All Episodes

September 19, 2025 15 mins

Submit any questions you would like answered on the podcast!

The wait is over: the Department of Defense has finalized the CMMC rule, officially making it part of DFARS. That means compliance isn’t “coming soon”, it’s now in your contracts.

In this episode of the CMMC Compliance Guide Podcast, Austin and Brooke from Justice IT Consulting break down what the final rule means for DoD contractors and subcontractors, the key deadlines you need to know, and the exact steps to prepare for Level 2 certification before requirements hit contracts in November 2026.

What you’ll learn in this episode:

- The new CMMC final rule and when it goes into effect
- How the 4-phase rollout impacts primes and subcontractors
- What’s different about this update (and why it’s not another delay)
- Key requirements: SPRS score, POAM limits, affirming officials, and more
- How to prepare your subcontractors with questionnaires and attestations
- Why you need to start engaging with C3PAOs now before schedules fill up

If you’re a DoD contractor, aerospace manufacturer, or subcontractor, this is the update you can’t afford to ignore.

Mark as Played
Transcript

Episode Transcript

Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Austin (00:00):
Hey there, welcome to the CMMC Compliance Guide
Podcast.
I'm Austin

Brooke (00:04):
and I'm Brooke

Austin (00:05):
from Justice IT Consulting, where we help
businesses like yours navigateCMMC and NIST 800-171
compliance.
We're hired guns gettingcompanies fast-tracked to
compliance, but today we're hereto give you all the secrets for
free, so if you want to tackleit yourself, you're equipped to
do so.
Let's dive into today's episodeand keep your business on

(00:26):
track.
Today's episode is a big one.
The De The Department ofDefense has finalized a rule
that officially makes CMMC partof the DFARS.
That means compliance just wentfrom coming soon to in your
contracts.
You ready to get into it,Brooke?

Brooke (00:45):
Absolutely.

Austin (00:46):
So, Brooke, big development.
We've been waiting on it for awhile.
Can you tell us what justhappened?

Brooke (00:52):
Other than being changed from DOD to DOW, the actual big
thing was that that 48 CF faruh final rule finally dropped it
finally was published uh that'sthe the clock is now ticking
it's it's it's going so um theydid there is a 60 day uh wait
for it to be to go to to beeffective to go into effect and

(01:17):
so that means november 10th uhit should go into effect

Austin (01:21):
okay so now that's official what does this mean for
defense contractors defense ofwar contractors

Brooke (01:28):
department of war the No,

Austin (01:30):
yeah, Department of War.
See,

Brooke (01:31):
I can't even get it right.
Yeah, it's kind of hard to getused to.
So it means the clock isticking now.
I mean, it's actually reallyticking.
We have a definite timeline.
It's coming down as far asdefinite as can be because there
are some caveats.
But definite timeline, it'scoming down the pike.
It's happening.
That light you see in thetunnel is actually coming

(01:53):
towards you.
So, you know, there's going tobe four phases to it.
And so, you know, the otherthing that– that really matters
is it doesn't just apply to you.
It applies to yoursubcontractors.
It applies to all the primes,their subcontractors.
It applies to yoursubcontractors and et cetera.
So the clock is ticking.

(02:13):
We're off to the races.

Austin (02:15):
The role is a little more inclusive.
It's not just talking aboutpeople that are handling CUI and
parts and drawings and stufflike that, right?
There's more people.

Brooke (02:26):
Well, there's, so if you're, there's, three levels.
There's level one, two, andthree.
Level one is just FCI.
It has 15 controls.
There's level two if you handleCUI.
And then level three has 20, Ithink 24 controls on top of
that.
That's more extensive than justthe 110 for level two.

(02:49):
Really, if you're level one,just FCI, it's business as
usual.
If you're level two, having acertification They start
requiring these certificationsnow or level two assessments.
They start requiring all thison contracts.
So really we're talking aboutlevel two.
Level three, they can too.

(03:12):
There's going to be a smallsubset of companies that are
level three.
So hopefully if you're going tobe level three, you already
know that because it is a littlebit of a tall order to get to
level three from level two.
But the level two, I would– Iwouldn't plan on that
certification assessment.
It's possible you might be justself-attestation, but I think

(03:38):
that's going to be the exceptionrather than the norm.

Austin (03:42):
Okay, so I want to kind of bring this into the real
world for the contractors outthere listening.
What are the key requirementsthat contractors need to know
about and need to address rightnow?

