CMMC rollout timeline
CMMC compliance deadlines: the Phase 1–4 rollout
CMMC isn't one deadline — it's a four-phase rollout under 32 CFR 170.3(e) that started November 10, 2025. Phase 1 self-assessment is in effect; the later certification phases were suspended in July 2026 pending a Department of War review. Here's exactly where the rollout stands today.
The four phases
Each phase widens what DoD requires as a condition of award. Your actual deadline depends on when your specific contracts are solicited, re-competed, or have an option exercised — not a single calendar date for everyone. Phases marked Suspended are on hold pending the July 2026 review.
DoD includes CMMC Level 1 and Level 2 self-assessment requirements in most new solicitations and contracts as a condition of award.
- Level 1 (self) for FCI; Level 2 (self) for CUI where applicable
- A current SPRS score on file (DFARS 252.204-7019/7020)
- Annual affirmation by an Affirming Official
Was scheduled to begin requiring CMMC Level 2 certification assessments by a C3PAO (third party) as a condition of award for CUI contracts. Suspended July 13, 2026 pending the Department of War reform review — not a current deadline.
- Level 2 (C3PAO) certification for applicable CUI contracts
- Level 1 / Level 2 self-assessment continues elsewhere
Would have applied Level 2 (C3PAO) across a broader range of contracts and introduced Level 3 (DIBCAC) for high-priority programs. Suspended July 13, 2026 pending the reform review — not a current deadline.
- Level 2 (C3PAO) on most applicable CUI contracts
- Level 3 (DIBCAC) for designated high-priority programs
Would have made the applicable CMMC level a condition of award on all new DoD contracts (and exercised options), except commercial off-the-shelf (COTS) items. Suspended July 13, 2026 pending the reform review — not a current deadline.
- Applicable CMMC level on all in-scope contracts (COTS excepted)
Don't wait for the next phase to find out where you stand
Run the free self-assessment now and see your real SPRS score, CMMC status, and gaps — before your next solicitation asks for a number you don't have.
Frequently asked questions
Is CMMC Phase 2 still happening?
Not on the original schedule. On July 13, 2026, the Department of War announced the immediate suspension of CMMC Phase II — the Level 2 C3PAO certification requirement that was set to begin November 10, 2026 — along with pending and future implementation milestones, and opened a 60-day reform review. Phase 1 self-assessments remain in effect, the interim enforced standard is NIST SP 800-171 Rev 2, and DFARS 252.204-7012 still applies. Verify current status against dodcio.defense.gov/CMMC.
When does CMMC become mandatory for DoD contracts?
The CMMC contract clause (DFARS 252.204-7021) began phasing into new solicitations and contracts on November 10, 2025, with Phase 1 self-assessment requirements as a condition of award. The later phases that moved contracts to third-party (C3PAO) certification and full implementation were suspended on July 13, 2026 pending a Department of War review, so there is no firm certification-phase date right now — but the Phase 1 self-assessment and SPRS-score obligations still apply.
What's the difference between CMMC Phase 1 and Phase 2?
Phase 1 requires Level 1 (self) for FCI and Level 2 (self) for CUI, where applicable, as a condition of award — the same self-assessment and SPRS scoring this tool covers, and it remains in effect. Phase 2 would have added the requirement that applicable CUI contracts move to Level 2 (C3PAO) — a third-party certification assessment, not a self-assessment — but Phase 2 was suspended in July 2026 pending review, so it is not a current requirement.
Do I need a C3PAO assessment right now, or can I still self-assess?
Self-assessment (Level 1 or Level 2, as applicable) is the standard path today, and the Phase 2 that would have started phasing in C3PAO certification is suspended as of July 2026. A specific solicitation can still call out a required CMMC level, so check your contract's language rather than assuming — but there is no active government-wide certification deadline while the review is underway.
My current contract doesn't mention CMMC — am I exempt?
Not necessarily. The clause is added contract-by-contract as solicitations are issued, contracts are re-competed, or options are exercised — a contract that doesn't reference CMMC today can pick it up at the next award action. Check the specific solicitation language, ask your contracting officer, or talk to your local APEX Accelerator (formerly PTAC) advisor.
Can these phase-in dates change?
Yes — and they just did. The schedule is set by rulemaking (32 CFR Part 170) and DoD retains discretion on a per-solicitation basis; on July 13, 2026 the Department of War suspended CMMC Phase II and the later certification phases pending review. Verify current dates against eCFR or dodcio.defense.gov/CMMC before relying on them for a specific contract decision.
Related guides
Sources
- 32 CFR 170.3(e) — the CMMC Program rule's phase-in schedule (four phases at 12-month intervals from the rule's effective date).
- DFARS 252.204-7021 — the CMMC contract clause requiring the applicable CMMC level as a condition of award and annual affirmation of continuing compliance. See the DFARS Reference tool for the full clause text and effective dates.
Phase-in dates can change by rulemaking and DoD retains discretion on individual solicitations — verify current dates against eCFR or dodcio.defense.gov/CMMC before relying on them for a specific contract decision. SentryNexus is a preparation and self-assessment tool. It is not affiliated with the DoD, does not connect to SPRS, and does not submit anything to the government.