Before CMMC: DFARS and NIST 800-171
Before the CMMC program was established, the Department of Defense had established cybersecurity requirements for contractors responsible for protecting sensitive defense information.
A major milestone came in 2015, when the National Institute of Standards and Technology (NIST) published NIST Special Publication 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations. The publication established security requirements designed to protect Controlled Unclassified Information (CUI) when it resides in nonfederal systems and organizations.
2019: CMMC is Introduced
2020: CMMC 1.0 is Released
CMMC was moving from a cybersecurity framework toward becoming a contractual requirement, but the original CMMC 1.0 model would soon face significant changes.
2021: CMMC 2.0 is Announced
In 2021, the DoD conducted an internal review of the CMMC program in response to industry feedback and concerns about implementation costs, complexity, and alignment with existing cybersecurity requirements.
On November 4, 2021, the DoD announced CMMC 2.0, significantly restructuring the original program. The new model reduced CMMC from five maturity levels to three and more closely aligned its requirements with existing federal cybersecurity standards, including NIST SP 800-171.
CMMC 2.0 established the basic framework that would ultimately move forward through the federal rulemaking process, although several more years would pass before CMMC became an enforceable contractual requirement.
2022: CMMC Moves into Rulemaking
Following the announcement of CMMC 2.0, 2022 became a year of rulemaking and program development. The DoD began working to incorporate the revised CMMC framework into federal regulations, including the requirements governing the CMMC program and its implementation in defense contracts.
2023: CMMC Enters Formal Rulemaking
After several years of development, CMMC reached a major regulatory milestone in December 2023 when the DoD published its proposed 32 CFR Part 170 rule. The proposed rule formally outlined the revised CMMC program and opened a 60-day public comment period.
The proposal established the framework for three CMMC levels, including self-assessments for Level 1 and certain Level 2 requirements, third-party assessments for other Level 2 requirements, and government assessments for Level 3. It also aligned CMMC more directly with existing NIST cybersecurity requirements.
This moved CMMC significantly closer to becoming a fully implemented federal program, setting the stage for the final CMMC program rule in 2024.
2024: The CMMC Program Rule is Finalized
2024 marked a major turning point for CMMC. In August, the DoD published a proposed DFARS rule outlining how CMMC requirements would be incorporated into DoD solicitations and contracts.
Then, on October 15, 2024, the DoD published the final CMMC Program Rule under 32 CFR Part 170. The rule formally established the CMMC program, including its three levels, assessment requirements, and phased implementation structure. The rule became effective on December 16, 2024.
With the CMMC program framework finalized, attention shifted to the remaining acquisition rule needed to put CMMC requirements into DoD contracts.
2025: CMMC Implementation Begins
In 2025, CMMC moved from rulemaking into implementation. The DoD finalized the DFARS acquisition rule needed to incorporate CMMC requirements into defense solicitations and contracts, completing the regulatory framework established under 32 CFR Part 170.
On November 10, 2025, CMMC Phase 1 implementation began, allowing applicable DoD solicitations and contracts to require contractors to have the specified CMMC status as a condition of award. The DFARS requirements also established how CMMC status would be verified through the Supplier Performance Risk System (SPRS).
This marked a significant shift for the Defense Industrial Base: CMMC was no longer simply a future compliance requirement. It had entered the DoD contracting process.
2026: CMMC Phase II is Suspended
CMMC implementation took another significant turn in 2026. On July 13, 2026, the Department announced the suspension of CMMC Phase II requirements, which had been scheduled to take effect on November 10, 2026. At the same time, it launched a comprehensive review of the CMMC program.
Importantly, Phase I self-assessment requirements remain in effect. Defense contractors and subcontractors also remain responsible for safeguarding covered defense information under DFARS 252.204-7012, while the Department reviews the future direction of the CMMC program.
For defense contractors, the Phase II suspension does not mean cybersecurity or compliance requirements have disappeared. Organizations should continue meeting their current contractual requirements and maintaining an accurate, defensible cybersecurity program.
Where CMMC Stands Today
As of October 2026, CMMC Phase I remains in effect while the transition to Phase II is suspended as the Department conducts a broader review of the program. Phase I self-assessment requirements have not been suspended.
Defense contractors should not interpret the Phase II suspension as a pause in their cybersecurity responsibilities. Contractors and subcontractors remain responsible for protecting covered defense information under DFARS 252.204-7012, and the Department continues to enforce NIST SP 800-171 Rev. 2 requirements through self-assessments and select government-led assessments. Additionally, many prime contractors have made it clear they expect their supply chain to implement the required cybersecurity controls regardless of where CMMC currently stands.
For organizations in the Defense Industrial Base, the priority remains the same: understand your contractual requirements, accurately assess your cybersecurity posture, address compliance gaps, and maintain the documentation and evidence needed to support your compliance.
CorpInfoTech, a Trust CMMC Level 2 Certified MSP
The history of CMMC shows that the program will continue to change, but the responsibility to protect CUI and maintain a strong cybersecurity program remains. Defense contractors need an approach that supports today's requirements while preparing their organization for what comes next.
As a CMMC Level 2 Certified MSP, CorpInfoTech helps defense contractors build and maintain secure, compliant environments through a practical five-step roadmap: Define → Assess → Implement → Validate → Maintain.
- Define – Understand your requirements, CUI environment, scope, and compliance objectives.
- Assess – Evaluate your environment against applicable NIST SP 800-171 and CMMC requirements and identify gaps.
- Implement – Remediate gaps and put the necessary security controls, technology, policies, and processes in place.
- Validate – Confirm controls are operating as intended and prepare your documentation and evidence.
- Maintain – Continuously manage and monitor your environment to support ongoing compliance.
CMMC compliance is not a one-time project. CorpInfoTech brings cybersecurity, compliance, and managed IT together to help defense contractors protect CUI, demonstrate compliance, and maintain readiness as requirements continue to evolve.
