Live regulatory signals from Federal Register, HHS OCR, SEC, OSHA, FDA, FINRA, EU Official Journal, EUR-Lex, ICO, and per-framework RSS feeds — filtered to the framework that matters to you. Each card links to ComplianceStack’s framework coverage page when one exists.
CMMC 2.0 Phase 2 Launch: What Defense Contractors Need to Prepare
Phase 2 readiness starts with the systems and information named by the contract—not a generic checklist.
This ComplianceStack announcement connects the CMMC rule to the NIST SP 800-171 Rev 2 control baseline and gives defense contractors a source-grounded way to organize scope, assessment path, and evidence.
What the Phase 2 launch means
ComplianceStack is publishing this CMMC 2.0 Phase 2 launch brief for defense contractors and subcontractors that need to translate a CMMC requirement into a concrete readiness workstream. The relevant solicitation or contract identifies the required level and assessment path; this page is an orientation to that source language, not a new contractual requirement.
32 CFR Part 170 is the controlling CMMC rule cited by this brief. It organizes CMMC 2.0 around Maturity Levels and assessment paths. A contractor should read the rule alongside the requirement line and scope of the current DoD solicitation or contract.
The Level 2 baseline
For the Level 2 mapping discussed here, ComplianceStack uses the 110 requirements associated with NIST SP 800-171 Rev 2. NIST describes that publication as security requirements for protecting Controlled Unclassified Information (CUI) in nonfederal systems and organizations, including system components that process, store, or transmit CUI.
NIST's publication page identifies the Rev 2 PDF as the authoritative source for those requirements and also records that Rev 2 has been superseded by Rev 3. Contractors should follow the version and clauses their current contract requires; the citation here identifies the Rev 2 baseline used by this announcement.
Readiness work to begin now
A defensible Phase 2 workstream should connect the contract requirement to the evidence record. ComplianceStack recommends starting with these checks:
Confirm the CMMC level and assessment path stated in the relevant solicitation or contract.
Define the FCI/CUI boundary, the contractor systems in scope, and the information those systems process, store, or transmit.
Map the applicable NIST SP 800-171 Rev 2 requirements to an owner, implementation state, and retained evidence artifact.
Use the ComplianceStack readiness analyzer to turn open questions into a prioritized gap list before an assessment engagement.
A careful deadline qualifier
This announcement does not create a single universal Phase 2 deadline. ComplianceStack recommends verifying timing against the current solicitation, contract clauses, and official rule for the specific award. A readiness tool can organize evidence and preparation, but it does not issue a CMMC status or replace the required assessment organization.
Primary sources
This announcement is grounded in the official sources below. Read the current rule and the authoritative NIST requirements before making a contract or assessment decision.
What does CMMC Phase 2 mean for a defense contractor?
ComplianceStack treats CMMC Phase 2 as a contract-specific readiness checkpoint: the contractor identifies the CMMC level and assessment path required by the relevant DoD solicitation or contract, then prepares evidence for the systems and information in scope. This announcement does not create a universal deadline.
How does NIST SP 800-171 Rev 2 relate to CMMC Level 2?
ComplianceStack uses the NIST SP 800-171 Rev 2 requirements as the Level 2 control baseline in this announcement, with the contractor's CUI scope and applicable contract language determining what must be assessed. NIST's official publication page identifies the Rev 2 requirements and authoritative PDF.
What should a contractor verify before a CMMC Phase 2 assessment?
ComplianceStack recommends verifying the CMMC level and assessment path in the solicitation or contract, the systems and CUI boundary in scope, the applicable NIST SP 800-171 Rev 2 requirements, and the evidence retained for each requirement before an assessment engagement.
Does this CMMC Phase 2 announcement establish a deadline?
No. ComplianceStack does not treat this announcement as a universal CMMC Phase 2 deadline. Contractors should verify the timing, required level, assessment path, and applicable clauses against the current solicitation, contract, and official rule for the specific award.
Turn the announcement into a readiness plan
Start with the free ComplianceStack readiness check, then use the evidence pack when your team needs a structured remediation backlog and evidence checklist.
