.jpg?ext=.jpg)
When is My CMMC Assessment Supposed to Happen
As of November 2025, the rhetoric about CMMC has changed. The question, “Is CMMC really coming?” is now outdated. The final rules are effective, the phased rollout is officially in motion, and the "wait and see" window is now closed. If you are wondering exactly when your organization needs to face an assessor, the answer depends on two factors: the official Department of Defense (DoD) timeline and the increasingly aggressive demands of your prime contractors.
The Official CMMC Phased Rollout
The DoD is currently executing a four-phase rollout designed to transition the entire supply chain to the new standards by 2028. Here is where we stand today:
- Phase 1 (Began November 10, 2025): We are currently well into Phase 1. During this period, the DoD is including CMMC Level 1 or Level 2 self-assessment requirements in new solicitations. If you handle Federal Contract Information (FCI) or non-prioritized Controlled Unclassified Information (CUI), you must have your self-assessment and senior-level affirmation uploaded to the Supplier Performance Risk System (SPRS) to be eligible for award.
- Phase 2 (Starting November 10, 2026): On November 10, 2026, the DoD will begin to mandate third-party assessments (Level 2) for any contracts involving prioritized CUI. Organizations will no longer be able to self-assess. A CMMC Third-Party Assessor Organization (C3PAO) must verify compliance before a contract can be awarded.
- Phase 3 (Starting November 10, 2027): CMMC Level 2 third-party assessments become a requirement for exercising option periods on existing contracts. This is also when Level 3 (government-led) assessments begin for the most sensitive programs.
- Phase 4 (November 2028): Full implementation. CMMC requirements will be present in all DoD solicitations and contracts above the micro-purchase threshold.
Your Prime Can Alter the CMMC Timeline
The phased rollout is clear, but it is not written in stone for organizations in the DIB.
Primes are legally responsible for their entire supply chain's security. To mitigate their own risk, many primes have stopped waiting for the DoD’s phase-in dates. Primes have started to require subcontractors to provide proof of a CMMC Level 2 ready status or even a completed C3PAO assessment as soon as possible, regardless of whether the specific sub-contract technically falls under Phase 1.
Time to Put the CMMC Pedal to the Metal
If your prime contractor asks for your CMMC status today and you don’t have an SPRS score or a clear path to certification, they may (and often will) move your work to a competitor who does. To reduce this risk, make sure your organization expedites its compliance efforts. It is also beneficial to schedule your assessment date now so you can be assured of a C3PAO’s availability, even if you are not yet ready.
What questions do you have about the CMMC timeline? We are happy to help, so just reach out today.