The CMMC Timeline, Decoded: What Each Phase Means for Small Contractors

CMMC stopped being a future problem on November 10, 2025. That’s when the 48 CFR acquisition rule (DFARS 252.204-7021 and friends) took effect and the four-phase rollout began appearing in new DoD solicitations. Here’s the schedule in plain English, and, more usefully, what a 10-to-200-person contractor should be doing in each phase.

The four phases

Phase 1: now (began November 10, 2025). New solicitations can require, as a condition of award:

• Level 1 self-assessment posted in SPRS (contracts with FCI only), or
• Level 2 self-assessment posted in SPRS (contracts with CUI),
• plus the annual affirmation by your Affirming Official.

DoD also has discretion to require Level 2 certification early in select Phase 1 solicitations: it’s the exception, not the rule, but it exists.

Phase 2: begins November 10, 2026. New applicable solicitations involving CUI start requiring Level 2 C3PAO certification (a third-party assessment, valid three years) instead of self-assessment. This is the phase that changes the economics: certification means external assessors, evidence packages, and a real queue.

Phase 3: begins November 10, 2027. Certification requirements extend to option periods on existing contracts (not just new awards), and Level 3 (DIBCAC-assessed) requirements begin for the most sensitive programs.

Phase 4: November 10, 2028. Full implementation: CMMC requirements in essentially all applicable DoD solicitations and contracts.

What the phases hide: the capacity math

There are tens of thousands of defense contractors that handle CUI, and only a few hundred authorized C3PAOs to certify them. Everyone who waits until a Phase 2 solicitation lands in their inbox joins the same queue at the same time. Assessment slots, and the consultants who prepare you for them, get booked out. This, not the rule text, is the real deadline pressure: the smart window for getting assessment-ready is now, while the line is short.

What to do, by situation

You handle FCI only (no CUI): Your obligation is already live. Implement the 17 practices, run the Level 1 self-assessment, post it in SPRS, affirm annually. There is no POA&M at Level 1: it’s done or it isn’t.

You handle CUI and bid regularly: Phase 1 already checks your SPRS score; Phase 2 will demand certification. The path: an honest SPRS self-assessment, then your SSP, then a POA&M, then closing gaps, then booking a C3PAO before the rush. If your score is deeply negative today, that’s normal and fixable, but it’s a 6-to-18-month remediation arc, which is exactly why starting in Phase 1 matters.

You’re a sub, and the prime is “handling it”: CMMC flows down. Primes are already surveying subs’ SPRS scores and will drop suppliers who can’t show progress, quietly, by simply not sending RFQs. Your SPRS record is your cyber résumé whether or not a contracting officer ever reads it.

Two traps in the transition years

1. The “we’ll wait for our first CMMC solicitation” trap. By the time the requirement is in a solicitation you want to bid, there’s no time left to remediate 40 controls and get assessed. The requirement is a condition of award, not a suggestion to start planning.
2. The false-affirmation trap. Affirmations are annual, personal (a named senior official), and enforceable: DOJ’s Civil Cyber-Fraud Initiative has already extracted multi-million-dollar False Claims Act settlements for misrepresented cybersecurity compliance. An honest low score with a worked POA&M is defensible. An optimistic affirmation is a liability with your executive’s name on it.

The one-page action list

1. Determine your level with the 60-second wizard.
2. Scope your boundary as small as honestly possible.
3. Self-assess (Level 1 or SPRS score): today, not after remediation.
4. Write/refresh the SSP; build the POA&M from your gap export.
5. Post to SPRS; calendar the affirmation.
6. Close gaps in weight order; keep evidence as you go.
7. If you need Level 2 certification: get C3PAO quotes this year.

Dates for Phases 2-4 describe the published implementation schedule for new solicitations; DoD retains discretion on specific solicitations. Verify against the current rule text when planning around a specific contract.