CMMC reference

CMMC implementation timeline.

Use this timeline to understand the CMMC rollout phases, the November 10, 2025 DFARS start date, and practical readiness windows for defense contractors.

Official timeline

CMMC rollout phases.

The Department of Defense established a phased CMMC rollout. The 32 CFR CMMC Program rule took effect December 16, 2024, and the revised DFARS clause took effect November 10, 2025.

01
Final Rule (32 CFR)
December 16, 2024

CMMC Program rule became effective

02
DFARS Rule (48 CFR)
November 10, 2025

Revised DFARS clause 252.204-7021 became effective

03
Phase 1: Self-Assessments
November 10, 2025 - November 9, 2026

Level 1 and Level 2 self-assessments are the primary focus

04
Phase 2: C3PAO Assessments
November 10, 2026 - November 9, 2027

Level 2 third-party assessments begin for applicable contracts

05
Phase 3: DIBCAC Assessments
November 10, 2027 - November 9, 2028

Level 3 government assessments begin for applicable contracts

06
Phase 4: Full Applicability
November 10, 2028

CMMC requirements appear in applicable DoD solicitations and contracts covered by the DFARS rule

Official sources

Contract timing

Implementation timeline by contract type.

  • Phase 1 contracts: focus mainly on Level 1 and Level 2 self-assessment requirements
  • Phase 2 contracts: begin adding Level 2 third-party assessment requirements
  • Phase 3 contracts: begin adding Level 3 government assessment requirements
  • Phase 4 contracts: include CMMC requirements wherever the DFARS rule applies
  • Option years: may add CMMC requirements at renewal

Preparation

Typical Level 2 implementation path.

Based on our experience, many defense contractors should plan for a 12-18 month Level 2 implementation window.

  1. Months 1-3

    Gap assessment and planning

  2. Months 4-9

    Technical implementation and remediation

  3. Months 10-12

    Documentation and validation

  4. Months 13-15

    Assessment preparation

  5. Months 16-18

    C3PAO assessment and certification

Planning

Critical planning considerations.

  • Start early: implementation commonly takes 12-18+ months for many organizations
  • Budget planning: include CMMC costs in FY planning cycles
  • Resource allocation: dedicate team members to CMMC efforts
  • C3PAO scheduling: book assessments early because capacity may be limited
  • Continuous maintenance: plan for ongoing compliance after certification

Level timelines

Level-specific planning windows.

Level 1 Timeline (1-3 months)

  • Week 1-2: Gap assessment
  • Week 3-6: Remediation
  • Week 7-8: Documentation
  • Week 9-12: Self-assessment and SPRS submission

Level 2 Timeline (12-18 months)

  • Month 1-3: Full gap assessment
  • Month 4-9: Control implementation
  • Month 10-12: SSP and POAM development
  • Month 13-15: Pre-assessment preparation
  • Month 16-18: C3PAO assessment

Level 3 Timeline (18-24 months)

  • Month 1-3: Advanced gap assessment
  • Month 4-12: Enhanced control implementation
  • Month 13-15: Assessment documentation
  • Month 16-18: DIBCAC coordination
  • Month 19-24: Government assessment

Next step

Start before the contract date does the planning for you.

Pilotcore can help map your target level, current gaps, evidence plan, and assessment path before a solicitation turns the timeline into a rush.