Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

On September 10, 2025, the Department of Defense (DoD) published its final Cybersecurity Maturity Model Certification (CMMC) rule in the <a href="https://www.federalregister.gov/documents/2025/09/10/2025-17359/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of">Federal Register</a>, which takes effect on November 10, 2025. This “CMMC Acquisition Rule” officially begins the rollout of cybersecurity requirements across DoD contracts. Specifically, DoD will implement CMMC requirements in four phases over a three-year period, based on the certification level applicable to a DoD contract solicitation or bid.

contentpilot/introduction

core/heading

CMMC is a major DOD program built to protect the defense industrial base (DIB) from cyberattacks that compromise government-related data. The CMMC model is designed to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) shared with defense contractors and subcontractors during contract performance.

core/paragraph

Federal Contract Information (FCI): As defined in section 4.1901 of the Federal Acquisition Regulation (FAR), FCI is “information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, excluding information provided by the Government to the public (such as that on public websites) or simple transactional information, such as that necessary to process payments.”

core/list-item

Controlled Unclassified Information (CUI): As outlined in 32 CFR 2002.4(h), CUI is “information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls.” For more details on specific CUI categories and subcategories, see the DoD CUI Registry.

Verification Component: CMMC builds on existing trust-based cybersecurity regulations in <a href="https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting.">DFARS 252.204-7012</a> by adding a verification requirement.

core/list

All DoD prime and subcontractors planning to bid on future contracts subject to the CMMC Acquisition Rule must obtain a CMMC certification prior to award. Some contractors accessing, processing, or storing FCI (but not CUI) will minimally require a Level 1 attestation. Each DoD contract will specify the compliance level required.

The CMMC <a href="https://cyberab.org/What-is-CMMC">Accreditation Body</a> has emphasized that “[a]ll DIB members should learn the CMMC's technical requirements not only for certification but for long-term cybersecurity agility. However, DoD recognizes that many DIB members are small businesses that lack the resources of their larger, prime counterparts. As a result, the CMMC Framework incorporates cost-effective and affordable controls for small businesses to implement at the lower CMMC levels.”

The CMMC Program’s implementation date is November 10, 2025, which is 60 days after publication of the CMMC Acquisition Rule. Assessment requirements will be introduced in four phases over three years. The phases add requirements incrementally, starting with self-assessments in Phase 1 and ending with full implementation in Phase 4. By November 10, 2028, all applicable DoD solicitations and contracts will include the full CMMC requirements.

This phased approach allows time to train assessors and for companies to understand and implement requirements. DoD has <a href="https://dodcio.defense.gov/cmmc/About/">provided</a> a 4-Phase Implementation Timeline, which is included at the end of this article for easy reference.

DFARS supplements the federal government’s primary purchasing regulations, so the CMMC Acquisition Rule inserts requirements directly into contracts, making cybersecurity essentially a prerequisite for doing business with DoD.

Overview of Security Assessments and CMMC Requirements

The program establishes three assessments levels, each incorporating requirements from existing regulations and guidelines:

Level 1: Basic Safeguarding of FCI. Requires an annual self-assessment and affirmation of compliance with the 15 security requirements in FAR 52.204-21.

Level 2: Broad Protection of CUI. Requires either a self-assessment or a C3PAO assessment every three years, as specified in the solicitation. The specific requirement is based on the type of information processed, transmitted, or stored on the contractor or subcontractor information systems. It also requires an annual affirmation and verification of compliance with the 110 security requirements in NIST SP 800-171 Revision 2.

Level 3: Higher-Level Protection of CUI Against Advanced Persistent Threats. Requires an organization to achieve Final Level 2 status, undergo an assessment every three years by the Defense Contract Management Agency’s Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), and to provide annual affirmation of compliance with the 24 requirements in NIST SP 800-172.

The DoD Office of Small Business Programs offers resources to help small and mid-sized businesses with CMMC compliance. Its <a href="https://business.defense.gov/Programs/Cyber-Security-Resources/">Project Spectrum</a> initiative provides free training, tools, and support to strengthen cybersecurity awareness and help contractors meet DoD requirements.

medium

thumbnail

th_person

core/image

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2025/09/CMMC-2.0-Implementation-Rule.pdf

CMMC 2.0 Implementation Rule

Services