If you cannot find information about a compliance topic, please contact us for free support.
CMMC Implementation Timeline and Phased Rollout
CMMC is not appearing in all contracts simultaneously. The DoD is implementing requirements through a phased rollout, gradually expanding which contracts require certification. Understanding the timeline helps you plan compliance efforts appropriately—neither panicking unnecessarily nor waiting too long.
CMMC stands for Cybersecurity Maturity Model Certification—the DoD’s mandatory cybersecurity program for defense contractors.
This guide explains when CMMC requirements take effect and what each implementation phase means for defense contractors.
The Phased Implementation Approach
The DoD chose phased implementation for practical reasons:
Assessment Capacity
The C3PAO ecosystem needs time to scale. Requiring C3PAO assessment for all contractors immediately would create impossible bottlenecks.
C3PAO stands for Certified Third-Party Assessment Organization—companies authorized to conduct CMMC assessments.
Contractor Preparation
Many contractors need time to implement required controls. Phased rollout provides a compliance runway.
Process Refinement
Early implementation phases allow the DoD to refine processes based on real-world experience before full rollout.
Risk-Based Prioritization
Higher-risk programs receive CMMC requirements first, focusing initial effort where it matters most.
The Four Implementation Phases
Phase 1: Foundation (December 2024 – 2025)
The first phase establishes the CMMC foundation:
What’s Included:
- Level 1 self-assessment requirements
- Level 2 self-assessment requirements
- CMMC clauses may appear in new contracts
- Voluntary early adoption encouraged
What’s Not Included:
- Level 2 C3PAO assessment not yet required
- Level 3 not yet implemented
- Existing contracts are generally not modified
Contractor Impact:
- Contractors should complete self-assessments
- SPRS scores should be current and accurate
- Preparation for the C3PAO assessment should begin
SPRS stands for Supplier Performance Risk System, where contractors report compliance status.
Phase 2: Expansion (2025 – 2026)
Phase 2 expands CMMC requirements significantly:
What’s Included:
- Level 2 C3PAO assessment for prioritized acquisitions
- Broader inclusion of CMMC clauses in contracts
- Increased contract requirements for certification
What’s Not Included:
- Level 3 is still limited
- Not all contracts yet require CMMC
Contractor Impact:
- Contractors handling CUI should be assessment-ready
- C3PAO assessment may be required for new contracts
- Competition increasingly favors certified contractors
CUI stands for Controlled Unclassified Information—sensitive government data requiring protection.
Phase 3: Advancement (2026 – 2027)
Phase 3 brings Level 3 and broader Level 2:
What’s Included:
- Level 3 assessment implementation
- Level 2 C3PAO required for more contracts
- Continued expansion of CMMC clause inclusion
Contractor Impact:
- Most CUI contracts will require CMMC
- Level 3 contractors must prepare for government assessment
- Non-certified contractors face increasing barriers
Phase 4: Full Implementation (2027 – 2028)
Phase 4 completes the rollout:
What’s Included:
- All applicable contracts include CMMC requirements
- Full enforcement across the defense industrial base
- CMMC becomes standard for DoD contracting
Contractor Impact:
- CMMC certification becomes table stakes
- Non-certified contractors are effectively excluded
- Compliance is a business necessity, not optional
What “Phase” Means for Contracts
Phased implementation refers to when CMMC clauses appear in contracts, not when you must comply:
New Contracts
New contracts in each phase may include CMMC requirements. If your new contract includes DFARS 252.204-7021, you must comply with the specified level and assessment type.
DFARS stands for Defense Federal Acquisition Regulation Supplement—contract clauses for DoD acquisitions.
Contract Modifications
The DoD generally does not retroactively add CMMC to existing contracts, but:
- Option exercises may include new requirements
- Follow-on contracts will include requirements
- Some modifications may add CMMC clauses
Prime Contractor Flow-Down
Even if your direct contract does not include CMMC, prime contractors may flow down requirements to subcontractors. Primes often implement requirements before formal DoD mandates.
Timeline Factors You Cannot Control
Several factors affect your specific timeline:
Contract Timing
When you pursue new contracts determines when CMMC becomes your requirement. A contractor bidding on new work in 2025 faces different timing than one executing existing contracts through 2027.
Customer Requirements
Some DoD components and programs implement CMMC faster than the minimum timeline. If your customers are early adopters, your timeline accelerates.
Prime Contractor Decisions
Prime contractors may require CMMC certification from subcontractors before DoD mandates it. Your prime’s timeline becomes your timeline.
Competition
Even without contract requirements, competitors achieving certification may pressure you to certify to remain competitive.
Timeline Factors You Can Control
When You Start Preparation
Starting early provides flexibility. Starting late creates pressure and increases failure risk.
Resource Allocation
Dedicating sufficient resources accelerates compliance. Treating CMMC as a part-time afterthought extends timelines.
