This page tracks the developments that change what CMMC requires, or how it is assessed, as they happen. Each entry notes what it affects and links back to the part of the guide that treats it in full, so that a change in the program can be followed straight through to its consequences.
Phase 2 approaches, and with it the end of self-attestation for most CUI work
The most consequential near-term date in the program is November 10, 2026, when Phase 2 begins and a third-party certification becomes the standard requirement for most contracts involving CUI, in place of the self-assessment that satisfied Phase 1. The weight of the date comes from capacity. Industry counts place the number of Certified CMMC Assessors in the hundreds against a projected need in the low thousands, and the roughly eighty authorized C3PAOs are serving a base counted in the tens of thousands, so assessment scheduling has stretched to many months and is expected to lengthen further through the second half of the year. For a contractor that has not begun, the sequence of remediation, then an assessment booking, then the assessment itself, no longer fits comfortably inside the window before the date.
The renumbered clauses begin appearing in live solicitations
Solicitations posted this spring and summer have started to carry the citations produced by the February renumbering, referring to the basic safeguarding rule as FAR 52.240-93 and to the relocated subcontractor provision as DFARS 252.240-7997, while the CMMC clause at DFARS 252.204-7021 and the solicitation provision at 252.204-7025 continue under their existing numbers. The obligations are unchanged, but a contractor reading a new solicitation now sees the new citations where the familiar ones used to sit, which is worth recognizing when comparing a current solicitation against older guidance.
ISACA completes its transition to the assessor and instructor certification role
As of April 1, 2026, ISACA fully assumed the role of the CMMC Assessor and Instructor Certification Organization, the CAICO, taking over the training, examinations, and certifications for the individual professionals in the ecosystem, from the Certified CMMC Professional and the Certified CMMC Assessor to the lead assessor designation and the Certified CMMC Instructor. The Cyber AB continues to accredit the organizations and to run the background investigations behind the credentials, which leaves a clean division of labor: the Cyber AB accredits organizations, and ISACA certifies individuals.
The Revolutionary FAR Overhaul renumbers the cybersecurity clauses
A set of class deviations tied to the Revolutionary FAR Overhaul renumbered several of the cybersecurity citations. The basic safeguarding rule for FCI moved from FAR 52.204-21 to FAR 52.240-93, the older self-assessment provision at DFARS 252.204-7019 was eliminated, and the subcontractor provision moved from DFARS 252.204-7020 to DFARS 252.240-7997. The safeguarding clause at DFARS 252.204-7012 and the CMMC clauses at 252.204-7021 and 252.204-7025 kept their numbers. These are interim class deviations with formal rulemaking still to follow, and the underlying obligations did not change.
The acquisition rule takes effect and Phase 1 begins
The 48 CFR CMMC acquisition rule took effect on November 10, 2025, sixty days after its publication, giving contracting officers the authority to place CMMC into solicitations and contracts. That date opened Phase 1 of the phased rollout, under which Level 1 and Level 2 self-assessment requirements appear in applicable new solicitations, with the Department retaining discretion to require a Level 2 third-party certification for select contracts. From this point, a self-assessment score posted to SPRS became a condition of award for the contracts that carry the requirement.
The CMMC acquisition rule is published in the Federal Register
The 48 CFR CMMC acquisition rule, the amendment to the Defense Federal Acquisition Regulation Supplement that places CMMC into contracts, was published in the Federal Register on September 10, 2025, starting the sixty-day clock to its effective date. Until this rule, the program rule at 32 CFR Part 170 was a complete framework that still lacked the contractual mechanism to require it.
The CMMC Program rule takes effect
32 CFR Part 170, the CMMC Program rule, took effect on December 16, 2024, establishing the program itself: the three levels, the assessment types and roles, the scoring methodology, the plan of action rules, the annual affirmations, and the phase-in schedule. The rule defined how CMMC works, though the mechanism to place it into contracts would arrive the following year with the acquisition rule.