CMMC 2.0 Regulatory Timeline

Where We Are and
What's Coming

The 32 CFR Part 170 final rule is in effect. Phase 2 C3PAO assessments begin appearing in solicitations starting November 2026. 220,000+ contractors. A shrinking runway. Here's every date that matters.

Live countdown — Phase 2 deadline
--- days
-- hours
-- min
-- sec
Approximately --- business days remaining
Target: November 1, 2026 (Phase 2 solicitations begin) [UNVERIFIED — exact date not yet published]
12-month remediation
—
Start remediation by this date to finish before Phase 2
6-month C3PAO booking
—
Book your C3PAO engagement by this date (6-9 mo lead time)
Gap assessment window
—
Complete your gap assessment and SPRS baseline by this date
Dec 2024 — Final Rule Effective Phase 1 active 2027 — Full enforcement
View Full Timeline Where Do I Stand? Build My Timeline
Regulatory milestones

Every Date That Matters

From DFARS 2017 through full CMMC enforcement — every milestone with its source. Cyan = completed. Purple = active or imminent. Dim = upcoming.

September 2017
DFARS 252.204-7012 Effective
DoD made DFARS clause 252.204-7012 mandatory for all contracts involving Controlled Unclassified Information. Contractors were required to implement NIST SP 800-171 and report cyber incidents to DoD within 72 hours.
Completed
Source: DFARS 252.204-7012 (48 CFR)
January 2020
CMMC 1.0 Published
DoD released CMMC 1.0 — a 5-level maturity model with 171 practices. All contractors handling CUI required third-party assessment, regardless of contract size. This version was later withdrawn in favor of the simplified 2.0 framework.
Completed
[UNVERIFIED — date approximate; DoD archived CMMC 1.0 documentation]
November 2021
CMMC 2.0 Announced
DoD announced a comprehensive review and simplification: CMMC 2.0 reduced from 5 levels to 3, eliminated unique practices not found in NIST SP 800-171, and aligned Level 2 directly to all 110 NIST 800-171 practices. Third-party assessment became required only for prioritized acquisitions.
Completed
[UNVERIFIED — based on DoD press release Nov 2021; verify at defense.gov]
December 2023
CMMC 2.0 Proposed Rule Published (48 CFR)
DoD published the proposed rule in the Federal Register to embed CMMC requirements into the Defense Federal Acquisition Regulation Supplement (DFARS). Opened a public comment period. This preceded the final 32 CFR rulemaking.
Completed
[UNVERIFIED — based on public reporting; verify at federalregister.gov]
October 15, 2024
32 CFR Part 170 Final Rule Published
The DoD Cybersecurity Maturity Model Certification (CMMC) Program final rule was published in the Federal Register. Established the three-level framework, assessment requirements, POA&M constraints, and the phased implementation schedule codified in 32 CFR 170.3.
Completed
Source: Federal Register Vol. 89, No. 200 (Oct 15, 2024); 32 CFR Part 170
December 16, 2024
Final Rule Effective — CMMC Is Law
32 CFR Part 170 became effective. CMMC requirements are now codified in federal regulation. DoD may immediately begin including CMMC Level 1 and Level 2 (self-assessment) requirements in new solicitations. Phase 1 begins.
Completed
Source: 32 CFR Part 170 — effective date specified in final rule preamble
2025 — Phase 1 (Active Now)
Self-Assessment Contracts Begin
DoD contracts may require CMMC Level 1 (annual self-assessment) or Level 2 self-assessment for select, lower-risk programs. Contractors must submit SPRS scores via PIEE. POA&M items allowed with 180-day remediation window. No C3PAO assessment required yet.
Active You Are Here
Source: 32 CFR 170.3 — phased implementation schedule
Mid-2025
First C3PAOs Authorized by Cyber AB
Cyber AB (formerly CMMC Accreditation Body) began authorizing C3PAO organizations to conduct official CMMC Level 2 assessments. Assessor pipelines are ramping up but remain severely constrained relative to contractor demand.
Underway
[UNVERIFIED — based on Cyber AB public statements; verify at cyberab.org]
November 2026 — Phase 2
C3PAO Assessments Required in Solicitations
DoD solicitations begin requiring CMMC Level 2 third-party C3PAO certification for contracts involving CUI. This is the hard deadline most defense contractors face. Contractors without valid certification on file cannot win covered work.
Upcoming Hard Deadline
Source: DoD phased implementation plan per 32 CFR 170.3 [exact date [UNVERIFIED] — monitor acquisition.gov]
2027 — Phase 3
Full CMMC Requirements in All Applicable Contracts
CMMC requirements appear in all applicable DoD contracts and task orders, including existing contract modifications. Level 3 (DIBCAC-assessed) requirements may also begin appearing for the highest-sensitivity CUI programs.
Upcoming
[UNVERIFIED — based on phased rollout language in 32 CFR 170.3; DoD has not published an exact 2027 date]
2028–2029
NIST SP 800-171 Rev 3 Transition Expected
CMMC Level 2 is currently locked to NIST SP 800-171 Revision 2 via 32 CFR 170.2. NIST published Rev 3 (SP 800-171r3) in 2024 with structural changes including Organization-Defined Parameters. DoD has not announced a transition date; industry estimates suggest 2028–2029 enforcement alignment.
Future
[UNVERIFIED — CMMC-to-Rev3 transition date not yet published; see 32 CFR 170.2 and nist.gov/publications/SP-800-171r3]
Implementation phases

