On September 10, 2025, the U.S. Department of Defense (DoD) published its long-awaited final rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) to incorporate contractual requirements related to the Cybersecurity Maturity Model Certification (CMMC) program. The final rule begins a phased-in approach under which, within the next three years, nearly all DoD solicitations and contracts will require contractor conformance to one of three levels of cybersecurity requirements.
Read the full blog post.