CMMC Requirements Are Starting To Show Up

CMMC officially goes into effect on November 10th, 2025, at which point all new DoD solicitations and contracts will include at least CMMC Level 1 status requirements. While the government shutdown might affect the pace of new contract awards, it doesn’t change anything about the effective date of CMMC specifically. This week we’re looking at the trickle of contract notices that are letting people know CMMC is very real and will absolutely be required (including level 2).

---

Transcript

All right, folks. It is almost the end of October of 2025. And if you remember way back in the day, the 48 CFR CMMC final rule was published in the Federal Register on September 10th of 2025. The regulation officially goes into effect on November 10th of 2025, at which point all new DoD solicitations and contracts will include at least CMMC level one status requirements. While the government shutdown might affect the pace of new contracts, it doesn’t change anything about the effective date of the CMMC program and contracts specifically. So, even though SAM.gov is very quiet at the moment thanks to the shutdown, we have seen seven notices coming out that let people know that CMMC is very real and will absolutely be required including some level two requirements and that’s what we’re going to talk about today.

Okay, first and foremost, let’s get it out of the way. The elephant in the room, seven notices. We had no influence over that whatsoever. Um, and then the only other thing that I have going into this episode, Jacob, uh, is, uh, my question is, is this a case where, um, people were following 7304 too far and they didn’t remove it when maybe the class deviation came out or things of that nature, right? The requirements within the contracts. I’m also interested to see if we’re seeing it in seven contracts, what kind of contracts are they? Are they really high-speed contracts? Are they what what’s it going to be? So, I’m really excited for this.

Yeah. No. And these are all either new uh or up these are all either new notices or requests or they’re updates to things that were published just prior to the rule being published itself. Uh and we’ll see that as we sort of walk through them. But yeah, these are not mistakes. These are actually, you know, what it’s going to look like in the in the brave new world that we’re going to be in after November 10th.

So, first up, NAVSEA (Level 2). The Navy has a notice on SAM.gov under Naval Sea Systems Command. They have a request for information on semiconductors and related device manufacturing. The Navy is looking for information related to establishing a US onshore 300 millimeter wafer production fabrication capability for magnetoresistive random access memory devices utilizing magnetic tunnel junction technology with a focus on production foundry capabilities. Uh that’s what they’re looking for. There’s all kinds of cool stuff that you see on SAM.gov. However, if you scroll through this uh this notice, this RFI on SAM.gov, they say at a minimum, the envisioned US onshore fabrication capability shall meet the following requirements. And they give you a big list. And inside of that list, it says shall be able to support an ITAR compliant manufacturing flow, including at a minimum CMMC level two for the protection of customers controlled unclassified information categorized as export controlled.

They say that the requirement for this ITAR CUI compliance is driven by the need for this random access memory manufacturing capability in radiation hardened memory microcircuits customd designed to meet specific natural space and man-made radiation environments. If you’re doing micro electronics manufacturing, if you’re doing reshoring of high-speed manufacturing of micro electronics, nextgen things like that, high-speed fabrication, they’re straight up saying it’s going to be CMMC level two, not CMMC itself assessment, CMMC level two. So, this is a Navy Sea Systems Command RFI. And they say it right there. They say it right in the uh right in the RFI on there.

So, right out of the gates, uh we see a contradiction to what everybody seems to think, right, Jacob? uh the phased roll out begins. Oh, we’re going to have level one requirements inside of our contracts, but here the very first solicitation that we see says uh not only is it level two, but it’s specified CUI level two on this mag. I’m not even going to try the who’s they’re making microchips that go into radiation in, you know, radiation hardened microchips for some crazy space-based application that is super export controlled.

Yeah, it doesn’t sound like something that you would want level one controls, making sure that that security is in place or you want to take somebody’s word on it. We want to make sure this stuff’s locked down so it doesn’t get out there. It sounds like a lot of money spent on it. But with that being said, like I mentioned at the at the beginning of the comment is that this is already a contradiction to what people’s belief is right now. The belief is I’m only going to have to self assess. I’m only going to have to do level one. The very first solicitation that we talk about, bam.

