Story perspectives

New Cybersecurity Standards Set for Defense Contractors by 2025

9/10/2025

Summary

Story summary

The Cybersecurity Maturity Model Certification (CMMC) program will start on November 10, 2025, mandating contractor compliance with cybersecurity standards.
Contractors must perform self-assessments for Levels 1 and 2, while Level 3 requires third-party assessments.
A survey found that 44% of organizations lack end-to-end encryption, a critical CMMC requirement.
The Defense Department stresses that compliance is vital for national security and contract eligibility.
Continuous compliance is necessary; companies must embed cybersecurity practices to stay competitive in defense.

History

Historical Context

The Federal Information Security Management Act (FISMA) of 2002 mandated federal agencies to secure their information systems, leading to the development of guidelines by the National Institute of Standards and Technology (NIST). In response to rising cybersecurity threats, the Cybersecurity Maturity Model Certification (CMMC) was introduced in 2019 to enhance security practices among defense contractors, impacting the $768 billion defense industry.

1 of 2

Story summary

The Cybersecurity Maturity Model Certification (CMMC) program will start on November 10, 2025, mandating contractor compliance with cybersecurity standards.
Contractors must perform self-assessments for Levels 1 and 2, while Level 3 requires third-party assessments.
A survey found that 44% of organizations lack end-to-end encryption, a critical CMMC requirement.
The Defense Department stresses that compliance is vital for national security and contract eligibility.
Continuous compliance is necessary; companies must embed cybersecurity practices to stay competitive in defense.

1 / 2