Assessment specifically designed for defense contractors. In plain English, we'll tell you exactly where you stand against CMMC requirements, what needs to get done, and how to prioritize it.

No jargon. No fluff. Just a straight look at your current posture and a clear action plan.

CMMC Is Here. Is Your Business Ready?