Yeah. Level two, which you know, it’s an RFI. So reach out to NAVC and tell them you can’t do it and you need an exception or tell them you can’t. Kind of crazy that it came from Navy too, right? I I I would in our experience Navy I think has been the one where there’s more explaining that’s needed, right? And then all of a sudden they’re just out the gates bam bam bam.

Yeah. So and this is only one thing, right? I mean obviously there’s going to be a million different RFIs, RFPs, notices on SAM.gov, especially once things open back up. But, you know, we’ve been we’ve been shouting from the rooftops for a long time now, telling people that during phase one, that first 12 months, there is no prohibition on CMC level two status being a requirement. It’s totally up to DoD’s discretion when it comes to making radiation hardened micro electronics for 300 millimeter wafer production fabrication capabilities. Level two it is. So, we’ll include the link to uh that RFI and you guys can check it out for yourself.

Next up, there’s one from USSOCOM (Level 1). Special Operations Command, US SOCOM. They have a notice on there for global services delivery sources sought. This is for administrative management, general management, consulting services. So, very, very different from making precision radiation hardened micro electronics. They’re actually updating a notice that they put on SAM.gov prior to the 48 CFR CMMC rule being published. They say this update is provided to place offerers on notice that the final CMMC rule was released on 10 September 2025 based on the implementation date of 10 November 2025 and an anticipated request for proposal release date that falls after that implementation date.

The government will include a CMC pass fail requirement in the final RFP as qualifying criteria. They say it’s currently anticipated that CMC level one will be required at the time of proposal uh submission. Potent potential offerers are encouraged to begin working to meet this requirement if you have not already done so. They go on to say prime offerers are encouraged to ensure that team members, so they’re subcontractors, team members have also completed this requirement as a prime offerer will be disqualified if it is determined that an identified team member does not also meet CMMC level one qualification.

So they want administrative support, consulting support, general management consulting services. So not super high speed, not doing consulting in space, right? This is not ITAR rated whatever. It’s just sort of general support services, but it’s a contract after the effective date. So, it’s going to have at least CMMC level one. So, some people think that’s easy. That’s no big deal. A lot of people think that that’s a bridge too far. Here you go. If you’re trying to do uh administrative management and general management consulting services for US special operations command next year, then uh you’re going to have to be able to prove that you have at least CMC level one and your subs have at least CMMC level one.

Yeah, that was the thing that stood out to me the most. Uh this wasn’t one where the level uh exceeded what was supposed to be uh uh supposed to take place, right? We didn’t go past level one self-assessment and what we expected, what people’s expectations were. But what we did say is that your entire supply chain has to be in order and if it’s not in order, uh you’re not going to get awarded this contract. You’ll just be disqualified.

Absolutely. So we had the Navy, we had USACE (Level 2). US SOCOM, now we have US Army Corps of Engineers, and there’s a ton of stuff from the Army Corps of Engineers uh that has uh mentions of CMMC requirements in it. They’re probably the ones that have, you know, they’re the most in front of this requirement for the current set of things that are on SAM.gov.

So under the core of engineers for commercial and institutional building construction, they want uh people to uh uh solicit offers for the construction of groundbased strategic deterrent sentinel operations group facilities at few air force base in Wyoming. So GBSD, this is America’s intercontinental ballistic missile system. So they’re building buildings around intercontinental ballistic missiles, which is kind of a big deal. So they say in this notice the project is anticipated to be subject to cyber security maturity model certification level two pursuant to def clause 7021. Firms will need to ensure they are properly certified. Failure to meet the CMMC level two requirement will make an offerer ineligible for award. They’d anticipate that the award will happen in FY27.

So, you have a ton of time before they’re going to award this contract. You are going to be making buildings that go around intercontinental ballistic missiles at a strategic air force base in Wyoming. You know, like in Terminator when like the the the prairie opens up and the giant missiles fly out of the ground, that’s what you’re making buildings around. So, you’re going to probably need CMMC level two at a minimum, although that even seems a little loose to me. It ain’t going to be level one, and it probably won’t be a self assessment for obvious reasons.

But we’re talking about construction companies here, right? We’re not talking about, you know, some high-speed space-based laser uh micro electronic whatever, right? But you’re in and around these facilities. You’re dealing with whatever the data is that they’re talking about here.