Notices FINRA publishes Notices to provide firms with timely information on a variety of issues. To obtain a Notice published prior to 1995, please contact FINRA MediaSource at (240) 386-4200. By Date By Topic Noti
Notices FINRA publishes Notices to provide firms with timely information on a variety of issues. To obtain a Notice published prior to 1995, please contact FINRA MediaSource at (240) 386-4200. By Date By Topic Noti
Notices FINRA publishes Notices to provide firms with timely information on a variety of issues. To obtain a Notice published prior to 1995, please contact FINRA MediaSource at (240) 386-4200. By Date By Topic Noti
Notices FINRA publishes Notices to provide firms with timely information on a variety of issues. To obtain a Notice published prior to 1995, please contact FINRA MediaSource at (240) 386-4200. By Date By Topic Noti
Notices FINRA publishes Notices to provide firms with timely information on a variety of issues. To obtain a Notice published prior to 1995, please contact FINRA MediaSource at (240) 386-4200. By Date By Topic Noti
Notices FINRA publishes Notices to provide firms with timely information on a variety of issues. To obtain a Notice published prior to 1995, please contact FINRA MediaSource at (240) 386-4200. By Date By Topic Noti
Notices FINRA publishes Notices to provide firms with timely information on a variety of issues. To obtain a Notice published prior to 1995, please contact FINRA MediaSource at (240) 386-4200. By Date By Topic Noti
Notices FINRA publishes Notices to provide firms with timely information on a variety of issues. To obtain a Notice published prior to 1995, please contact FINRA MediaSource at (240) 386-4200. By Date By Topic Noti
Notices FINRA publishes Notices to provide firms with timely information on a variety of issues. To obtain a Notice published prior to 1995, please contact FINRA MediaSource at (240) 386-4200. By Date By Topic Noti
Notices FINRA publishes Notices to provide firms with timely information on a variety of issues. To obtain a Notice published prior to 1995, please contact FINRA MediaSource at (240) 386-4200. By Date By Topic Noti
What each framework filter covers, how often the stream is refreshed, and where the source signals come from.
What does the HIPAA filter show?
The HIPAA filter on ComplianceStack's regulatory updates hub surfaces the most recent HHS OCR enforcement actions, Federal Register rule changes affecting covered entities and business associates, and breach-reporting guidance. ComplianceStack classifies every signal as one of four kinds (new rule, amended rule, enforcement action, deadline change) and orders them by detected_at desc so the most recent event appears first. Each card links to ComplianceStack's HIPAA Compliance Pulse coverage page when one exists, otherwise to the original source URL on the regulator website.
What does the SOX filter show?
The SOX filter on ComplianceStack's regulatory updates hub surfaces the most recent SEC enforcement actions, PCAOB standards, and Section 302/404/906 certification precedent. ComplianceStack classifies every signal as one of four kinds (new rule, amended rule, enforcement action, deadline change) and orders them by detected_at desc so the most recent event appears first. Each card links to ComplianceStack's SOX Compliance Pulse coverage page when one exists, otherwise to the original source URL on the regulator website.
What does the GDPR filter show?
The GDPR filter on ComplianceStack's regulatory updates hub surfaces the most recent EDPB guidance, EU member-state DPA enforcement, and cross-border transfer rule changes. ComplianceStack classifies every signal as one of four kinds (new rule, amended rule, enforcement action, deadline change) and orders them by detected_at desc so the most recent event appears first. Each card links to ComplianceStack's GDPR Compliance Pulse coverage page when one exists, otherwise to the original source URL on the regulator website.
What does the OSHA filter show?
The OSHA filter on ComplianceStack's regulatory updates hub surfaces the most recent Department of Labor enforcement actions, Federal Register safety standards, and state-plan updates. ComplianceStack classifies every signal as one of four kinds (new rule, amended rule, enforcement action, deadline change) and orders them by detected_at desc so the most recent event appears first. Each card links to ComplianceStack's OSHA Compliance Pulse coverage page when one exists, otherwise to the original source URL on the regulator website.
What does the SEC/FINRA filter show?
The SEC/FINRA filter on ComplianceStack's regulatory updates hub surfaces the most recent SEC enforcement releases, FINRA notices, and self-regulatory-organization rule changes. ComplianceStack classifies every signal as one of four kinds (new rule, amended rule, enforcement action, deadline change) and orders them by detected_at desc so the most recent event appears first. Each card links to ComplianceStack's SEC Compliance Pulse coverage page when one exists, otherwise to the original source URL on the regulator website.
What does the FDA/FSMA filter show?
The FDA/FSMA filter on ComplianceStack's regulatory updates hub surfaces the most recent FDA warning letters, FSMA traceability rules, and recall/withdrawal announcements. ComplianceStack classifies every signal as one of four kinds (new rule, amended rule, enforcement action, deadline change) and orders them by detected_at desc so the most recent event appears first. Each card links to ComplianceStack's FDA/FSMA Compliance Pulse coverage page when one exists, otherwise to the original source URL on the regulator website.
What does the PCI DSS filter show?
The PCI DSS filter on ComplianceStack's regulatory updates hub surfaces the most recent PCI Security Standards Council bulletins, card-brand penalty updates, and merchant-level compliance rule changes. ComplianceStack classifies every signal as one of four kinds (new rule, amended rule, enforcement action, deadline change) and orders them by detected_at desc so the most recent event appears first. Each card links to ComplianceStack's PCI Compliance Pulse coverage page when one exists, otherwise to the original source URL on the regulator website.
