The CMMC phase-in has started. Here is what that means for your contracts.

The two rules, briefly

Two separate rules had to land for CMMC to reach your contracts. 32 CFR Part 170, effective December 16, 2024, established the program itself: the levels, the assessments, the ecosystem. The DFARS rule for clause 252.204-7021, effective November 10, 2025, is what puts CMMC requirements into actual solicitations and contracts, and it does so on a phased schedule rather than all at once.

The four phases

Phase 1, underway now: applicable new solicitations require a Level 1 or Level 2 self-assessment as a condition of award. Phase 2, one year in: applicable procurements involving CUI begin requiring Level 2 C3PAO certification, not just self-assessment. Phase 3, two years in: Level 3 requirements enter for the programs that need them. Phase 4, three years in: full implementation, with CMMC requirements in all applicable solicitations and contracts, including option periods on existing work.

The trap in "we have three years"

The schedule describes when the government must include the requirement. It does not stop program offices from requiring certification earlier where mission demands it, and it does not slow your primes down at all: flow-downs are already appearing in subcontracts ahead of the government's own schedule, because a prime cannot risk its supply chain failing at award time. Meanwhile the work itself has not gotten shorter. A realistic Level 2 implementation for a small contractor runs six to eighteen months, which means the recompete that falls in Phase 2 is being won or lost on preparation that starts now.

What to do with this

Map your contracts: which involve CUI, when each recompetes or hits an option year, and which primes are already asking. That one exercise turns an abstract federal timeline into your company's actual deadline, and it is usually sooner than people hope but further than people fear.