CMMC Final Rule Brings Operational Technology Into Scope for Defense Contractors

After more than six years of debate and revision, the Department of Defense (DoD) has finalized its Cybersecurity Maturity Model Certification (CMMC) program. On Sept. 10, 2025, DoD issued its final rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) to incorporate CMMC requirements into defense contracts. Known as the Acquisition Rule, it formally embeds CMMC into the contracting process and builds on the 2024 Program Rule, which established the framework and substantive requirements.

CMMC Final Rule Brings Operational Technology Into Scope for Defense Contractors

Month