Brooke (03:55):
So there's really four big ones.
So like I said, CMMC is here.
here it's coming there's adefinite timeline now with phase
one kicking in it'll kick in onNovember 10th of 2025 and so by
November of 2026 November 10thof 2026 those that level two

(04:17):
certification will will startshowing up on contracts you'll
have to have that so that's whenthat'll start it could start
sooner for subcontractors Andthere's a whole ton of
subcontractors out there.
Not everybody does businessdirectly with the federal
government.
So if you're a sub, your primecontractor very well may say,

(04:42):
hey, you know what?
We need you to have thatcertification in hand to keep
getting contracts.
We need you to have that inhand by X date.
So they can require sooner thanthat or highly motivate you
maybe to get it before then,however that motivates may come.
Your CMMC unique ID that Ibelieve you get out of SPRS, you

(05:06):
need to have that.
Make sure you have that squaredaway.
That's what everything is goingto be based upon.
So make sure you have thatunique ID and you're aware of it
and documented all that funstuff.
POAMs are limited, of course.
That's not really a change, but180 days to clean things up.
However, if you're doing acertification assessment and you
have to POAM some stuff, noteverything can be POAMed.

(05:28):
So you've got to be aware thatthere's only certain things that
can be POAMed.
When you go through and score,use the NIST 800-171A, the
assessment guide.
When you use that, you can gothrough and use a scoring sheet
and score yourself to get yourSPRS score.
There's five-pointers,three-pointers, and
one-pointers.

(05:49):
No five-pointers orthree-pointers can be POAMed,
and only certain one-pointerscan be POAMed.
So if you have a level threecertification, excuse me, a
level two certification, and youhave a POAM, then or understand
that only certain one-pointerscan actually be POANed for 180
days.
You still have to affirm thatyou meet whatever certification

(06:10):
level you're at.
You still meet all the controlsand assessment objectives.
You still have to affirm thatevery year, but they change that
from a senior official to anaffirming official.
You can appoint someoneaffirming official, I guess, and
so they can be the ones to goin and affirm that score in
SBRS.

Austin (06:29):
So I'll be the voice of the defense contractor here.
Um, and, uh, it may not make mepopular with a DOD or I guess
DOW to say this, but, um,contractors I hear typically
are, um, kind of fatigued fromthe kicking down can down the
road, um, experience.

Brooke (06:46):
They we've heard that.
Yeah.
Yeah.

Austin (06:49):
Yes.
Um, and so, uh, just beingrealistic, um, I feel like a lot
of contractors kind of have,um, update, uh, fatigue or, uh,
You know, like, how is thisdifferent than all the other
previous updates that we've had?
Because a lot of them seem tosay it's just more of the same.
But this one seems like itmight be different.

(07:10):
So how is it different?

Brooke (07:11):
Well, it is different.
I mean, we've talked about thisat the beginning, but, I mean,
there's a timeline now.
There's a definite timeline.
There's no stepping back fromit.
It's happening.
It's coming.
It's happening.
It was coming before, but nowthis final rule has been
published and there's a definitetimeline that it's holding to

(07:34):
get this done.
So that's the biggest thing ofwhy this is different.
There's a few other littlethings that are different in the
rule or clarified.
It clarifies what currentmeans.
It does say you don't have toreport minor lapses to the
contracting officer, but itleaves the 72-hour reporting
rule standing.
And then leaves the phase-inperiod– just as we thought it

(08:01):
was.
But the biggest thing is thatif there's still people out
there saying, well, I don'tthink it's going to come, a
thousand percent, they're justin denial.

Austin (08:15):
It just...

Brooke (08:16):
Yeah, the Department of War has decided now is the time
and they're doing it.
So really, I was going to say Iwas surprised, but I was a
little surprised that it cameout now rather than waiting just
a little bit.
I was also kind of surprisedthat there was a 60-day wait

(08:36):
period to go into effect.
But they released it, it'spublished, and it's coming.

Austin (08:46):
the 60-day timeline.
One of my questions for youwas, when does this all kick in?
So I think you kind of alludedto that.

Brooke (08:53):
Yeah, we've already addressed that, but just to say
it just straight up again, itwas released on September 10th,
and there's a 60-day period forit to go into effect, which is
November 10th.
You have four phases to it.
So the first phase is going tolast a year or so.
It's basically what you'redoing now, except there's a

(09:14):
definite timeline, and And soNovember 10th of 2026, that is
when certifications will startbeing actually required on
contracts.
Again, unless you're asubcontractor and your prime
contractor requires it beforethen for you.

Austin (09:34):
All right, Brooke.
So let's say you're a defensecontractor at home listening and
you've just realized, crap, Ireally got to do something about
this now.
For those people or even forthe people that are still
working on it, what do they needto be doing right now based on

(09:54):
the new changes?
What should they go like andsubscribe and then close out of
YouTube and then go do?
Like I dropped that in.
But right after they do that,they should go do what?

Brooke (10:07):
So really determine what kind of CUI or what level
you'll be.
Is it truly CUI that you'llhave, talk to your contracting
officer, say, what level am Igoing to need to be at for this,
for these contracts, and youwant to know what type of CUI.

