CMMC 2.0 Phase 1 Is Officially Live: What Contractors Need to Know

After years of planning, updates, and anticipation, the Cybersecurity Maturity Model Certification (CMMC) 2.0 program has officially begun. As of November 10, 2025, the Department of Defense (DoD) has entered Phase 1 of its CMMC implementation, marking the most significant step yet in securing the Defense Industrial Base (DIB) and protecting sensitive federal data.

As a result, CMMC requirements are now active in select defense solicitations and contracts. In other words, CMMC compliance has officially transitioned from a future objective to a current obligation for contractors across the DIB.

The Beginning of Phase 1: Self-Assessments Now Required

Phase 1 introduces the self-assessment requirement for contractors handling Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). Organizations must now conduct self-assessments based on NIST SP 800-171 practices. After that, they must enter their results into the Supplier Performance Risk System (SPRS).

However, one critical detail cannot be overlooked: an SPRS entry is not complete without an accompanying affirmation. Each contractor must submit an affirmation statement signed by a senior company official. To explain further, this statement confirms that the self-assessment results accurately reflect the organization’s current cybersecurity posture. This affirmation acts as a formal acknowledgment of accountability, verifying that the information submitted in SPRS is truthful and complete. Without this affirmation, the self-assessment is considered invalid, even if a score has been entered. Contractors that fail to include affirmations may be flagged as noncompliant, which could affect their eligibility for new or existing contracts. To stay compliant, organizations should:

• Designate an authorized company representative to review and submit affirmations.
• Ensure affirmations are updated annually or whenever the organization’s security posture changes.
• Retain documentation of each submission for audit purposes.

This requirement emphasizes the DoD’s focus on integrity, accuracy, and accountability throughout the CMMC program.

What the Phase 1 Rollout Means for Contractors

The CMMC rollout has moved beyond preparation and is now in motion. Contractors should use this first phase to confirm readiness and strengthen internal processes. Key priorities include:

• Reviewing your current NIST SP 800-171 compliance posture.
• Updating and validating your System Security Plan (SSP) and Plan of Action & Milestones (POA&M).
• Ensuring your SPRS entries and affirmations are complete and accurate.

Organizations that act now will be better positioned when Phase 2 begins next year, introducing mandatory Level 2 certifications where applicable.

The CMMC 2.0 Implementation Timeline

CMMC implementation follows a structured four-phase rollout designed to scale cybersecurity expectations gradually across the defense supply chain.

• Phase 1 – Initial Implementation (Begins November 10, 2025) – Contractors complete Level 1 and Level 2 self-assessments and submit results with affirmations in SPRS. This phase emphasizes accountability while allowing time for adaptation before external certification begins.
• Phase 2 – Level 2 Certification Requirements (Begins November 10, 2026) – Select solicitations begin requiring Level 2 certification through approved third-party assessment organizations (C3PAOs). The DoD may delay these certifications to contract option periods for flexibility.
• Phase 3 – Level 3 Certification Requirements (Begins November 10, 2027) – Contracts involving the most sensitive CUI begin requiring Level 3 government-led assessments by DIBCAC.
• Phase 4 – Full Implementation (Begins November 10, 2028) – All defense contracts must include the applicable CMMC level as a condition of award. By this stage, CMMC compliance will be fully integrated into the DoD acquisition process.

It is important to remember that the DoD reserves the right to accelerate CMMC requirements for certain procurements ahead of these milestones. Contractors who prepare early gain a competitive edge.

Preparing for Phase 1 and Beyond with RegDOX

As contractors face the reality of CMMC enforcement, the need for a secure, compliant, and unified environment has never been more urgent.

RegDOX Solutions simplifies this transition through its suite of CMMC Compliance Solutions, led by the Compliant Cloud Environment (CCE)—a platform built on the trusted RegDOX Secure Data Room foundation. The Secure Data Room provides a FedRAMP Moderate-equivalent environment for safeguarding sensitive information. As a result, it enables controlled collaboration, encryption, and access tracking that meet strict federal data protection requirements.

Building on this secure architecture, the CCE extends these capabilities into a complete compliance ecosystem. Furthermore, it integrates document storage, collaboration tools, access control, and audit-ready reporting within AWS GovCloud (US)—all fully aligned with NIST SP 800-171, DFARS, and CMMC frameworks.

To learn more about how the RegDOX CCE supports your compliance journey, read our blog Inside RegDOX’s Solution – How the Compliant Cloud Environment (CCE) Excels. This resource demonstrates how a purpose-built cloud foundation can simplify the process, reduce costs, and strengthen long-term compliance across all phases of CMMC.

Act Now: CMMC Compliance Is No Longer Optional

In conclusion, CMMC 2.0 is officially underway, and every phase will tighten enforcement across the DIB. Above all, contractors who proactively implement strong cybersecurity controls will protect more than just their data. They will also protect their ability to compete in the federal marketplace.

Whether you are beginning with self-assessments or preparing for certification, RegDOX can help simplify every step. Download our CMMC Guide:

About RegDOX

At RegDOX Solutions Inc., we help defense contractors and high-security organizations simplify compliance with ITAR, EAR, DFARS, NIST SP 800-171, and CMMC requirements. Our secure, cloud-based platforms combine end-to-end encryption, access controls, and audit-ready documentation to keep your data—and your contracts—safe.

Need help navigating evolving cybersecurity regulations?

Request a Compliance Demo
Or contact us directly at info@regdox.com