Pentagon Releases Long-Awaited Contractor Cybersecurity Rule

U.S. military contractors face the certainty of new cybersecurity requirements following the official publication of a controls framework that will become mandatory over the course of the next three years.

See Also: New Trend in Federal Cybersecurity: Streamlining Efficiency with a Holistic IT Approach eBook

The Department of Defense first proposed in 2019 a unified cybersecurity standard out of concern that its many contractors – they’re estimated to number more than 300,000 – don’t protect records falling below classification in sensitivity but still containing information the military doesn’t want made public. President Donald Trump earlier this month signed an executive order allowing the DOD to use “Department of War” as a “secondary” designation.

Wednesday’s release of the final Cybersecurity Maturity Model Certification Rule comes after years of vocal industry criticism the program would lock out small- and medium-size businesses due to the framework’s complexity.

The final rule outlines a three-year phased rollout of the program starting Nov. 10. The framework consists of three levels of ascending security, with vendors that deal with “federal contract information” allowed to self-attest their CMMC compliance. Vendors that handle more sensitive “controlled unclassified information” need to bring in an outside certified third-party assessor organization to verify the controls, or obtain require certification from the Defense Industrial Base Cybersecurity Assessment Center in order to handle the most sensitive, but still unclassified, information.

During the program’s first year, Defense intends to require self attestations as a requirement of all contract awards and possibly when exercise contract options. In its second year, it will roll out requirements for relevant contractors to obtain certification from a certified third-party assessor organization. Solicitations can start to require Defense Industrial Base Cybersecurity Assessment Center certification during the third year.

The phased rollout and a reduction in the number of CMMC levels from five to the final three are meant to assuage criticism. “We expect our vendors to put U.S. national security at the top of their priority list,” said, Katie Arrington, who is performing the duties of the Pentagon CIO.

Stacy Bostjanick, deputy CIO and chief of defense industrial base cybersecurity told Information Security Media Group in May that defense contractors face constant threats from cybercriminals, including malware, ransomware and cyberespionage.

“The defense industrial base has become the soft underbelly of the department,” Bostjanick said during an interview at RSAC Conference 2025 (see: Defense Industrial Base Strengthens Cybersecurity With CMMC).

The final rule “creates an immediate imperative for defense contractors to formalize their governance structures,” said Frank Balonis, CISO and senior vice president of operations at Kiteworks. The software security company surveyed more than 400 organizations, finding the majority of military contractors lack formal governance controls, fail to enforce supplier security requirements and are falling short of encryption benchmarks critical for CMMC compliance.

“Only 38% of CMMC-pursuing organizations have instituted comprehensive governance control and tracking systems, and this gap has real consequences,” he said.

The staggered approach for is designed to allow time for training assessors, providing contractors time to understand and implement the requirements and limit financial and operational strain, according to analysts.

“Despite efforts to minimize the burden of compliance on small businesses and the defense industrial base by using phased implementation, the rule will eventually impact more than 300,000 organizations,” said Amy Fuentes, an attorney for Holland & Knight who advises contractors on defense compliance.

Many of those businesses will have to “adjust their business practices to be certified,” she said.