Assessment Scheduling
C3PAO availability varies. Scheduling early in implementation phases provides more options than waiting until deadlines approach.
Gap Closure Speed
How quickly you remediate identified gaps determines your certification timeline.
Planning Your Compliance Timeline
Work backward from your requirements:
Step 1: Identify Your Target Date
- When do you expect contracts requiring CMMC?
- When are you bidding on new work?
- What are your prime contractors requiring?
- Add buffer for unexpected delays
Step 2: Estimate Assessment Duration
- Level 1 self-assessment: 1-2 weeks
- Level 2 self-assessment: 2-4 weeks
- Level 2 C3PAO assessment: 4-8 weeks (plus scheduling lead time)
Step 3: Estimate Remediation Duration
Based on gap assessment results:
- Minor gaps: 1-3 months
- Moderate gaps: 3-6 months
- Significant gaps: 6-12 months
- Major gaps: 12-18 months
Step 4: Build Your Timeline
| Milestone | Target Date | Duration |
|---|---|---|
| Target certification | [Your date] | – |
| Complete assessment | [Date – assessment duration] | |
| Complete remediation | [Above – remediation time] | |
| Begin remediation | [Above – remediation time] | |
| Complete gap assessment | [Start + 2-4 weeks] | |
| Start CMMC preparation | [Today] |
Common Timeline Mistakes
Mistake 1: Waiting for Contract Requirements
Waiting until contracts require CMMC leaves insufficient preparation time. By then, you are competing for C3PAO availability with everyone else who waited.
Mistake 2: Underestimating Duration
Compliance typically takes 6-18 months, depending onthe starting position. Assuming you can achieve certification in 3 months usually leads to failure.
Mistake 3: Ignoring Prime Contractor Timelines
Primes often impose requirements before DoD mandates. Your prime’s timeline may be more aggressive than the official phased rollout.
Mistake 4: Assuming Self-Assessment Is Sufficient
If your contracts will require C3PAO assessment, self-assessment is a step toward readiness—not the finish line.
Mistake 5: Not Accounting for Remediation
Many contractors schedule assessments without completing remediation first. This leads to failed assessments and wasted fees.
The “Soft Enforcement” Period
Even before contracts formally require CMMC:
DFARS 252.204-7012 Still Applies
NIST SP 800-171 compliance has been required since 2017. CMMC formalizes verification, but the underlying requirements are not new.
SPRS Scores Are Visible
Contracting officers can see your SPRS score. Poor scores affect source selection even without formal CMMC requirements.
Prime Contractors Are Watching
Primes evaluate subcontractor security posture. Your compliance status affects teaming opportunities.
Competitive Advantage
Early certification demonstrates security commitment and differentiates you from non-certified competitors.
Key Dates Summary
| Date | Milestone |
|---|---|
| October 2024 | 32 CFR Part 170 (Program Rule) effective |
| December 2024 | Phase 1 begins; DFARS implementation rule effective |
| 2025 | Phase 2; Level 2 C3PAO in prioritized contracts |
| 2026 | Phase 3; Level 3; broader Level 2 C3PAO |
| 2027-2028 | Phase 4; Full implementation complete |
Specific dates may shift based on regulatory process and DoD decisions. Monitor official DoD announcements for current information.
Staying Current on Timeline Changes
CMMC implementation continues evolving. Stay informed:
Official Sources
- DoD CIO CMMC Website: dodcio.defense.gov/CMMC
- Federal Register: federalregister.gov
- Cyber AB: cyberab.org
Industry Resources
- Industry associations (NDIA, AIA, PSC)
- CMMC-focused publications and newsletters
- Professional consultants and advisors
Contract Monitoring
- Watch for CMMC clauses in new solicitations
- Monitor prime contractor communications
- Track industry trends in your sector
Key Takeaways
CMMC is implementing through four phases from 2024 through 2028, gradually expanding which contracts require certification. Phase 1 establishes self-assessment requirements; Phase 2 adds C3PAO assessment for prioritized acquisitions; Phase 3 implements Level 3 and expands Level 2; Phase 4 completes full rollout.
Your specific timeline depends on when you pursue contracts, customer requirements, prime contractor decisions, and competitive pressure. Do not wait for contract requirements to begin preparation—compliance takes 6-18 months for most contractors.
Plan backward from your target date, accounting for assessment scheduling, remediation duration, and gap assessment. Build a buffer for unexpected delays. The contractors who start early will be certified when opportunities arise; those who wait will be scrambling.
Free tools
Get to an honest number faster
You will run this more than once: after any material change to your environment, and again before every annual affirmation. Both are free, and both are yours to keep.
Neither is a certified assessment, and neither pretends to be.
Official sources
The audit is gone. The liability isn't.
Greypike runs the environment your CUI lives in and owns the compliance outcome that proves it's protected. If you are not certain your environment supports the score sitting in SPRS next to your CAGE code, that is the conversation to have.
Talk to Greypike about SPRS Attestation Assurance