CMMC 2.0's Program Rule Is Now in Effect — What Contractors Need to Know
32 CFR Part 170 is live. The DFARS acquisition rule that actually puts CMMC into contracts is rolling out separately, and on its own timeline.
October 21, 2026
v1
2 min
CMMC 2.0's Program Rule Is Now in Effect — What Contractors Need to Know
CMMC 2.0's program rule — 32 CFR Part 170 — became effective in December 2024, formally establishing the three-level model (Foundational, Advanced, Expert) and the assessment mechanisms behind each. That's a separate milestone from the DFARS acquisition rule that actually requires CMMC certification as a condition of a specific contract award.
Two rules, two timelines
- 32 CFR Part 170 (the program rule): defines what CMMC is and how assessments work. Already effective.
- The DFARS acquisition rule: determines when a specific solicitation actually requires a contractor to hold a CMMC certification. Phasing in gradually across new solicitations.
Explore CMMC
Hub overview →
Related Executive Guides
CMMC 2.0's three levels, its direct relationship to NIST SP 800-171, and why the real consequence of non-compliance is contract eligibility, not a fine.
What the CRA actually requires, who it applies to, and the concrete deadlines security, compliance, and product leaders need on their calendar.
Management-body liability is the detail that changes NIS2 from an IT compliance project into a governance question every board should already be asking about.