It’s been five years.
I’m sure you heard it…
It started with a rumble: whispers of CMMC echoing across the small business shoreline. Drafts, delays, webinars galore—it felt like a storm that kept churning the surf. Some contractors scrambled to patch holes in their cyber boats; others cracked a beer under the tarpaulin, feeling the wind while waiting it out.
A fascinating view of human nature.
Then the ocean pulled back. Silence. Nothingness. CMMC 1.0 faded with just the hush of a retreating tide. Maybe it wasn’t coming after all?
Maybe it’d all just go away…
But now—WHOOOOSH — that’s the sound of a massive wall of water coming back to shore, with a vengeance!
Title 48 is filling the horizon, soon to crash down like a thousand-page compliance tsunami. This isn’t a drill. It’s CMMC 2.0, codified, clarified, and carrying the full weight of enforcement. If you’re a defense contractor and not building your ark, you’re going swimming.
The Important Bits
From the last amended date 7/7/2025:
eCFR :: 48 CFR Part 204 Subpart 204.75 -- Cybersecurity Maturity Model Certification
(DFARS Part 204 Subpart 204.75)
- Contracting officers must include required CMMC level in solicitations.
- No awards without valid (≤3 years old) CMMC certificate.
- Contractors must:
- Be certified at award.
- Stay certified during contract.
- No extensions without valid certification.
- CMMC status verified via SPRS.
- Before Oct 1, 2025: Clause used selectively, approved by OUSD(A&S).
- After Oct 1, 2025: Clause in all contracts except those for COTS items.
Why Does This Matter?
For small defense contractors, this isn’t just paperwork—it’s survival. Those who
mapped their networks, classified their assets (maybe even those weird IoT coffee
makers), and documented a rock-solid SSP? They’ll be surfing this massive wave. The
rest? They risk getting swept off the approved vendor map altogether.
It’s scary, for sure. But you’re not alone. We can help get you ready for the wave, chart
a course, and maybe build you a cybersecurity lifeboat to surf it just in time.
But for now, let us unpack what Title 48 actually requires before it floods your inbox?
What Is Title 48?
Title 48 CFR governs federal acquisition regulations, and its recent update integrates CMMC 2.0 into the procurement process. While 32 CFR establishes the CMMC program’s structure, 48 CFR is the enforcement mechanism—the teeth behind the policy. Once implemented, contractors must be CMMC-certified at the appropriate level before they can be awarded DoD contracts.
This means cybersecurity is no longer a best practice—it’s a contractual requirement.
The CMMC Framework in a Nutshell
CMMC 2.0 simplifies the original five-level model into three tiers:
- Level 1: Basic safeguarding of Federal Contract Information (FCI)
- Level 2: Advanced protection of Controlled Unclassified Information (CUI),
aligned with NIST SP 800-171 - Level 3: Expert-level security for high-priority programs (still under development) Small manufacturers handling CUI will likely need Level 2 certification, which includes third-party assessments by Certified Third-Party Assessment Organizations (C3PAOs).
The Impact on Small Manufacturers
For small manufacturers, the CMMC Title 48 rule is a double-edged sword: it raises the
bar for cybersecurity but also raises the cost of doing business.
- Compliance Costs
- Infrastructure upgrades: Many small firms lack the IT backbone to meet CMMC Level 2 requirements.
- Consulting and assessments: Hiring experts to conduct gap analyses, write System Security Plans (SSPs), and prepare for certified assessments can be expensive.
- Ongoing maintenance: Compliance isn’t a one-time event. It requires continuous monitoring, updates, and documentation.
- Resource Constraints
- Small teams often wear multiple hats. Adding cybersecurity compliance to the mix can stretch already thin resources.
- Unlike large primes, small businesses may not have dedicated IT or compliance departments.
- Contractual Pressure
- No certification, no contract: Under 48 CFR, certification is a prerequisite for award—not a post-award checkbox.
- Flow-down requirements: Even subcontractors must comply, meaning small manufacturers in the supply chain can’t rely on primes to shield them.
- Timeline Crunch
- Before October, 2025, it’s a selective rollout.
- After October, 2025—it’s all contracts containing CUI.
Strategies for Staying Afloat
FNI can help your company take the steps to ride the wave instead of being swept
away.
✅ Conduct a Free Readiness Assessment
Schedule a free 30 minute appointment with FNI. We will evaluate your company’s
readiness based off a series of weighted questions to approximate your level of
readiness – no strings attached!
✅ Do a CUI Flow Analysis
Contract with FNI to map your data throughout your organization and determine what,
exactly, you’re facing when it comes to your organization’s boundary that needs to meet
CMMC requirements. This is a one-time project with a fixed cost, with no additional
strings attached.
✅ Leverage FNI ’s OMNI: CORE Enclave
The DoD allows the use of IT enclaves—segmented environments that isolate CUI. This
can reduce the scope (and cost) of compliance. FNI stands up pre-modeled enclaves
either in the cloud, or on-premises.
The Time is Now
If your company has DoD contracts that contain CUI, the time for waiting is over.
Get compliant, or lose your DoD contracts.
