CMMC Enforcement Update – Prime Contractors Are Actively Requiring Compliance

We want to make you aware of a shift we are seeing across the Defense Industrial Base that directly impacts subcontractors.

Prime contractors have begun formally enforcing CMMC requirements across their supply chains, including issuing supplier surveys, requiring updated attestations, and validating CMMC status prior to contract awards. These requests are no longer informational in nature; they are being tied directly to award eligibility and subcontracting decisions.

Recent communications from primes make the following points clear:

1. CMMC is final and enforceable
2. If CMMC DFARS clauses are included in a contract or solicitation, compliance is mandatory and non-negotiable
3. Prime contractors may not award subcontracts to organizations that are not compliant with the required CMMC level
4. Most suppliers handling CUI are expected to meet CMMC Level 2
5. Organizations operating under a POA&M are not eligible for a Final CMMC Level 2 status

Suppliers are being required to formally document:

• • Their current CMMC level
  • Whether assessments are Self or C3PAO
  • Whether status is Conditional or Final
  • SPRS submissions and Unique Identifiers (UIDs)
  • Estimated completion dates if not yet compliant

We are also seeing primes require updated supplier forms, digital or wet signatures, confirmation of Medium Level of Assurance (MLOA) certificates where applicable, and strict completion of all DFARS-related attestations, with returned or incomplete submissions delaying awards.

The key takeaway is this: CMMC preparedness is now a gate to doing business, not a future planning exercise.

If your organization is targeting or currently supporting DoD work, this is the time to ensure that:

• • Your required CMMC level is clearly understood
  • Your assessment path (Self vs. C3PAO) is defined
  • Your documentation, training, and operational controls are assessment-ready
  • You have a defensible timeline if you are not yet compliant

If you would like to review your current posture, validate what level applies to your contracts, or build a realistic path forward that aligns with how primes are enforcing these requirements, please reach out. We are actively helping customers respond to these exact supplier requests.