In this uh notice on SAM.gov, They say, “Please include the following information in your response narrative. Briefly describe your firm’s current status regarding CMMC progress.” Remember, this isn’t until FY27. We’re talking about, you know, basically a year from now, October of uh 2026. Briefly describe your firm’s current status regarding the CMMC process. This includes but is not limited to whether you are actively working towards certification at a specific level or have already achieved CMMC certification. If you are certified, please indicate the achieved level.

So a year before they plan to award it, they’re like where are you on your progress? Are you progressing or do you already have your C? And I would imagine that if you put down we already got our cert that that’s going to be a huge help.

I don’t know a year is a long time so maybe other people are going to get their certs and they’ll be able to say yeah we’re working on it. We’ll let you know. But they’re telling you right now a year from now level two.

Well yeah so let’s talk about what stands out here. Everybody always applies CMMC requirements uh automatically to I make a part for a missile. I make this special chip that goes into this. I I make this that goes into this particular name your defense capability here, right? And then we’re like, well, what about some of those like not directly impacted contracts?

Are we going to see this pop into this construction one? Is one people don’t realize the importance of protecting maybe the blueprints for the buildings that surround those silos, protecting some of the capabilities of those buildings, and that’s why these requirements go into it.

Um, do you think, and this is just a strict question to you, do you think because it’s a construction based one and they’re going to have to submit like design drawings, architecture drawings, and all that to be bid on and approved on, right? Uh, they’re going to have to accept not only the contractor’s uh, proposal, but what the contractor’s design is, right? So maybe because the narrative’s there, they have to have all that in place because it’s such a longer process.

Yeah. I don’t know. I mean, the uh, you know, that reading through the SAM.gov, of, you know, notice on there. There’s tons of stuff in there that are specific to the construction industry and the types of buildings and the types of like reinforced concrete footings that they have to make.

You there’s a lot of situational stuff that I’m sure can drive those requirements. But the thing that’s what I did a terrible job of trying to ask the question for is like are there situational things as to why we’re seeing this pop out because the anticipated award is 27 or is this just these the Army Corps of Engineers being way ahead of it is kind of what it’s hard to know.

I mean, I’m sure that a lot of for a lot of these big expensive construction projects, some of these construction projects are like, you know, they’re they’re basically saying like, don’t even don’t even talk to us if you can’t support like a $175 million project or larger. And they think that it’s going to be in the neighborhood of like$1 175 mil to $250 million project over the course of like,00 days, right? So, they’re pretty certain like the scale of these things.

But yeah, that’s the part that jumped out to me was they’re not saying that you don’t need a level two cert until FY27 because of the phased rollout. They’re saying you need a level two in FY27 because that’s when we’re going to award the contract, right?

So if they were going to say we’re going to award this in Q4 of 2026, phase roll out is not what’s driving this requirement. Just happens to be that’s when the award period is going to be. They aren’t saying in the interim you can do a self assessment. There’s no work until they award the contract. So the phase roll out is not what’s driving, hey, you don’t need this for a year. It’s the contract award, anticipated contract award date.

Yep.

Yeah. All righty. So, we talked about USACE Japan (Level 1). The Navy. We talked about SOCOM. We talked about Army Corps of Engineers.

Army Corps of Engineers has several other notices on SAM.gov currently, including housing revitalization projects in Yakusa, Japan. So, base housing. Uh, anybody who’s lived in base housing knows they’re constantly in need of renovation. Uh, they have a multiple award task order contract in Honshu, Japan. They have a bulk fuel storage tanks phase 2 opportunity at Yakakota Air Base in Japan.

So, you’re talking roofers. You’re talking just a multiple award contract. You’re talking bulk fuel storage specialty construction. Everything from micro electronics to roofing to building concrete footings for missiles. Like there’s all kinds of stuff that is on SAM.gov all the time.

But the overall thing that the Army Corps of Engineers put into each of these is they’ve said the Army Corps of Engineers Japan District anticipates that all solicitations issued on or after November 10th will require CMMC level one certification or higher. Period. Right.

say if your company is not certified at level one or higher, you will not be eligible to receive a contract award. They have related questions in all of these notices on SAM.gov. One of them on there says, “Does your company have CMMC certification? If yes, what level and when does it expire?”

