The CMMC Rollout Timeline
CMMC is rolling out in four phases from 2024 through 2028. Phase 2 (Level 2 C3PAO assessments) was suspended on July 13, 2026, pending a Department of War review — the underlying DFARS and NIST 800-171 obligations were not paused.
Update, July 13, 2026: The Department of War suspended CMMC Phase 2, pending review, so the third-party C3PAO certification gate described below is currently on hold and the November 10, 2026 date is no longer an active enforcement deadline. The DFARS 252.204-7012 and NIST SP 800-171 obligations underneath it were not repealed. See the July 2026 CMMC Intelligence Report for the current status and what still applies while the review is pending.
CMMC is not being turned on all at once. The DoD is phasing in requirements across all applicable contracts over a roughly four-year window. Understanding which phase applies to your contracts is critical for prioritizing your compliance investment and scheduling assessments at the right time.
| Phase | Date | What Changes |
|---|---|---|
| Phase 1 | Dec 16, 2024 | Level 1 self-assessments and conditional Level 2 self-assessments begin appearing in contracts |
| Phase 2 | June 11, 2025 (suspended July 13, 2026, pending review) | Level 2 C3PAO assessments begin appearing in new contracts involving CUI |
| Phase 3 | ~2026 (frozen pending Phase 2 review) | Level 3 (DCSA-led) assessments added to the highest-sensitivity contracts |
| Phase 4 | ~2028 (frozen pending Phase 2 review) | Full implementation — all applicable DoD contracts include appropriate CMMC level requirement |
November 10, 2026 — no longer an active enforcement date
What Phase 2 was and why it is now paused
As of June 11, 2025, the DoD began inserting DFARS 252.204-7021 into solicitations for contracts involving CUI, requiring CMMC Level 2 certification (or a conditional certification with an active POA&M) as a condition of award. On July 13, 2026, the Department of War suspended Phase 2 pending a CMMC Reform Task Force review, freezing the third-party C3PAO certification requirement along with Phases 3 and 4. Existing DFARS 7012 and NIST SP 800-171 obligations, and SPRS self-assessment reporting, remained in force throughout.
Lead times are still worth planning around
Even with Phase 2 suspended, C3PAO assessments were booking 4–6 months out before the pause, and the 12–18 months typically needed for gap remediation has not gotten shorter. Contractors who have not yet completed a gap assessment benefit from starting now, both to close SPRS-visible gaps today and to be ready whenever the Reform Task Force review concludes.
The CMMC Ready Now gap assessment is designed to give contractors a clear-eyed starting point — your current SPRS score, your priority gaps, and a realistic remediation roadmap with timeline estimates.
Ready to start your CMMC journey?
Book a free 30-minute call with Rick to get a straight answer on where you stand and what to do next.
More in Getting Started