The November 10 Double Deadline: CMMC Phase 2 and the BIS 50% Rule Land on the Same Day

Most compliance crunches don't arrive as a single dramatic event. They arrive as a calendar collision — two obligations coming due in the same window, landing on the same small team. For the U.S. defense industrial base, that collision now has a date: November 10, 2026.

On that day, the cybersecurity rulebook and the export-control rulebook move at the same time. The Cybersecurity Maturity Model Certification (CMMC) program enters Phase 2, and the Bureau of Industry and Security's (BIS) “Affiliates Rule” — the 50% rule for export controls — is scheduled to come back into force after a one-year suspension. They have nothing to do with each other on paper. They have everything to do with each other in practice, because they land on the same contractor, often the same person.

Deadline one: CMMC Phase 2 ends the self-attestation era

CMMC is how the Department of Defense verifies that contractors actually protect the government information they handle. The program is established under 32 CFR Part 170, and the contractual hook — the clause a contracting officer puts in a solicitation — is DFARS 252.204-7021. The acquisition rule that lets officers require a CMMC level took effect November 10, 2025, and the rollout is phased.

Phase 2 begins November 10, 2026. The change that matters: for most contracts involving Controlled Unclassified Information (CUI), a Level 2 assessment by an accredited third party — a Certified Third-Party Assessment Organization, or C3PAO — becomes a condition of award. The self-attestation many contractors have leaned on is no longer enough for that work.

Here is where this stops being an IT problem. CMMC Level 2 is built on NIST SP 800-171, and one of its control families is Physical Protection (PE): escort and monitor visitors, maintain physical access logs, and control who can reach the systems and areas where CUI lives. Assessors do not accept “we have a policy.” They ask for the evidence. A spiral notebook at the front desk is one of the quiet places an otherwise-ready program loses points.

Where SecurePoint fits: our visitor platform generates the time-stamped access logs, escort records, and audit trail that support the NIST 800-171 Physical Protection and Audit & Accountability control families. That is evidence for an assessor — it is not, and we never claim it to be, a CMMC certification.

Deadline two: the BIS 50% Rule makes ownership the new screen

The second clock is export controls. In September 2025, BIS published the Affiliates Rule (an interim final rule at 90 FR 47201). It extends the restrictions that apply to a listed party — on the Entity List, the Military End-User List, or certain Specially Designated Nationals — to any foreign entity that is 50% or more owned, directly or indirectly, individually or in aggregate, by those listed parties. The affiliate is restricted even though it is not, itself, named on any list.

When it does return, a clean name-against-the-list check stops being sufficient for an export transaction. You have to resolve ownership. BIS paired the rule with a know-your-customer red flag: if you have reason to know a foreign party has a listed owner, you have an affirmative duty to determine the ownership percentage — and if you can't, to seek a license. Because these affiliates are never individually listed, the Consolidated Screening List is expressly not an exhaustive answer.

None of this is conceptually new to anyone who screens for sanctions: OFAC's 50% rule has long blocked entities owned 50%+ by blocked persons. The BIS rule pulls export controls in the same direction — toward ownership resolution — which means one capability can serve both regimes.

Where SecurePoint fits: our screening flags potential 50%-rule ownership matches for human review and records the list version, the result, and the disposition. The determination — and the legal obligation — stays with you; the tool makes reasonable care provable.

Why one date plus one team is the actual risk

A large prime can absorb two simultaneous regulatory changes with two different departments. The mid-size and small contractors that make up most of the defense industrial base cannot. At those companies, the person chasing a C3PAO assessment slot is frequently the same person who owns vendor screening, visitor access, and the audit file. Two regulatory clocks, one understaffed function, one date.

Treated as two separate fire drills, this is a brutal fall. Treated as one posture — prove who gets access, prove who you do business with, and keep the evidence — it is a single program with two outputs. The contractors who come out ahead will be the ones who stopped seeing “physical security” and “export screening” as different problems months before November.

Two rules, side by side

What to do in the next five months