The final rule in CMMC 2.0 is finally here: 48 CFR. But what does it mean for you? If you’re doing business with the DoD (or plan to in the future), read on to learn how the official start of the Phase 1 CMMC rollout will impact your organization.
What is 48 CFR?
The CMMC 48 CFR is the final rule and will make CMMC enforceable in DoD contracts. The rule will be published in the Federal Register on September 10, 2025 with an effective date of November 10, 2025. This marks the official start of Phase 1 of the CMMC roll out, meaning readiness is no longer optional and all new DoD solicitations and contracts will include some level of CMMC requirement.
What’s next?
CMMC requirements will be included in all new DoD solicitations and contracts going forward, and compliance will be mandatory for award.
With implementation underway, the time to act is now. If you haven’t taken your place in the queue to begin your CMMC certification, contacting a C3PAO should be high on your priority list.
Learn about the standard
Understanding CMMC and the level of compliance that your organization will need to meet is key to a successful audit cycle. If you’re starting from scratch, our CMMC Buyer’s Guide will spell out the standard and levels of compliance, the assessment journey, and how to prepare based on your level of compliance.
Selecting a C3PAO
The Cyber AB authorizes a CMMC Third Party Assessment Organization (C3PAO) to contract and manage CMMC assessments. Only authorized C3PAOs can conduct CMMC assessments.
There are a limited number of C3PAOs authorized to conduct CMMC assessments, and not all are created equal. We recommend seeking out a C3PAO that has deep experience in federal compliance, delivers high-quality final reports, and streamlines the process. To learn more about choosing the right C3PAO, download our CMMC Checklist.
The A-LIGN difference
If you’re ready to take the next step toward CMMC compliance, contact us today. The A-LIGN difference is:
- Deep federal expertise with 1,000 federal assessments completed and more than 50 federal global staff.
- A quick start to CMMC with a kickoff in just 6-8 weeks alongside our experienced federal team. The industry average is 2x this timeline.
- Scalable support to be ready even while other C3PAOs get inundated.
Don’t get left behind. Reach out today to learn how A-LIGN can help you navigate this next step in your compliance journey.