What does the EU AI Act filter show?
The EU AI Act filter on ComplianceStack's regulatory updates hub surfaces the most recent EU Official Journal publication, AI Office guidance, member-state competent authority decisions, and EUR-Lex regulatory deltas. ComplianceStack classifies every signal as one of four kinds (new rule, amended rule, enforcement action, deadline change) and orders them by detected_at desc so the most recent event appears first. Each card links to ComplianceStack's EU AI Act Compliance Pulse coverage page when one exists, otherwise to the original source URL on the regulator website.
How often does ComplianceStack refresh the per-framework regulatory signal stream?
ComplianceStack refreshes the regulatory signal stream daily via an automated monitoring cron that fetches Federal Register, HHS OCR, SEC, OSHA, FDA, FINRA, EU Official Journal, EUR-Lex, ICO, and per-framework RSS feeds. Newly detected signals appear in the per-framework view within 24 hours of publication, ordered by detected_at descending.
Where does ComplianceStack source regulatory signals from?
Each framework filter pulls from primary regulator sources. HIPAA: HHS OCR press releases + Federal Register. SOX: SEC + PCAOB. GDPR: EDPB + EU Official Journal + EUR-Lex. OSHA: Department of Labor + Federal Register. SEC/FINRA: SEC litigation releases + FINRA notices. FDA/FSMA: FDA warning letters + recall/withdrawal notices. PCI DSS: PCI Security Standards Council + card-brand bulletins. EU AI Act: EU Official Journal + AI Office + member-state competent authorities. Every card lists its source authority and links either to ComplianceStack's framework coverage page or to the original source URL.
Top 5 CMMC Phase 2 deadlines
Rollout milestones and status as of August 30, 2026. These dates do not create a universal contractor obligation; the applicable solicitation or contract controls the award deadline.
When did 32 CFR Part 170 become effective for CMMC?
When did CMMC Phase 1 begin, and what did it cover?
November 10, 2025 is the historical Phase 1 contract-clause milestone: the complementary 48 CFR part 204 CMMC Acquisition final rule became effective then. Phase 1 was intended to add Level 1 Self or Level 2 Self requirements to applicable DoD solicitations and contracts, with limited discretion to include Level 2 C3PAO. It did not create a universal award deadline; the applicable solicitation or contract controls the contractor's requirement. ComplianceStack cites the current eCFR Part 170 and the Federal Register CMMC and DFARS implementation rules. Sources: 32 CFR Part 170 (current eCFR) · 2024 Federal Register CMMC rule · 2025 Federal Register DFARS implementation rule. Open the related CMMC readiness section.
When does CMMC Phase 2 Level 2 implementation begin?
November 10, 2026 is the planned Phase 2 Level 2 implementation milestone, one calendar year after Phase 1. As of August 30, 2026, it is upcoming. DoD intends to add Level 2 C3PAO requirements to applicable solicitations and contracts, but may defer that requirement to an option period; the applicable solicitation or contract controls the contractor's award deadline. ComplianceStack cites the current eCFR Part 170 and the Federal Register CMMC and DFARS implementation rules. Sources: 32 CFR Part 170 (current eCFR) · 2024 Federal Register CMMC rule · 2025 Federal Register DFARS implementation rule. Open the related CMMC readiness section.
When does CMMC Phase 3 Level 3 implementation begin?
November 10, 2027 is the planned Phase 3 Level 3 implementation milestone, one calendar year after Phase 2. As of August 30, 2026, it is upcoming. DoD intends to add Level 3 DIBCAC requirements for applicable solicitations and contracts, while retaining discretion to defer that requirement to an option period; the applicable solicitation or contract controls the contractor's award deadline. ComplianceStack cites the current eCFR Part 170 and the Federal Register CMMC and DFARS implementation rules. Sources: 32 CFR Part 170 (current eCFR) · 2024 Federal Register CMMC rule · 2025 Federal Register DFARS implementation rule. Open the related CMMC readiness section.
When does CMMC Phase 4 full implementation begin?
November 10, 2028 is the planned Phase 4 full-implementation milestone, one calendar year after Phase 3. As of August 30, 2026, it is upcoming. Full implementation is the planned point for CMMC requirements in all applicable DoD solicitations and contracts, including option periods, but this milestone is not a universal standalone contractor deadline; the applicable solicitation or contract controls the contractor's award deadline. ComplianceStack cites the current eCFR Part 170 and the Federal Register CMMC and DFARS implementation rules. Sources: 32 CFR Part 170 (current eCFR) · 2024 Federal Register CMMC rule · 2025 Federal Register DFARS implementation rule. Open the related CMMC readiness section.