(10:29):
That's very important.
So what type of CUI.
Then you'll want to, assumingyou're level two or even level
one, but you'll want to assessyour state, see where you're at
right now.
You can use the assessmentguide I mentioned a while ago,
the NIST 800-171A Alpha.
Use that to assess yourenvironment, figure out what

(10:53):
needs to be done, and then fromthere you can start building
your SSP, developing a POAM.
Hopefully you're alreadypartway down the road on that,
but build off that SSP, buildoff that POAM, make some
projects from that, and juststart stepping through and
getting it done.
Register an SPR Make sure youmake note of your CMMC ID.

(11:18):
Start talking to some C3PAOs.
That's a really good thing todo.
Talk to a few of them.
There may be some that you justdon't mesh with.
You don't get along or youdon't see eye to eye with them
or something.
Interview them.
See what their schedule islike.

(11:39):
They may say, yeah, we can getyou on the schedule in 2026.
Or they may say, say yeah wecan get you on the schedule next
week but you know talk to themask them questions they'll
answer what they can answerbecause if you ask them any
questions that they think may beconsulting then they'll

(11:59):
politely decline to answer andlet you know that they can't but
yeah ask them questions there'sat this point there's around 60
that are authorized and can doassessments so That's not a ton
of them.
So I would suspect that nowthat this rule is hit that

(12:25):
there's going to be a little bitof a rush to get assessments
done, certification assessments.
So their schedules are likelygoing to start stacking up.
So be aware of that.
And then make sure yoursubcontractors are ready.
Develop a questionnaire, muchlike if you're a subcontractor
to a prime, they make you fillout a questionnaire.

(12:49):
Do the same thing to them.
So if you're not asubcontractor and you directly
contract, then develop aquestionnaire.
It doesn't have to be reallyhard or anything, but develop a
questionnaire to where they'reattesting to you that they are–
the same level as you.

(13:10):
If they're not the same levelas you, they can attest to that.
Unfortunately, you can't usethem for, at least where CUI is
concerned, you can't use them.

Austin (13:19):
And if you're struggling on that questionnaire, could
you just repurpose some of thesimilar questions from the SPRS
or SPURS questionnaire and sendout to them?

Brooke (13:32):
From the calculation, yeah, from the temp Yes, you can
do that.
Uh, you can use that torepurpose some of those
questions.
Um, and again, it doesn'treally have to be that, that in
depth or anything, but, uh, butsomehow they've got to attest

(13:52):
that they are, uh, if you'relevel two need to be level two,
uh, uh, certified, then theyneed to attest that they're
level two certified or they'reworking on it or however you,
you need to know their state,right?
So if you have to be level twocertified, then by the time you
are, they have to be as well.

Austin (14:13):
So you don't have to develop your own SPRS portal and
system and questionnaire.
You more or less just need astatement, written statement or
attestment that they aresufficient.
Right.

Brooke (14:27):
Okay.
And you can ask them for theirSPRS score.
You can ask them for all sortsof stuff, but ask them for their
SPRS score and stuff like that.
But yes, it doesn't have to behugely complicated.
You don't have to develop aportal or anything, but you do
have to verify that they'rethere at the correct level.

Austin (14:47):
That's it today, guys.
If you have any questions aboutwhat we covered, please reach
out to us.
We're here to help fast-trackyour compliance journey.
Text, email, or call in yourquestions.
We'll answer them for free hereon the podcast.
You can find our contactinformation at
cmmccomplianceguide.com.
Stay tuned for our nextepisode.

(15:07):
Until then, stay compliant,stay secure, and make sure to
subscribe.
Advertise With Us

Popular Podcasts

On Purpose with Jay Shetty

On Purpose with Jay Shetty

I’m Jay Shetty host of On Purpose the worlds #1 Mental Health podcast and I’m so grateful you found us. I started this podcast 5 years ago to invite you into conversations and workshops that are designed to help make you happier, healthier and more healed. I believe that when you (yes you) feel seen, heard and understood you’re able to deal with relationship struggles, work challenges and life’s ups and downs with more ease and grace. I interview experts, celebrities, thought leaders and athletes so that we can grow our mindset, build better habits and uncover a side of them we’ve never seen before. New episodes every Monday and Friday. Your support means the world to me and I don’t take it for granted — click the follow button and leave a review to help us spread the love with On Purpose. I can’t wait for you to listen to your first or 500th episode!

Stuff You Should Know

Stuff You Should Know

If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.

Dateline NBC

Dateline NBC

Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com

Music, radio and podcasts, all free. Listen online or download the iHeart App.

Connect

© 2025 iHeartMedia, Inc.