CMMC 2.0 has two rules: requirements (32 CFR) and DoD program management implementation (Title 48 CFR). It became law on December 16, 2024, with KAMIND among the first certified as a Level 2 company. This blog discusses 48 CFR and its timeline.
What It Is About
48 CFR, officially “Title 48 of the Code of Federal Regulations System,” includes federal procurement rules contractors must follow. Defense contractors must be certified at one of three Maturity Levels to bid on DoD contracts, covering CUI and FCI datasets. The draft’s proposed timeline for deployment contains a key provision all defense contractors should note.
“DoD may also, at its discretion, include the requirement for CMMC Status of Level 2 (C3PAO) in place of the Level 2 (Self) CMMC Status for applicable DoD solicitations and contracts”, which is in the initial rollout. If this is the case, the scheduled rollout is immaterial.
The proposed 48 CFR schedule
| Milestone | Date / Period | Details |
| Final Rule Publication | May–July 2025 | The 48 CFR rule is expected to be published in the Federal Register during this window. |
| Effective Date | 60 days after publication | Once published, the rule becomes law after a 60-day congressional review period. |
| Initial Phase (Selective Application) | Late 2025 | CMMC requirements apply to select contracts at the discretion of DoD program offices. |
| Second Phase (Expanded Application) | 2026 | More contracts begin to include CMMC requirements. |
| Third Phase (Broad Application) | 2027 | Most contracts will require CMMC compliance. |
| Final Phase (Universal Application) | 2028 | All relevant DoD contracts must comply with CMMC requirements. |
The issue with 48 CFR as it is currently written is that the implementation requirements are subject to the discretion of the DOD Program Manager. If you are planning a project that requires CMMC Level 2 certification, would you prefer to schedule your certification timeline yourself or wait until a DOD Program Manager tells you the date? As 48CFR is written, the program manager’s decision will override the published timeline.
Conclusions
Trying to get through the CMMC certification and compliance process can be a daunting task. But at KAMIND IT, we can help you through every step of the way. We are currently certified at CMMC Level 2, and our CEO, Matt Katzer, is a Certified CMMC Professional (CCP). Contact us today
