As cybersecurity enforcement continues under the False Claims Act, the latest Cybersecurity Maturity Model Certification (CMMC) update raises the stakes for defense contractors and subcontractors. Last month, the U.S. Department of Defense published a long-awaited final rule to implement the CMMC that will have far-reaching implications across the defense industrial base. Mandatory implementation begins on November 10, 2025. To help contractors navigate the new regime, this article synthesizes insights offered during a Crowell & Moring presentation on the key provisions of the new final rule – including certification and attestation requirements, assessments and implementation timelines – supply chain considerations, enforcement risk and ensuring CMMC compliance. See our two-part series on getting started with CMMC: “Understanding Goals, Requirements and Challenges” (Jan. 27, 2021), and “How to Prepare and What to Expect From the Assessment” (Feb. 3, 2021).