Final Rule, Real Impact: What 48 CFR Means for Your Contracts | MAD Security Town Hall Webinar Recap – November 2025

Watch the November MAD Security Town Hall Webinar replay 👇

A major shift has arrived for defense contractors. On November 10, 2025, the Department of Defense finalized the 48 CFR update, officially integrating CMMC 2.0 into DFARS. For contractors handling Controlled Unclassified Information (CUI), the rule introduces new enforceable cybersecurity requirements that include verified compliance through CMMC assessments. 

During this month’s MAD Security Cybersecurity Town Hall, hosts Adam Starnes and Jaclyn Jones explained how the new rule affects organizations across the Defense Industrial Base. They discussed what the changes mean for contract eligibility, NIST 800-171 requirements, and the path to achieving CMMC assessment readiness. 

Key Takeaways from the November Town Hall

	48 CFR Final Rule Makes CMMC 2.0 Official The 48 CFR update now formally requires CMMC Level 2 certification for contractors that handle CUI. This marks the end of the voluntary preparation phase and the beginning of mandatory compliance.  Effective immediately as of November 10, 2025 Full certification required by November 2026 Some contracts may require certification earlier than federal deadlines
	SPRS Scoring and Affirmation Requirements The Supplier Performance Risk System (SPRS) now requires detailed scoring for all 110 NIST 800 171 controls. Organizations must provide documentation that supports their scores. Unsubstantiated or inaccurate submissions may result in False Claims Act liability or contract loss.  Minimum score of 88 required to submit an affirmation Organizations must retain documentation supporting each control SPRS scores now influence CMMC assessment readiness and contract awards
	Prime Contractors Are Enforcing Compliance Early Prime contractors have begun requiring subcontractors to show proof of CMMC progress. This includes SPRS scores, System Security Plans, POAMs, and remediation timelines.  Primes remain responsible for CUI flow down Many primes are using internal deadlines earlier than 2026 Subcontractors who cannot show progress may lose opportunities
	Start with a CMMC Gap Assessment A CMMC Level 2 Gap Assessment is the most effective starting point. It evaluates current controls, identifies deficiencies, and creates a roadmap for remediation and assessment preparation.  MAD’s assessments include seven key deliverables including SSP and POAM Control evidence is prepared in alignment with CMMC assessment expectations Gap assessments help organizations demonstrate progress to primes and internal leadership
	Partner with a Certified MSSP  Interpreting control requirements can be challenging. MAD Security provides guidance through its Virtual Compliance Manager (VCM) program, which supports organizations through remediation, documentation, and CMMC assessment preparation. Our experts participate with clients during their C3PAO assessment sessions to help ensure clarity and accuracy.  Support is provided by the same professionals who passed MAD’s own CMMC assessment Assistance includes control interpretation, evidence development and planning The combination of technical and compliance leadership increases assessment success rates

Q&A Highlights from Live Attendees

MAD Security: A Proven Partner for CMMC and DFARS Compliance

MAD Security is a CMMC Level 2 Certified MSSP with a perfect SPRS score of 110. Our mission is to support the Defense Industrial Base by delivering unmatched cybersecurity and compliance expertise. 

Why You Must Act Now

With the 48 CFR rule now in effect, organizations cannot afford to wait. Delaying CMMC preparation increases the risk of: 

These tools offer practical support to help organizations strengthen compliance and improve readiness at any stage of their cybersecurity journey. 

Schedule your session now. 

Final Thoughts: CMMC Readiness Is a Continuous Journey

CMMC is now a permanent requirement for defense contractors, and preparation is an ongoing responsibility. The most successful organizations begin early, build solid cybersecurity habits, and maintain readiness beyond their certification date. You are not alone in this process. MAD Security is ready to guide you every step of the way with proven expertise and mission aligned support.