CMMC reference

CMMC implementation timeline.

Use this timeline to understand the CMMC rollout phases, the November 10, 2025 DFARS start date, and practical readiness windows for defense contractors.

Current CMMC status

Phase II is suspended. Phase I self-assessments remain active.

On July 13, 2026, the Department suspended the Phase II requirements originally scheduled for November 10, 2026. The schedule below shows later dates for reference. They are not current implementation dates.

Status checked July 17, 2026.

Read the official CMMC status update

Official timeline

CMMC rollout phases.

The Department of Defense established a phased CMMC rollout. The 32 CFR CMMC Program rule took effect December 16, 2024, and the revised DFARS clause took effect November 10, 2025.

01
Final Rule (32 CFR)
December 16, 2024

CMMC Program rule became effective

02
DFARS Rule (48 CFR)
November 10, 2025

Revised DFARS clause 252.204-7021 became effective

03
Phase 1: Self-assessments
November 10, 2025 to present

Active. CMMC is paused in Phase I, and Level 1 and Level 2 self-assessment requirements remain in place.

04
Phase 2: C3PAO assessments (original schedule)
Originally scheduled for November 10, 2026 to November 9, 2027

Suspended on July 13, 2026. Under the original schedule, Level 2 C3PAO assessments would expand for applicable contracts if the Department restores or replaces this phase.

05
Phase 3: DIBCAC assessments (original schedule)
Originally scheduled for November 10, 2027 to November 9, 2028

Not currently in force while Phase II is suspended. Under the original schedule, Level 3 government assessments would apply to selected contracts.

06
Phase 4: Full applicability (original schedule)
Originally scheduled for November 10, 2028

Not currently in force while Phase II is suspended. Under the original schedule, CMMC requirements would apply to solicitations and contracts covered by the DFARS rule.

Official sources

Contract timing

Implementation timeline by contract type.

  • Current Phase I contracts: Level 1 and Level 2 self-assessment requirements remain active where the solicitation or contract requires them
  • Originally scheduled Phase 2: Level 2 C3PAO requirements remain suspended unless the Department restores or replaces that phase
  • Originally scheduled Phase 3: Level 3 government assessments are not currently in force while Phase II is suspended
  • Originally scheduled Phase 4: full applicability is not currently in force while Phase II is suspended
  • Option years: may add CMMC requirements at renewal

Preparation

Typical Level 2 implementation path.

Based on our experience, many defense contractors should plan for a 12-18 month Level 2 implementation window.

  1. Months 1-3

    Gap assessment and planning

  2. Months 4-9

    Technical implementation and remediation

  3. Months 10-12

    Documentation and validation

  4. Months 13-15

    Assessment preparation

  5. Months 16-18

    C3PAO assessment only if a future contract requires it after the Department changes the current status

Planning

Critical planning considerations.

  • Start early: implementation commonly takes 12-18+ months for many organizations
  • Budget planning: include CMMC costs in FY planning cycles
  • Resource allocation: dedicate team members to CMMC efforts
  • C3PAO scheduling: treat external assessment timing as contingency planning while Phase II is suspended
  • Continuous maintenance: plan for ongoing compliance after certification

Level timelines

Level-specific planning windows.

Level 1 Timeline (1-3 months)

  • Week 1-2: Gap assessment
  • Week 3-6: Remediation
  • Week 7-8: Documentation
  • Week 9-12: Self-assessment and SPRS submission

Level 2 Timeline (12-18 months)

  • Month 1-3: Full gap assessment
  • Month 4-9: Control implementation
  • Month 10-12: SSP and POAM development
  • Month 13-15: Pre-assessment preparation
  • Month 16-18: C3PAO assessment if a future contract requires it after the phase-in changes

Level 3 Timeline (18-24 months)

  • Month 1-3: Advanced gap assessment
  • Month 4-12: Enhanced control implementation
  • Month 13-15: Assessment documentation
  • Month 16-18: DIBCAC coordination
  • Month 19-24: Government assessment if the Department activates a Level 3 path

Next step

Start before the contract date does the planning for you.

Pilotcore can help map your target level, current gaps, evidence plan, and assessment path before a solicitation turns the timeline into a rush.

Want a read on where you stand against these dates? A CMMC readiness review maps your target level, gaps, and evidence plan to this timeline.