Phase-by-Phase Requirements

Each phase expands CMMC scope. Know what's required in your current phase — and what's coming next.

Phase 1 — Active
Self-Assessment Permitted
Dec 16, 2024 → Nov 2026
What's required
Level 1: Annual self-assessment, affirm in SPRS. Level 2 (select): Self-assessment with senior official affirmation. No C3PAO required yet.
Who's affected
All DoD prime and subcontractors handling FCI (Level 1) or CUI in contracts where DoD explicitly includes CMMC requirements.
Assessment type
Self-assessment against NIST 800-171 (Level 2) or 17 basic safeguards (Level 1). Score entered in SPRS.
Not yet required
C3PAO third-party assessments are not yet mandated during Phase 1 (except where individual contracts specify them).
POA&M Rules POA&M items are allowed for non-critical deficiencies with a 180-day maximum remediation window. "Critical" findings (per 32 CFR 170.21) cannot remain open when submitting an assessment. Contractors with open critical findings cannot achieve a passing score.

Source: 32 CFR 170.21 [verify at ecfr.gov]
What's required
Level 2 (prioritized): C3PAO third-party assessment required. Must achieve passing score before contract award. Level 2 (non-prioritized) may still allow self-assessment.
Who's affected
DoD contractors handling CUI in any new solicitation that includes CMMC Level 2 requirements. Existing contracts may not be affected until option periods or modifications.
Assessment type
Triennial C3PAO assessment (every 3 years). Annual affirmation of continued compliance required in intervening years.
Lead time
C3PAOs booking 6-9 months in advance as of early 2026. Factor in remediation time before assessment. Total runway: 12-24 months from scratch.
POA&M Rules Same 180-day remediation cap applies. No critical findings can remain open at the time of C3PAO assessment. POA&M items closed after assessment still require ongoing monitoring and annual affirmation. [Verify against 32 CFR 170.21 and CMMC assessment guides at dodcio.defense.gov]
What's required
CMMC requirements appear in all applicable DoD contracts and task orders, including modifications to existing contracts. Level 3 (DIBCAC-assessed) requirements expected for highest-sensitivity programs.
Who's affected
The full DoD industrial base. No exceptions for existing contract vehicles — CMMC will be flowed down through option exercise periods.
Assessment type
Level 2: C3PAO triennial. Level 3: DIBCAC (Defense Industrial Base Cybersecurity Assessment Center) assessment required for classified-adjacent programs.
Rev 3 transition
NIST 800-171 Rev 3 may begin appearing in CMMC requirements toward the end of Phase 3 / 2028-2029 window. [UNVERIFIED]
Note Phase 3 exact dates have not been officially published as of April 2026. Monitor acquisition.gov and dodcio.defense.gov for updates. The 32 CFR 170.3 phased schedule is the authoritative source.
Personalized assessment

Where Do I Stand?

