Imprimis is "Staffing Up":

48 CFR became final and was published in the Federal Register on September 10, 2025; and took effect on November 10, 2025. This rule mandates that all new defense contracts require contractors to demonstrate CMMC compliance, which will be a prerequisite for contract awards. The implementation will begin with Phase 1, focusing on lower-level requirements and self-assessments, with full compliance requirements expected to be phased in over the next few years.

On Sept. 10, the newly named Department of War made its position clear: cybersecurity is now a battlefield requirement.

Beginning November 10, 2025, these requirements will begin to be included in new defense contracts. For the Defense Industrial Base, this is no longer theoretical. The nation has declared war on cyber threats and the supply chain is the front line.

The Newly Named Department of War and Why it Matters 

The organization has been known as the Department of Defense since 1947, when Congress replaced the historic Department of War with a post–World War II structure. On Sept. 5, President Trump signed an executive order restoring “Department of War” as a secondary title. The Secretary of Defense has been directed to pursue legislative action to make the change permanent.

The symbolism is deliberate. By reintroducing the War title, the Administration is sending a blunt message and in cyberspace, America is not only defending but also going on the offensive. The timing of the renaming, followed immediately by the release of the 48 CFR rule, underscores that cybersecurity is now treated as a matter of national defense and compliance is the weapon of choice.

No matter your size or sector, we meet you where you are, and take you where you need to be.