CMMC Phase 2 Deadline: What Contractors Must Do

The Defense Department's phased rollout of Cybersecurity Maturity Model Certification (CMMC) enters its second and far more consequential stage on November 10, 2026, when self-assessments stop being sufficient for a wide swath of Level 2 contracts and third-party certification becomes mandatory instead. Contractors who assumed a SPRS self-assessment satisfied CMMC are about to find that assumption expires in roughly two months, according to the phase structure set out in the DFARS acquisition rule that puts CMMC clauses into contracts.

Two separate federal rules control the timeline, and the gap between them is the source of most contractor confusion. The CMMC Program rule itself, 32 CFR Part 170, became effective December 16, 2024, and defines the three certification levels: Level 1 (self-assessment with annual affirmation), Level 2 (self-assessment or a C3PAO third-party certification assessment, depending on the information involved), and Level 3 (a government-led DIBCAC assessment). But that rule alone didn't put CMMC into any contract. The companion acquisition rule under DFARS Case 2019-D041 — the one that amends 48 CFR Parts 204, 212, 217, and 252 and actually inserts DFARS 252.204-7021 into solicitations — was published September 10, 2025, and became effective November 10, 2025. That later date started the phase clock.

Why Phase 2 Starts November 10, 2026, Not Some Other Date

The CMMC Program rule's preamble ties each phase to the start of the one before it, not to a fixed calendar date: "Phase 1 begins on the effective date of this CMMC 32 CFR part 170 CMMC Program rule or the complementary 48 CFR part 204 CMMC Acquisition rule, whichever occurs later." Because the DFARS acquisition rule's November 10, 2025 effective date came later than the CMMC Program rule's December 16, 2024 effective date, Phase 1 started on the later of the two. From there the math is mechanical: "Phase 2 begins one calendar year after the start date of Phase 1," which puts Phase 2 at November 10, 2026. Phase 3 follows a year after that, and Phase 4 — full implementation — a year after Phase 3.

Phase 2 is the phase that matters most for Level 2 contractors specifically, because it's when the government starts conditioning applicable contract awards on an actual C3PAO certification assessment rather than a self-attested score in SPRS. A contractor whose plan has been "we'll self-assess and affirm annually" needs a different plan for any solicitation that lands after that date and requires Level 2.

Contracting officers aren't required to apply CMMC to every contract immediately, either. The DFARS rule gives program managers and requiring activities discretion over whether to invoke a CMMC requirement "until three years after the effective date of the rule" — meaning through November 10, 2028. After that window closes, CMMC becomes mandatory by default whenever a contract will involve processing, storing, or transmitting federal contract information (FCI) or controlled unclassified information (CUI), with an exception carved out for contracts limited to commercially available off-the-shelf (COTS) items. In practice, that discretion period means some Phase 2 solicitations will carry the C3PAO requirement and some won't — contractors have to read each solicitation's CMMC level requirement rather than assume a blanket rule.

How Long a "Current" CMMC Status Actually Lasts

DFARS 252.204-7021 doesn't just require a certification once — it requires the contractor to "have and maintain for the duration of the contract a current CMMC status at the following CMMC level, or higher." What counts as current varies sharply by level and by whether the assessment resulted in a Conditional or Final status. A Conditional Level 2 (Self) or Conditional Level 2 (C3PAO) status is current for only 180 days. A Final Level 1 (Self) status is current for one year. Final Level 2 and Final Level 3 statuses are current for three years. Regardless of level, the clause text specifies these windows "not older than" the assessment date, and every status — Conditional or Final — still requires an annual affirmation of continuous compliance, logged in SPRS by a designated "affirming official," to remain valid between assessments.

The 180-day clock on Conditional Level 2 status is the one that catches contractors off guard. A Conditional status means the assessment found gaps that haven't been closed yet, tracked through a Plan of Action and Milestones (POA&M). If a contractor doesn't close out that POA&M and convert to Final status within 180 days, the Conditional status lapses — and a lapsed status on a contract requiring current CMMC status is a compliance failure, not a paperwork delay.

The SPRS Unique Identifier and Subcontractor Flow-Down

Every covered information system has to carry its own CMMC Unique Identifier (CMMC UID) self-reported in SPRS — a contractor with multiple enclaves or system boundaries needs a UID for each one, not one blanket identifier for the company. That identifier is what a contracting officer checks against before award, and it's also what a prime has to verify before flowing a subcontract to a lower-tier vendor. The clause requires primes to confirm that subcontractors hold the CMMC level "based on the requirements at 32 CFR 170.23" before subcontract award — which means a prime's own compliance work isn't finished until its subcontractor tier is verified too, and a sub without a current status can hold up an award the prime already won.

What It Means for Contractors

Any contractor holding or bidding on a contract that will require CMMC Level 2 should treat November 10, 2026 as a hard planning deadline, not a distant regulatory milestone — two months is not enough lead time to schedule a C3PAO assessment cold. The practical sequence is to confirm which level a given solicitation or existing contract actually requires (that determination sits with the contracting officer, not the contractor), check whether an existing self-assessment or C3PAO score is still current under the 180-day/1-year/3-year windows above, and start a POA&M remediation now if any Conditional status is running against the 180-day clock. Contractors relying on subcontractors for CUI-touching work should request current CMMC UIDs from those subs immediately, since a flow-down failure discovered at award time can delay the whole contract, not just the subcontractor's piece of it. Finally, don't assume discretion protects a given award — some program offices may already be applying CMMC ahead of the 2028 mandatory date, and the only way to know is to read the solicitation's clause list directly.