Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

CMMC 2.0

In force United States (Federal) · In force Dec 16, 2024 · next deadline Nov 10, 2026 (in 14 days)

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

Coming up
ComplianceNov 10 · in 14 days · Source
Phase 2: Level 2 C3PAO certificationPhase 2 begins one calendar year after Phase 1; applicable solicitations require CMMC Level 2 third-party (C3PAO) certification (32 CFR 170.3(e)(2)).
ComplianceNov 10, 2027 · in 12 months · Source
Phase 3: Level 3 certificationPhase 3 begins one year after Phase 2; Level 3 (DIBCAC) requirements added to applicable solicitations (32 CFR 170.3(e)(3)).
ComplianceNov 10, 2028 · in 2 years · Source
Phase 4: full implementationCMMC requirements included in all applicable DoD solicitations and contracts, including option periods (32 CFR 170.3(e)(4)).
Already passed
Takes effectNov 10, 2025 · 12 months ago · Source
DFARS rule effective; Phase 1 beginsCMMC Level 1 and Level 2 self-assessment requirements begin appearing in applicable DoD solicitations and contracts (32 CFR 170.3(e)(1)).
Takes effectDec 16, 2024 · 22 months ago · Source
CMMC Program rule (32 CFR Part 170) effectiveThe program rule establishing CMMC levels and assessment processes took effect; contract enforcement awaited the DFARS rule.

Summaries for reference, not legal advice. Check the official text.

What it does

Requires defense contractors and subcontractors that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) to meet a specified CMMC level (Level 1 self-assessment, Level 2 self- or third-party (C3PAO) assessment against NIST SP 800-171, Level 3 DIBCAC assessment against selected NIST SP 800-172 controls) as a condition of contract award. Requirements are phased into DoD solicitations over four years.

Who it applies to
DoD prime contractors and subcontractors at all tiers whose information systems process, store or transmit FCI or CUI in contract performance; excludes contracts solely for commercially available off-the-shelf (COTS) items.
Penalties
Ineligibility for award or option exercise; misrepresented affirmations can create False Claims Act and contractual liability.
Enforced by
U.S. Department of Defense (DoD CIO, contracting officers, DCMA DIBCAC); Cyber AB accredits C3PAOs
Official name
Cybersecurity Maturity Model Certification (CMMC) Program (32 CFR Part 170) and DFARS acquisition rule (48 CFR Parts 204, 212, 217, 252)
Citation
32 CFR Part 170 (89 FR 83092, Oct. 15, 2024); DFARS Case 2019-D041, 90 FR 43560 (Sept. 10, 2025)
Topics
Cybersecurity
Verified 2026-09-22 federalregister.gov dodcio.defense.gov
Research notes

Phase dates computed per 32 CFR 170.3(e): Phase 1 starts on the later of the Part 170 or the 48 CFR rule effective date (November 10, 2025), each later phase one calendar year after the previous; DoD may include higher requirements earlier at its discretion. The DoD CIO site could not be fetched during verification.

Related

In forceUnited States
AI state-law preemption EODirects federal agencies to push back on state AI laws seen as onerous. It orders a DOJ AI Litigation Task Force, a Commerce list of conflicting state laws, BEAD and grant funding conditions, an FCC disclosure-standard proceeding and an FTC policy statement on AI outputs. It does not itself preempt any state law; that needs Congress or court rulings.In effect since Dec 11, 2025
EnactedUnited States
CFPB Open Banking Rule (Section 1033)Requires banks, card issuers and other data providers to give consumers and authorized third parties their transaction and account data through a secure developer interface, free of charge. Third parties must limit collection, use and retention to what the consumer requested. The CFPB is reconsidering the rule and a federal court has barred its enforcement until that reconsideration ends.Next: Apr 1, 2027 Tier 2 compliance date (original) · in 5 months
EnactedUnited States (Federal)
CIRCIADirects CISA to require covered critical infrastructure entities to report covered cyber incidents within 72 hours of reasonably believing one occurred and ransom payments within 24 hours of payment, and to preserve related data. Reporting obligations begin only once CISA's final rule takes effect.No date set
AmendedUnited States (Federal)
COPPA RuleRequires operators of child-directed online services, or those with actual knowledge they collect personal information from children under 13, to give notice and obtain verifiable parental consent before collecting, using or disclosing that data. The 2025 amendments add separate parental consent for disclosures to third parties (including for targeted advertising), require a written data retention policy and a written information security program, expand 'personal information' to include biometric identifiers and government-issued identifiers, and tighten Safe Harbor program oversight.In effect since Apr 21, 2000
In forceUnited States (Federal)
DOJ Bulk Data RuleProhibits U.S. persons from data brokerage and genomic-data transactions with countries of concern or covered persons, and restricts vendor, employment and investment agreements involving bulk U.S. sensitive personal data or government-related data unless CISA security requirements are met. Restricted transactions require a data compliance program, due diligence, audits, recordkeeping and reporting.In effect since Apr 8, 2025
AmendedUnited States (Federal)
FCC CPNI Breach RuleThe 2023 order expands carrier breach rules from CPNI to all customer personally identifiable information, covers inadvertent disclosures, requires notice to the FCC (in addition to the Secret Service and FBI) within seven business days, and adopts a harm-based trigger for customer notice. Until the revised 64.2011 takes effect, the existing CPNI breach rule (law enforcement notice within 7 business days, customer notice after a waiting period) continues to apply.In effect since Mar 13, 2024
AmendedUnited States (Federal)
FTC Health Breach Notification RuleRequires vendors of personal health records (including health and wellness apps) and PHR related entities not covered by HIPAA to notify affected individuals, the FTC and, for 500+ residents of a state, prominent media, after a breach of unsecured PHR identifiable health information. The 2024 amendments confirm that unauthorized disclosures (not just hacks) are breaches, clarify coverage of health apps drawing data from multiple sources, allow email notice, and expand notice content.In effect since Sep 24, 2009
AmendedUnited States (Federal)
GLBA Safeguards RuleRequires non-bank financial institutions under FTC jurisdiction to maintain a written information security program with a qualified individual, risk assessments, access controls, encryption, MFA, monitoring and board reporting. Since May 13, 2024, institutions must notify the FTC within 30 days of discovering a 'notification event' (unauthorized acquisition of unencrypted customer information) affecting at least 500 consumers.In effect since May 23, 2003
Questions about CMMC 2.0
What are the CMMC 2.0 compliance deadlines?
Dec 16, 2024: CMMC Program rule (32 CFR Part 170) effective. Nov 10, 2025: DFARS rule effective; Phase 1 begins. Nov 10, 2026: Phase 2: Level 2 C3PAO certification. Nov 10, 2027: Phase 3: Level 3 certification. Nov 10, 2028: Phase 4: full implementation.
When does CMMC 2.0 take effect?
CMMC 2.0 took effect on Dec 16, 2024. The next milestone is Nov 10, 2026: Phase 2: Level 2 C3PAO certification.
Who does CMMC 2.0 apply to?
DoD prime contractors and subcontractors at all tiers whose information systems process, store or transmit FCI or CUI in contract performance; excludes contracts solely for commercially available off-the-shelf (COTS) items.
What are the penalties under CMMC 2.0?
Ineligibility for award or option exercise; misrepresented affirmations can create False Claims Act and contractual liability.