The November 10 Double Deadline: CMMC Phase 2 and the BIS 50% Rule Land on the Same Day

Most compliance crunches don't arrive as a single dramatic event. They arrive as a calendar collision: two obligations coming due in the same window, landing on the same small team. For the U.S. defense industrial base, that collision was scheduled for November 10, 2026. Half of it has already moved.

On that day, the cybersecurity rulebook and the export-control rulebook were scheduled to move at the same time. The Cybersecurity Maturity Model Certification (CMMC) program was to enter Phase 2, and the Bureau of Industry and Security's (BIS) “Affiliates Rule” (the 50% rule for export controls) is still scheduled to come back into force after a one-year suspension. Class Deviation 2026-O0025 suspended the CMMC Phase 2 C3PAO transition. They have nothing to do with each other on paper. They still land on the same contractor, often the same person.

Deadline one: CMMC Phase 2 is suspended

CMMC is how the Department of Defense verifies that contractors actually protect the government information they handle. The program is established under 32 CFR Part 170, and the contractual hook (the clause a contracting officer puts in a solicitation) is DFARS 252.204-7021. The acquisition rule that lets officers require a CMMC level took effect November 10, 2025, and the rollout is phased.

Phase 2 was to begin November 10, 2026. The change that would have mattered: for most contracts involving Controlled Unclassified Information (CUI), a Level 2 assessment by an accredited third party (a Certified Third-Party Assessment Organization, or C3PAO) would become a condition of award. Class Deviation 2026-O0025 suspended that transition. Self-assessment under DFARS 252.204-7012 remains in force. See our current coverage of the deviation.

Here is where this stops being an IT problem. CMMC Level 2 is built on NIST SP 800-171, and one of its control families is Physical Protection (PE): escort and monitor visitors, maintain physical access logs, and control who can reach the systems and areas where CUI lives. Assessors do not accept “we have a policy.” They ask for the evidence. A spiral notebook at the front desk is one of the quiet places an otherwise-ready program loses points.

Where SecurePoint fits: our visitor platform generates time-stamped access logs, escort records, and an audit trail that support NIST 800-171 Physical Protection evidence. That is evidence for an assessor. It is not a CMMC certification.

Deadline two: the BIS 50% Rule makes ownership the new screen

The second clock is export controls. In September 2025, BIS published the Affiliates Rule (an interim final rule at 90 FR 47201). It extends the restrictions that apply to a listed party (on the Entity List, the Military End-User List, or certain Specially Designated Nationals) to any foreign entity that is 50% or more owned, directly or indirectly, individually or in aggregate, by those listed parties. The affiliate is restricted even though it is not, itself, named on any list.

When it does return, a clean name-against-the-list check stops being sufficient for an export transaction. You have to resolve ownership. BIS paired the rule with a know-your-customer red flag: if you have reason to know a foreign party has a listed owner, you have an affirmative duty to determine the ownership percentage, and if you can't, to seek a license. Because these affiliates are never individually listed, the Consolidated Screening List is expressly not an exhaustive answer.

None of this is conceptually new to anyone who screens for sanctions: OFAC's 50% rule has long treated entities owned 50%+ by blocked persons as blocked. The BIS rule pulls export controls in the same direction, toward ownership analysis.

Where SecurePoint fits: screening records the list version, the result, and the disposition. OFAC 50% ownership results run in shadow mode by default and do not change the access decision. BIS affiliate hits are held for review. The legal determination stays with you.

Why one date plus one team is the actual risk

A large prime can absorb two simultaneous regulatory changes with two different departments. The mid-size and small contractors that make up most of the defense industrial base cannot. At those companies, the person chasing a C3PAO assessment slot is frequently the same person who owns vendor screening, visitor access, and the audit file. Two regulatory clocks, one understaffed function, one date.

Treated as two separate fire drills, this is a brutal fall. Treated as one posture (prove who gets access, prove who you do business with, and keep the evidence), it is a single program with two outputs. The contractors who come out ahead will be the ones who stopped seeing “physical security” and “export screening” as different problems months before November.

Two rules, side by side

What to do while Phase 2 is paused