The CMMC Rollout Timeline
CMMC is rolling out in four phases from 2024 through 2028. Phase 2 began in June 2025 — meaning Level 2 C3PAO assessments are now appearing in new DoD contracts involving CUI.
CMMC is not being turned on all at once. The DoD is phasing in requirements across all applicable contracts over a roughly four-year window. Understanding which phase applies to your contracts is critical for prioritizing your compliance investment and scheduling assessments at the right time.
| Phase | Date | What Changes |
|---|---|---|
| Phase 1 | Dec 16, 2024 | Level 1 self-assessments and conditional Level 2 self-assessments begin appearing in contracts |
| Phase 2 | June 11, 2025 | Level 2 C3PAO assessments begin appearing in new contracts involving CUI |
| Phase 3 | ~2026 | Level 3 (DCSA-led) assessments added to the highest-sensitivity contracts |
| Phase 4 | ~2028 | Full implementation — all applicable DoD contracts include appropriate CMMC level requirement |
November 10, 2026
What Phase 2 actually means for contractors
As of June 11, 2025, the DoD began inserting DFARS 252.204-7021 into solicitations for contracts involving CUI. This means that if you are competing for new DoD work that involves CUI, you now need to demonstrate CMMC Level 2 certification (or a conditional certification with an active POA&M) as a condition of award. Existing contracts are not retroactively required to comply, but they will include CMMC requirements at the next re-compete or option period.
Lead times are the problem
C3PAO assessments in 2026 are booking 4–6 months out. Adding the 12–18 months typically needed for gap remediation before an organization is assessment-ready, the effective deadline for “starting” your CMMC journey is well past. Contractors who have not yet completed a gap assessment need to begin immediately.
The CMMC Ready Now gap assessment is designed to give contractors a clear-eyed starting point — your current SPRS score, your priority gaps, and a realistic remediation roadmap with timeline estimates.
Ready to start your CMMC journey?
Book a free 30-minute call with Rick to get a straight answer on where you stand and what to do next.
More in Getting Started