CMMC Proposed Rule Analysis - What Defense Contractors Need to Know

Four Certified CMMC Assessors break down the major changes, the harder requirements, and the practical implications.

The CMMC rule is final. After years of speculation, interim guidance, and leaked drafts, defense contractors can now read exactly what the Department of War requires.

Four Certified CMMC Assessors from Kieri Solutions worked through the rule together: Amira Armond, Vince Scott, Brian Hubbard, and Jill Wright. Their combined experience includes dozens of assessments, hundreds of consulting engagements, and training more than 400 CMMC professionals.

Their conclusion was simple. CMMC got harder, in several unexpected ways.

POA&M Limitations Changed Dramatically

The common understanding was that you could fail up to a certain threshold of requirements and still get certified with a Plan of Action and Milestones.

That understanding was wrong.

The final rule limits POA&Ms to one-point requirements only. You have to implement every three-point and five-point requirement before the assessment. There’s one narrow exception. CUI encryption (SC.L2-3.13.11) can go on a POA&M if you’re already encrypting but the cryptography isn’t FIPS-validated yet.

On top of that, six specific one-point requirements are excluded from POA&M eligibility by name, even though they still score as one point.

Here’s what that adds up to. That leaves 63 of the 110 Level 2 requirements that cannot go on a POA&M. You have to implement them before the assessment.

Even if you qualify for a POA&M on the requirements that remain, you get 180 days to close it. Miss that window and your conditional certification expires, which makes you ineligible for the contract.

The Practical Impact

As one panelist put it, this sets a higher bar for a small machine shop than the Department sets for itself. A 2025 Inspector General report found the Department itself reaches only 70 to 79 percent implementation on these requirements.

Defense contractors have to hit near 100 %.

External Service Provider Requirements

This is where the rule delivered real surprises.

If you use an external service provider that handles CUI, that provider has to be covered under CMMC, either with its own Level 2 certification or by being assessed inside your boundary. A provider self-assessment on its own doesn’t satisfy the requirement.

This affects managed service providers, managed security service providers, and potentially Registered Practitioner Organizations.

The rule defines security protection data broadly. It covers log data, configuration data, passwords, network architecture, system security plans, vulnerability reports, antivirus information, and asset inventories. If your MSP touches CUI or that security protection data, it falls into your assessment scope, and you can’t take a self-attestation at face value.

The Cascading Effect

The panel raised a real concern. MSPs often use other service providers. An MSP might outsource SIEM analysis to an MSSP, and that MSSP now needs to be covered too.

The rule creates cascading certification requirements that weren’t in the Department’s cost estimates. One panelist estimated 5,000 to 10,000 additional companies need certification beyond the 220,000 defense contractors already counted.

The Timing Problem

There’s a dependency problem. Service providers that handle CUI generally need to be covered before their clients can certify.

When the panel first reviewed the rule, C3PAO assessments weren’t authorized yet, and joint surveillance assessments were funded only for defense contractors, not their service providers. That made the dependencies hard to satisfy. C3PAO assessments are authorized and underway now, but the practical bottleneck remains. Assessment capacity is limited, and many service providers are still early in their own compliance.

Cloud Service Provider Requirements

Cloud providers storing CUI or security protection data have to be FedRAMP Moderate authorized or FedRAMP Moderate equivalent.

Equivalency isn’t a paperwork exercise. The bar is high. The cloud provider has to hit 100 percent compliance with the FedRAMP Moderate baseline, get assessed by a FedRAMP-recognized third-party assessor, and produce a full body of evidence. That means the System Security Plan, the Security Assessment Plan, the Security Assessment Report, and continuous monitoring evidence. No POA&Ms from the third-party assessment. Everything has to be closed and validated.

You then hand that body of evidence to your C3PAO during your own CMMC Level 2 assessment, and they review it as part of your certification.

So there’s no self-attestation shortcut for equivalent clouds. If a provider gives you a marketing claim or an unvalidated SSP, that doesn’t meet the standard, and it puts your certification at risk. Check the FedRAMP Marketplace first. If your provider isn’t listed, ask for the full body of evidence before you trust the claim.

Security Protection Assets Now Fully Assessed

The earlier industry understanding was that security protection assets, your SIEM, antivirus server, and monitoring tools, were assessed for their security function but not necessarily against all 110 requirements.

The rule confirms that security protection assets are assessed against all requirements.

That expands scope a lot. Vulnerability scans of your SIEM. Audit logs from your antivirus server. Multifactor authentication for your logging infrastructure.

The panel estimated 50 to 80 percent additional assessment effort to cover this properly.

