CMMC Update: From Policy to DFARS — What It Means for Your Business
Earlier this year, we shared The CMMC 2.0 Compliance Journey — explaining how companies could prepare for the evolving Cybersecurity Maturity Model Certification. At that time, CMMC 2.0 was guidance, strongly encouraged by DoD primes, but not yet law.
That just changed.
On August 25, 2025, the Office of Information and Regulatory Affairs cleared the DFARS companion rule. This means CMMC is moving from policy to binding regulation under the Defense Federal Acquisition Regulation Supplement (DFARS). Once published in the Federal Register, compliance will no longer be optional. It will be written directly into DoD contracts.
What This Means in Practice
-
Level 1 self-assessments (basic safeguarding) will be required for nearly all contractors and subcontractors.
-
Level 2 certification will be required if your scope of work involves handling Controlled Unclassified Information (CUI).
-
Primes must flow down requirements: If the prime contract requires Level 2 due to CUI, then any subs touching that same information must meet Level 2. Subs not handling CUI will only need Level 1.
Why This Matters
For many small and mid-size businesses, the cost of Level 2 certification is significant. The key takeaway is that not every sub will automatically need Level 2 — it depends entirely on whether CUI is part of your role.
Hiring Implications
As DFARS enforcement takes effect, the ripple will be felt in hiring and workforce strategy:
-
Rising demand for cyber/compliance talent: Security analysts, ISSOs, and cleared cyber professionals will become even harder to find.
-
Job descriptions shifting: Roles may start including baseline cyber hygiene or CMMC awareness responsibilities, even outside IT.
-
Competitive pressure : Contractors who can’t staff compliance-related positions risk losing bids; those with the right people gain an edge.
-
Recruiting workload : HR teams will need to vet for cyber certifications (Security+, CISSP, CISM, etc.) and verify compliance training more rigorously.
Bottom line: CMMC is moving from a “best practice” to a contractual requirement. Beyond compliance, it will reshape hiring priorities across the defense industry.
Need talent with CMMC knowledge or cybersecurity expertise? Engenium specializes in recruiting cleared professionals who understand compliance, security, and the unique demands of defense contracting. Reach out to learn more.
