CMMC Phase 2 begins November 10, 2026. If your company handles Controlled Unclassified Information (CUI) for the Department of Defense, you need CMMC Level 2 certification before this date — or you lose contract eligibility. C3PAO assessment wait times are already 3–6 months. That means the real deadline to book your assessor is June 2026 or earlier. Here's exactly what defense contractors need to do now.
What Is CMMC Phase 2?
CMMC — the Cybersecurity Maturity Model Certification — is the DoD's mandatory framework for defense industrial base (DIB) cybersecurity. It replaces the honor-system self-attestation model with independently verified certification, enforced through DFARS contract clauses.
Phase 1 (CMMC Level 1) covers 17 basic cyber hygiene practices drawn from FAR 52.204-21. Companies can self-attest annually. Phase 1 is already in effect.
Phase 2 (CMMC Level 2) requires certification for the full 110 security requirements in NIST SP 800-171 Rev 2. These controls span 14 domains: access control, configuration management, incident response, audit and accountability, media protection, personnel security, physical protection, risk assessment, security assessment, system communications protection, system information integrity, awareness and training, identification and authentication, and maintenance.
Level 2 certification must be performed by an authorized C3PAO — a third-party assessor accredited by the Cyber Accreditation Body (Cyber AB). No self-attestation is allowed for Level 2. Certificates are valid for 3 years, after which reassessment is required.
The final CMMC rule was published in the Federal Register on December 26, 2023 (source: dodcio.defense.gov). Phase 2 requirements go live November 10, 2026 — exactly three years after the rule's effective date. VERIFIED
Who Is Affected?
CMMC Level 2 applies to any company in the Defense Industrial Base (DIB) that processes, stores, or transmits Controlled Unclassified Information (CUI) under a DoD contract. This includes prime contractors and their subcontractors — there are no small-business exemptions.
You are almost certainly in scope if your contract includes DFARS 252.204-7012 (Safeguarding Covered Defense Information) or DFARS 252.204-7021 (CMMC requirement). If unsure, search your contract for the word "CUI" or ask your contracting officer.
The 7 Things to Do Before November 10, 2026
In order of urgency. Steps 4–5 are time-critical — C3PAO availability is the longest pole in the tent.
-
Determine if CMMC Level 2 applies to youReview your contracts for DFARS 252.204-7012 and 252.204-7021 clauses. Audit whether you receive, process, store, or transmit CUI. If yes — you're in scope. Start your SPRS score if you haven't already. VERIFIED
-
Run a NIST SP 800-171 self-assessmentScore yourself against all 110 controls across 14 domains. Document your findings in a System Security Plan (SSP). Record gaps and remediation timelines in a Plan of Action & Milestones (POA&M). This baseline drives everything downstream. AI-GENERATED
-
Submit your SPRS scoreUpload your self-assessment score to the Supplier Performance Risk System at sprs.apps.mil. A current SPRS score is required before any new DoD contract award under DFARS 252.204-7019. Scores range from −203 (all controls failed) to +110 (full compliance). VERIFIED
-
Close your highest-priority gaps firstFocus on the controls that most commonly fail assessments: multi-factor authentication (3.5.3), CUI encryption at rest and in transit (3.13.8, 3.13.10), audit logging (3.3.x), incident response plan (3.6.x), and system access controls (3.1.x). Fix these before anything else. AI-GENERATED
-
⚠ Select and book a C3PAO — do this nowOnly Cyber AB-authorized C3PAOs can conduct CMMC Level 2 assessments. Assessment slots are booking 3–6 months out as of April 2026. Book by June 2026 at the latest to guarantee certification before November 10. Find authorized assessors at cyberab.org/marketplace. AI-GENERATED
-
Complete your formal C3PAO assessmentThe assessment involves reviewing your SSP, testing technical controls, interviewing staff, and validating evidence. A passing result gets you a CMMC Level 2 certificate valid for 3 years, entered by the C3PAO into eMASS (Enterprise Mission Assurance Support Service). AI-GENERATED
-
Flow down requirements to subcontractorsAs a prime, you are responsible for ensuring your subcontractors who touch CUI are also CMMC-compliant. Review teaming agreements, add CMMC flow-down clauses to subcontracts, and verify subs have current SPRS scores. Non-compliant subs are your risk. AI-GENERATED
6–18 Months Average. Book Your C3PAO by June 2026.
The CMMC Level 2 process isn't a weekend project. For most SMBs starting from a low NIST 800-171 baseline, the realistic timeline is 12–18 months from gap assessment to certified. Companies with mature IT and existing SPRS scores have cleared it in 6–9 months. Either way, time is already short.
The critical constraint is C3PAO availability — not remediation. Even if you complete all 110 controls tomorrow, you still need an assessor slot. With limited authorized assessors and 79,200 companies needing Level 2, expect a queue. AI-GENERATED
Last chance for Nov deadline
CMMC Level 2 Costs $75K–$150K for Most SMBs
Here's a realistic cost breakdown for a typical defense SMB (25–200 employees) with moderate IT complexity. Costs vary significantly based on your current posture, IT environment, and C3PAO selected. AI-GENERATED SEEK EXPERT ADVICE
| Cost Category | Estimated Range (SMB) | Notes |
|---|---|---|
| Gap assessment & consulting | $15,000 – $40,000 | Initial NIST 800-171 assessment + SSP/POA&M development |
| Technical remediation | $20,000 – $80,000 | MFA, encryption, logging, access controls. Highly variable by starting posture. |
| C3PAO assessment fee | $20,000 – $50,000 | Formal third-party assessment by Cyber AB-authorized C3PAO |
| GRC tooling (annual) | $5,000 – $15,000 | Compliance management platform (or DefenseBizStack from $99/mo) |
| Employee training | $2,000 – $8,000 | CMMC awareness training across affected staff |
| Total (typical SMB) | $75,000 – $150,000+ | Larger or more complex orgs: $200K–$500K+ |
Free CMMC Readiness Check
Answer 8 questions. Get your gap score across all 14 NIST 800-171 domains — with prioritized remediation steps. No credit card. No sales call.