The Tool Availability Problem

One panelist raised a concern the Department may not have weighed.

Most security tools went cloud-native over the past decade. It’s hard to buy on-premises security appliances anymore. Almost everything has a cloud component.

The FedRAMP marketplace has roughly 300 authorized offerings. That’s a tiny slice of the security tools on the market.

By requiring FedRAMP for security protection data, the rule takes most security tools off the table. Small and medium businesses have the hardest time here, since many vendors only want to sell to large federal agencies.

The unintended consequence is real. Forcing companies to drop good security tools may actually increase risk to the Defense Industrial Base.

Joint Surveillance Assessment Reciprocity

Good news for early adopters. Joint surveillance assessments translate into CMMC Level 2 certifications.

A few conditions apply.

• You need a perfect score with no open POA&Ms
• The assessment has to align with CMMC Level 2 scoping
• The certification is valid for three years from the original DIBCAC assessment

Companies that went through joint surveillance carry that certification for the full three years, which pushes many of them well into the later phases of the rollout before they need to recertify.

One catch the panel flagged. DIBCAC changed its policy and no longer performs POA&M closeouts. If you fail a requirement during joint surveillance, you can self-assess after remediation, but DIBCAC won’t come back to verify.

Timeline and Phases

The rule runs on a four-phase rollout, and each phase lasts a year.

Phase 1 started November 10, 2025. Most contracts in this phase call for Level 1 or Level 2 self-assessments, though contracting officers can require a Level 2 third-party assessment at their discretion.

Phase 2 begins November 10, 2026. Level 2 third-party certification becomes the standard for applicable contracts that involve CUI.

Phase 3 begins November 10, 2027, and brings Level 3 assessments into the mix.

Phase 4 begins November 10, 2028. From there, CMMC requirements are expected across all applicable contracts.

The endpoint looks a lot like the original 2019 and 2020 projections. Despite all the delays, where this lands hasn’t changed much.

Flow-Down Requirements

If a prime contractor needs Level 2 certification, its subcontractors that handle CUI need Level 2 certification too.

That sounds simple until you look at real supply chains.

A subcontractor might serve 10 primes and 20 subs of primes. If any of those primes carries a certification requirement, the subcontractor needs one.

The panel expected that while some primes may qualify for self-assessment, their subs will get hit hard with certification requirements because of how much supply chains cross over.

NIST SP 800-171 Rev 2 Locked In

The rule points to NIST SP 800-171 Rev 2 throughout. Not “current version.” Not “as updated.” Specifically Rev 2.

That takes some anxiety off the table. The requirements are locked.

It also means moving to Rev 3 would take new rulemaking. During the comment period, one panelist pushed for language that would let the revision number float with NIST updates instead of hardcoding Rev 2. The final rule kept Rev 2, and the panel doesn’t expect Rev 3 to be assessed for years.

Practical Recommendations

The panel offered several recommendations.

Evaluate your external service providers now. Figure out which ones handle CUI or security protection data. Start the conversation about their certification plans. If a provider won’t certify in time, consider bringing the service in-house.

Move to FedRAMP clouds. Ask any cloud you use for its System Security Plan and the full body of evidence. Don’t assume a commercial tier meets the requirement.

Talk to your C3PAO about scoping. With near-perfect implementation required, scoping decisions matter more than ever. Ask about specialized asset categories for systems you can’t fully secure.

Consider an enclave. Building a small, certifiable enclave and moving contract work into it is often more practical than certifying your whole corporate network.

Build the cost into your bids. The Department expects cybersecurity costs to show up in contract pricing. Raise your bids when CMMC requirements appear in the solicitation.

The Bottom Line

CMMC got harder. The external service provider requirements, the security protection asset scope, the POA&M limits, and the near-perfect self-assessment bar all add to the compliance load.

Companies that felt like they were in good shape may run into new problems. If you lean on MSPs or cloud-based security tools, you have real work ahead.

The phased timeline gives you some runway. Early joint surveillance adopters have years before they recertify. But the rule is final and in effect now, so the time to plan is already here.

Start now. Evaluate your providers. Plan your enclave. Get your scope in front of a C3PAO.

Kieri Solutions fields one of the deepest teams of certified assessors in the ecosystem. The Kieri Compliance Documentation and Kieri Reference Architecture give defense contractors scalable options for working through these requirements.

Download the KCD brochure at kieri.com/kcd

Download the KRA datasheet at kieri.com/kra

Want to talk it through? Schedule a consultation to see whether the KCD fits your compliance needs at kieri.com/schedule-consultation.