If you touch DoD work anywhere along the Route 29/I-95 corridor, CMMC is no longer “coming soon”—it’s here. As of September 10, 2025, DoD finalized the DFARS “Clause Rule” that puts CMMC requirements directly into solicitations and contracts. Contracting officers can begin inserting the CMMC clauses starting November 10, 2025 (60 days after publication).
Right here in Columbia Gateway and greater Howard County, many SMBs are either primes or subs on defense work—and even professional services and clinics that serve those contractors feel the ripple effects. This guide translates the rule into clear steps you can act on, locally.
The 2 Rules That Matter (In Plain English)
- 32 CFR Part 170 — “Program Rule.” This established the CMMC program itself in 2024 (levels, assessment types, ecosystem).
- DFARS / 48 CFR — “Procurement/Clause Rule.” Finalized September 10, 2025; it embeds CMMC into solicitations and contracts through updated clauses. Phase-in begins November 10, 2025.
Clauses you’ll see:
- DFARS 252.204-7025 (notice in solicitations) and an updated DFARS 252.204-7021 (the contract clause that sets your required CMMC level).
| CMMC Level | When It Applies | Assessment Type | What You Actually Need |
|---|---|---|---|
|
Level 1
|
You handle FCI | Annual self-assessment | 17 basic cyber practices (“good hygiene”) mapped to FAR/DFARS expectations. |
| Level 2 | You handle CUI | C3PAO third-party assessment for prioritized contracts (self-assessment allowed for some non-prioritized) | Implement all 110 controls in NIST SP 800-171 with evidence. |
| Level 3 | High-priority programs | Government-led (e.g., DIBCAC) | Enhanced requirements (often drawing from NIST SP 800-172) plus deeper scrutiny. |
Heads-up: The final DFARS rule introduces “CMMC status” in SPRS, tightens POA&M expectations, and clarifies flow-down to subs. F
Local Stakes for Howard County SMBs
- Gov-adjacent contractors around Fort Meade/Columbia Gateway will see CMMC levels specified in new solicitations. If you don’t meet the level, you’re ineligible—full stop.
- Professional services (legal/accounting) and healthcare clinics supporting those contractors need strong Microsoft 365 hygiene, secure file sharing, and audit-ready evidence—these are already top priorities in our market.
- Maryland breach timelines (e.g., 45-day notice) should be baked into your incident response playbooks alongside CMMC controls.
This aligns with what local decision-makers like Chris Delaney (Managing Partner) expect: audit readiness, clear dashboards, fast local support—no geek-speak.
Timeline (What to Watch)
- Nov 10, 2025: CMMC clauses begin appearing. Level 1 and Level 2 self-assessments show up in many Phase-1 procurements.
- Through 2026–2027: Level 2 C3PAO assessments scale up in prioritized contracts; Level 3 shows up on more programs during the phase-in.
Your Columbia-Focused To-Do List (No Geek-Speak)
- Inventory FCI/CUI across Microsoft 365 (Entra ID, SharePoint/OneDrive, Exchange Online) and key endpoints. Map which contracts and systems touch them.
- Pick your target level by contract: Level 1 vs. Level 2 (prioritized vs. non-prioritized). If you touch sensitive programs, discuss Level 3 with your prime or KO.
- Run a gap assessment against NIST 800-171 (for Level 2): identity/MFA, endpoint EDR/MDR, email security, backup/immutability, logging/retention.
- Build a realistic POA&M (close gaps fast). Understand conditional status expectations and time limits.
- Evidence ≠ paperwork dump. Produce auditor-friendly artifacts: policies, procedures, tickets, scan/vuln results, training, incident drills, and board-ready metrics.
- Book your C3PAO early (where required). Assessment capacity will be tight during the phase-in.
- Align leadership & budget. Treat this like revenue protection. Local firms prize fast response and clear SLAs—make that visible.
- Watch solicitations. Starting Nov 10, 2025, read the 7025 notice and 7021 clause closely for required level and flow-down duties to subs.
“You’ll never have to wonder if you’re protected—we’ll show you exactly where you stand and fix what isn’t right.” ← the reassurance your buyers want.
Why Start Now (Especially Here)
- Competitive edge: Being certified (or credibly on track) lets you bid with confidence as clauses ramp up.
- Local density: Howard County’s mix of defense, professional services, and healthcare means overlapping compliance (CMMC + HIPAA). Doing both well creates a referral flywheel.
- You’re closer than you think: Many controls mirror what you’re already doing in Microsoft 365—success is about hardening, documenting, and proving.
How We Help (Packages Mapped to Your Reality)
- Good (Foundational): Helpdesk, patching, 365 management, EDR, backup, standard SLA.
- Better (Secure-Ops): + MFA enforcement, conditional access, phishing training, vuln scans, MDM, quarterly vCIO.
- Best (Compliance-Ready): + CMMC control mapping/evidence, HIPAA safeguards, risk analysis, vendor reviews, DR testing, incident runbooks, and audit support—with metrics an exec can read.
