CMMC Final Rule: A Guide for DoD Subcontractors

What it is

Huntress's guide to the DoD CMMC final rule, published after the rule dropped September 10, 2025 and effective November 10, 2025. Beyond the level structure the summary covers, the page's actionable core is a capacity argument: why subcontractors should certify now rather than wait for the phased rollout.

The timeline and the bottleneck

CMMC requirements phase into contracts over three years — for that period the DoD picks which contracts get CMMC and at what level. Only after November 10, 2028 does it become standard for all contracts involving FCI or CUI.

The page argues against treating the phase-in as breathing room. The DFARS clause requires prime contractors to verify a subcontractor's certification before awarding a contract, so primes will demand it across their supply chains ahead of any DoD mandate. Meanwhile the supply cannot meet the demand:

• DoD estimates 80,000+ contractors need Level 2 or Level 3 (Huntress notes this is conservative — no subcontractor database exists).
• Only 82 C3PAOs are certified (per Cyber AB at time of writing).
• Even generously assuming each C3PAO handles 10 concurrent assessments, 52 weeks a year: 82 × 52 × 10 = 42,640/year, roughly two years to clear the first 80,000.

Level specifics the summary omits

• Level 1: annual self-assessment against 15 basic controls in FAR 52.204-21.
• Level 2: third-party (C3PAO) assessment every three years; a typical assessment runs four to eight weeks.
• Level 3: 110 Level-2 controls plus 24 from NIST SP 800-172, and these assessments are conducted by the government, not a C3PAO.

What to do

Prepare a Level 2 assessment proactively across three areas the page names:

• Technology: endpoint protection, SIEM, vulnerability scanning, application control — the stack must satisfy all 110 requirements.
• Processes: documented, repeatable procedures (onboarding, change control, incident response) that auditors can see are operational, not just written.
• Documentation: a current System Security Plan (SSP), a policy per control family, detailed procedures, and evidence records. The page calls documentation the biggest hurdle for most audits.

Caveats

The two-year backlog is Huntress's own back-of-envelope estimate built on generous assumptions (10 concurrent assessments per C3PAO, one week of C3PAO time each) — not an official figure. As a vendor post it frames the difficulty partly to motivate outside help. The Level 2 pass-score detail is cut off in the fetched text mid-sentence ("a score of 11…").