Pentagon Publishes Final CMMC Acquisition Rule, Effective On November 10

By Brian Kolbay Newsletter Archives September 16, 2025

TAKE NOTE (Insights and Emerging Technology)

The Department of Defense today formally published the long-awaited Cybersecurity Maturity Model Certification (CMMC) Acquisition Rule in the Federal Register, marking the final regulatory step in bringing the program into force. The rule, codified under Title 48 of the Code of Federal Regulations, establishes how and when CMMC requirements will appear in solicitations and contracts. With today’s publication, the rule takes effect after a 60-day period, setting November 10, 2025, as the official start date for implementation.

Beginning on that date, defense contractors will see CMMC language included in new requests for proposals (RFPs) and contracts. Phase One of the rollout will require companies to complete either a self-assessment at Level 1 or Level 2, depending on whether they handle Federal Contract Information or Controlled Unclassified Information. In some cases, the Department may mandate a third-party assessment from a Certified Third-Party Assessment Organization (C3PAO) before award, making cybersecurity compliance a hard gate for bidders rather than an advisory measure.

The impact is significant for the defense industrial base, particularly small and mid-sized businesses that have been preparing for CMMC but were awaiting final confirmation of timelines. Contractors who fail to meet assessment and certification requirements will be ineligible for award, placing urgency on companies to align with NIST SP 800-171 controls and schedule assessments. The November 10 effective date represents the start of a multi-year, phased rollout, culminating in full enforcement across all applicable DoD contracts by 2028.

Read more at Federal Register link below

UNDER DEVELOPMENT (Insights for Developers)

S/4 BTP Cloud-based Enhancements using Side-by-Side Extensibility Part 1

Intro

The SAP Business Technology Platform (BTP) is the foundation of SAP’s cloud strategy, bringing together data management, analytics, AI, application development, and integration into one unified environment. It gives organizations the flexibility to extend their core ERP systems, modernize legacy applications, and innovate faster with a cloud-first approach.

In the previous post Demystifying the BTP (SAP Business Technology Platform) – Part 1, we explained what the BTP was and introduced some of the products it has to offer. During this month’s blog, we begin a 4 part series that introduces implementing an “enhancement” using the BTP and side-by-side extensibility. The series uses a practical example of generating tweets for sales events in SAP ERP to demonstrate key technologies and solutions.

Before we begin, I would like to take another shot at an analogy that might help conceptualize what the BTP actual is. This may be particularly helpful for those who are more familiar with SAP Enterprise Resource Planning solutions and aren’t quite sure what to make of the vastness of the BTP.

Those who have worked in the SAP space may be expecting something like the Enhancement Framework (i.e. a rigid set of steps that allows developers to enhance the SAP solution with code to meet a business requirement).

Let me be clear that the BTP is CERTAINLY not that, or anything even remotely similar. Instead, the BTP grants the ability to build business software solutions, in the broadest sense, while taking advantage of the cloud environment. The BTP allows you to deploy pre-built software solutions, stand up environments to run custom code, manage and monitor processes and system resources, and deploy services to be consumed. So, in a very loose way, the BTP can be considered as a type of cloud “operating system”.

BTP Service-Marketplace

Also like an operating system, you may pick and choose which programs and services you subscribe to, allowing you to build the exact solution you need with no wasteful overhead. Of course, BTP enabled software will be made to support development or a business requirement; don’t expect to find Solitaire or Minesweeper available to download. However, the tools available are diverse enough that it is entirely possible that two customers could be using two entirely different sets of services, even to accomplish the same overall business task!

BTP’s Hidden Complexity- Disjointed Services and Processes

However, unlike an OS running on a single machine, the BTP has one clear hurdle that explains the infrastructure of the platform, and consequentially the design of any enhancements implemented within it.

BTP Services/Processes are Disjointed. Both from the perspective the components of our solution being isolated from the SAP system, and from the perspective of the individual components being isolated from each other (even though they reside in the same BTP instance!)

This necessitates the need to connect components together deliberately and explicitly, vs on-prem solutions that can use system memory, function calls, the database, etc. to connect different SAP technologies.
Communication is facilitated often through RESTful HTTP calls, both for internal BTP programs and external ones (e.g. the ERP system). To enable these connections, this means each component requires and HTTP endpoint, and an additional service to manage HTTP requests.
Different Services/Processes require authentication to connect to each other. Integrating separate portions of an overall custom solution require an additional step of creating communication users, generating credentials, etc.

This technical challenge leads to some additional questions when replacing traditional on-premise ERP enhancements with a Cloud extensions…

Questions Raised by Cloud-Based ERP Extensions

1. If the BTP is completely separate from the SAP, how can we act on business events in a timely and reliable fashion?

2. Even if we receive synchronize notifications, the point of side-by-side extensibility is to enhance the OTB SAP solution. How can we do that if the data resides in SAP?

2. Custom solutions require custom logic. If my ABAP environment is on the ERP system itself, how can I possibly execute any logic without an SAP environment?

4. A business’ primary function is to interact with parties that are external to our software ecosystem. How can we communicate with partners if don’t have a dedicated PO/PI system?

Over the next few blogs, I hope to answer these four questions in detail, while building a simple solution that accomplishes this straightforward task:

“Every time a sale is made within our SAP ERP system, our BTP extension will generate a Tweet containing details about the sale”

While this is not the most realistic scenario, iterating through steps required to build this extension will detail how to build and integrate BTP technologies that would be useful in everyday scenarios.

So lets start the build….

Q&A (Post your questions and get the answers you need)

Q. How can SAP Build help me with side-by-side extensibility?

A. SAP Build makes it possible to extend your S/4HANA system without disrupting the ERP core. Instead of customizing inside the system, you create new apps, workflows, and automatons on SAP Business Technology Platform (BTP). This keeps the digital core “clean,” which means upgrades are faster, maintenance is simpler, and long-term costs are lower.

With SAP Build Apps, you can design and deploy new applications that consume S/4HANA data and services through APIs and events. SAP Build Process Automation allows you to add extra workflow steps, automate routine tasks, and connect S/4 processes with external data sources—all without modifying the underlying ERP logic. And with SAP Build Work Zone, you can create user-friendly portals and dashboards that present S/4 information in new ways for employees, partners, or suppliers.

Key benefits include:

Preserve a clean core – extensions run on BTP, not inside S/4.
Faster innovation – business users can build solutions quickly with low-code/no-code tools.
Governance and security – IT retains oversight while enabling citizen developers.
Future-proofing – extensions remain stable even as the ERP core evolves.

In short, SAP Build is your toolkit for innovating “side-by-side.” It gives you the flexibility to meet new business needs, connect to external systems, and scale processes—all while keeping your S/4HANA system stable and upgrade-ready.

Cheers!