US DoD supply-chain cybersecurity certification regime; Phase 1 live from 10 November 2025; Phase 2 (mandatory Level 2 C3PAO) from 10 November 2026; gates US federal contract eligibility.