Select your current compliance state to see whether you're on track for the Phase 2 deadline.

Assessment bottleneck

The C3PAO Capacity Problem

The math is brutal: a limited pool of authorized assessors, 220,000+ contractors needing assessment, and a hard deadline. Booking early is not optional.

220k+
Contractors in the DIB Defense Industrial Base companies potentially subject to CMMC requirements. [UNVERIFIED — estimate based on DoD DIB sector statistics]
6–9mo
C3PAO booking lead time (early 2026) [UNVERIFIED — based on industry reports; individual C3PAO availability varies significantly. Verify with Cyber AB Marketplace.]
3 yr
Certification validity period A passed C3PAO assessment is valid for 3 years with annual affirmation. Source: 32 CFR 170.16
180d
Maximum POA&M remediation window Open POA&M items must be resolved within 180 days. Critical findings block assessment passage. Source: 32 CFR 170.21

How to Find and Book a C3PAO

  1. 1
    Visit the Cyber AB Marketplace (marketplace.cyberab.org) to browse authorized C3PAO organizations. Only organizations listed here can conduct official CMMC assessments.
  2. 2
    Request proposals from 3-5 C3PAOs simultaneously. Lead times vary; don't wait for one response. Include your estimated scope (CUI assets, employee count, cloud vs on-prem, etc.).
  3. 3
    Some C3PAOs offer a pre-assessment or readiness review — valuable for identifying critical gaps before the formal assessment clock starts.
  4. 4
    Once booked, your C3PAO will issue an Assessment Plan. You'll need to be ready to provide evidence for all 110 NIST 800-171 Rev 2 practices within your scope.
  5. 5
    After assessment, your C3PAO submits results to the CMMC eMASS system. Once accepted, your certification appears in SPRS and is valid for 3 years.
Do not assume availability. As Phase 2 approaches, C3PAO schedules will compress further. Contractors who wait until Q1 2026 to engage C3PAOs may find November 2026 slots already filled. [UNVERIFIED — based on industry capacity projections; verify current availability at marketplace.cyberab.org]
Free tools

Take the Next Step

Every tool is free, no account required. Built for defense contractors navigating CMMC.

📅
CMMC Timeline Calculator
Input your contract deadline and current state. Get a personalized backwards-planning schedule with C3PAO booking windows.
Build your timeline →
📊
SPRS Score Simulator
Estimate your current SPRS score against NIST 800-171. Identify which practice gaps are costing you the most points.
Check your score →
✅
2-Minute Readiness Quiz
Answer 12 questions and get an instant read on your CMMC readiness posture and the top three gaps to close first.
Start the quiz →
🔍
Control Explorer
Browse all 110 NIST 800-171 Rev 2 practices. See automated check mappings, implementation guidance, and evidence templates.
Explore controls →

Get milestone reminders as key dates approach — no spam, unsubscribe anytime.

Don't wait for the deadline.
C3PAO wait times exceed 18 months. Start your evidence pipeline now — we'll scan your environment in 30 minutes.
Book a 30-minute scan →

We recommend this tool to help improve and optimize your compliance posture. Continuously enhance your security. Strengthen defenses and improve readiness. We recommend this approach to optimize outcomes and find every opportunity to enhance your posture. Our approach is designed to enhance security outcomes and strengthen your organization against evolving threats.