The Defense Department is starting CMMC compliance only with a select number of large “prime” contractors this year. More and more contractors will be subject to CMMC over the next five years until all defense contracts require CMMC compliance in the fiscal year that starts on Oct. 1, 2025. The U.S. government has no plans right now to expand CMMC beyond the Defense Department — but “right now” is the crucial phrase here.