Last updated August 7, 2026
Here is your definitive CMMC timeline — highlighting the major rule-making, contract clause dates and rollout phases that contractors must track for the Cybersecurity Maturity Model Certification (CMMC) program.
On October 15th 2024, the DoW established a final ruling that began to put CMMC requirements into contracts and renewals as early as the first quarter of 2025. This is an important step towards tightening cybersecurity standards for contractors working with the DoW (Department of War). The program introduces a streamlined model with three levels of CMMC compliance, each with different requirements based on the sensitivity of information in question.
Read the full release from the DoW with everything you need to know. (link opens new website)
Read about the phased implementation of CMMC requirements from the DoW. (link opens new website)
CMMC Model 2.0 Requirements
See when certification requirements become mandatory for federal contract eligibility between 2025 and 2028
DATE
CMMC Status
What this means for you
October 2024
The CMMC Final Rule was published to the Federal Register.
CMMC will validate compliance through independent assessments conducted by C3PAOs.
Early 2025
Third-party assessments for CMMC Level 2 began
Mid 2025
CMMC language began appearing in contracts with the introduction of Title 48 into DFARS.
CMMC compliance and a valid assessment became a requirement on some DoW contracts.
September 2025
The DoW published the CMMC Acquisition Rule (48 CFR) in the Federal Register.
November 10, 2025
On November 10, 2025, the Department of War’s (DoW) final rule for the Cybersecurity Maturity Model Certification (CMMC) program officially went into effect. The 3-year phased rollout of CMMC requirements into new defense contracts and solicitations began.
Enforcement of CMMC requirements for contractors handling FCI (Federal Contract Information which is information-related to the protection of critical infrastructure (CI)) and CUI (Controlled Unclassified Information) began in new DoW solicitations.
As of November 10, 2025, new DoW solicitations began including CMMC requirements that will phase in over the next few years.
Phase 1: November 10, 2025 – Level 1 & 2 self-assessments
- Level 1 self-assessments were required for contracts involving Federal Contract Information (FCI).
- Level 2 self-assessments were required for contracts involving less sensitive Controlled Unclassified Information (CUI).
- Level 2 third-party certification assessments started being inserted into select contracts involving sensitive CUI.
The DoW has the discretion to require a C3PAO (third-party certification assessment) for certain Level 2 contracts even during this phase. Let our talented team of RP’s help get your organization to reach Level 1 with our CMMC LevelUp process!
TBD
CMMC Phase 2 Implementation –Solicitations will require Level 2 Certification. Note, the DoW is reviewing the Level 2 certification requirement in a contract to option period.
Phase 2: Deadline TBD – Level 2 third-party certifications (C3PAO) requirement for new contracts.
TBD
CMMC Phase 3 Implementation – Applicable solicitations will require Level 3 Certification. The DoW is reviewing the Level 3 certification requirement in a contract to option period.
Phase 3: Deadline TBD – Level 3 third-party certifications.
TBD
CMMC Phase 4 Implementation – All solicitations and contracts will include applicable CMMC Level requirement as a condition of contract awards.
Phase 4: Deadline TBD – Level 4 – all new and renewing contracts will have certification requirements.
**Companies will need their assessment completed by award time, which should be Q1 of 2026.
CMMC Implementation Phases 2025-28
CMMC Timeline FAQs for Defense Contractors and Subcontractors
It began in 2024
It takes an average of 6 months.
Check our CMMC LevelUp process for details.
Most contractors will need to complete Level 1 or Level 2 requirements by 2026.
What These CMMC Deadlines Mean for Your Ability to Win DoW Contracts
If your organization handles Controlled Unclassified Information (CUI), the CMMC timeline means you’ll need to complete a Level 2 self-assessment before the November 2025 phase begins. Level 3 requirements may follow for prime contractors by 2028.
In summary:
The CMMC timeline begins in late 2024 with rulemaking.
Most contractors must complete Level 1 assessments by 2026.
By 2028, all DoW contracts may be expected to include CMMC requirements.
Preparing early reduces risk and ensures eligibility for future defense work.
Prepare for Your CMMC Assessment Before Contract Requirements Begin
As a Registered Provider Organization (RPO), our team at CTI has CMMC certified professionals to help support all your CMMC assessment needs. We have over 20 years of combined experience supporting DoW programs in information technology, information assurance, and cybersecurity. Contact us today to discuss more about your unique situation and how we can help!
Find Out Which CMMC Level Your Contracts Require
CMMC 2.0 Resources for Defense Contractors Facing 2026–2028 Deadlines
Complete Guide to CMMC 2.0 Certification
CMMC 2.0 certification ensures that organizations meet the DoD’s strict cybersecurity requirements, and the introduction of three CMMC 2.0 levels makes it easier for contractors to understand and meet these needs.
Choosing the Right Partner for CMMC 2.0: What is an RPO?