They say, “The government is seeking to minimize proposed variations or substitutions during the solicitation bidder inquiry period.” bad news for everybody that says, “We’re just going to ask for special treatment. We’re just going to ask for a waiver. We’re just going to ask for this to not be a problem.”

They say, “We’re seeking to minimize all of the nonsense during the bidder inquiry period due to strict timelines. Our ability to fully analyze these requests during the solicitation phase is often limited.”

We’ve said this multiple times, right? the the the cardinal sin of running a business is being difficult to do business with. And so the government is saying you’re going to need this certification if you want an award. Period.

Please tell us if you have the cert and when it expires. We don’t want to spend time going back and forth with people over this requirement. There’s many other things that they list as well, but this is relevant to the podcast.

So if you got the C, you can say, “Yep, we got it. doesn’t expire for two years, doesn’t expire for three years, doesn’t expire for whatever,” and they don’t have to sit there and give you special treatment for it. They don’t have to carve out time for it. It’s just one more thing that isn’t going to be a discriminator against being able to do work with them. And that’s for all Army Corps of Engineer offerings for the entire Japan district.

Now, if level one is the requirement, obviously, uh you shouldn’t be trying to get variations or substitutions or waiverss or anything like that, right? Because of the simplicity of it. Um, but if level two is your requirement and you’re trying to get that there, there’s just not time to do that and if you’re depending on that trying to compensate for the fact that you didn’t get the waiver and make up for it to get done in time, it’s just not enough time, especially if they’re trying to move faster.

Yeah. Yeah.

So, some other Army Corps of Engineers notices that we’ve seen on SAM.gov, and this is all since September 10th, right? So, this is all stuff that’s happened in the last handful of weeks when there really hasn’t been a lot of activity on SAM.gov because of the shutdown.

So other things that we’ve seen, semiconductor test labs at Whitand Missile Range in New Mexico, probably going to be at least level two based off of just the title of what they’re talking about. The John Day Dam turbine runner replacement and generator project in Rufus, Oregon. So we’re talking about hydroelectrics.

We’re talking about micro electronics, roofing, bulk fuel storage, general admin support. everything that the DoD is doing, you’re going to have a CMMC level one requirement in it at least starting on November 10th. And for some of these, you’re going to have CMMC level two status requirements.

The phased roll out doesn’t matter, right? It is not a prohibition on including it. The problem that I see is that these are all the things that have sort of snuck through for whatever reason. they’re allowable or they’re priority.

But, you know, we’re into the next fiscal year now and we haven’t seen the long range acquisition forecasts get posted by the various DoD components. So, I think what’s going to happen is once the government opens back up, there’s going to be a huge rush to try to get these uh, you know, RFPs, RFIs, solicitations out there onto SAM.gov.

And it’s going to be even more constrained like the Army Corps of Engineers said where they’re like we’re way behind schedule. do you have it or do you not have it?

And so you’ll have even less time to anticipate what’s going to be in those uh contract solicitations because instead of them coming out in the last couple weeks, they might not come out for another month or two depending on how long things take, but they’ll still have the same deadline to get.

still going to have the same deadline.

Yeah, I I didn’t even think about that. That’s such a great point. Like the shutdown because they can’t work and the contracts don’t get out, they still have to get fulfilled and there’s still projects that have to get done.

Yeah, if they were planning on, you know, publishing something in October or November to award it in January or February, and you don’t see it until December, right, then you have way less time in order to do the same thing that they were going to require all the time anyway.

So, for everybody out there that says, “We’re going to wait until we see it in a solicitation to believe that it’s real.” Here’s a couple of examples from different components, different industries, different levels, different stuff.

You’re going to see the requirement in this solicitation. Like, don’t don’t be fooled. We’re what 20 days, a little less than 20 days. We’re getting into the, you know, we’re getting close to single digits here from the start of the phase roll out.

That’s crazy.

So, you know, the phase rollout’s going to go live and the government might not be open. So, everybody’s going to be like looking around waiting for things to happen and then as soon as these solicitations come out, then it’s going to be in there.

So, I thought it was interesting to walk through and see that we’re, you know, already seeing very clear-cut examples of CMC requirements. We’ll include all the links to the ones that we mentioned in sam.gov and uh we’ll go from there.

See you next week folks.

See you next week everybody.