CMMC Compliance Deadlines: The Complete Phase-by-Phase Guide (2025–2028)

DFARS 252.204-7021 becomes enforceable. Contracting officers begin inserting CMMC requirements into applicable new solicitations and contracts.

• Level 1 (FCI): Annual self-assessment against FAR 52.204-21’s 15 basic safeguarding requirements. Score and affirmation must be entered in SPRS prior to award. POA&Ms are not permitted at Level 1.
• Level 2 Self (CUI): Full NIST SP 800-171 Rev. 2 self-assessment covering all 110 requirements. Results entered in SPRS every 3 years with annual affirmations. A Conditional CMMC Status via POA&M is permitted but must be closed within 180 days.
• Level 2 C3PAO at DoD discretion: Contracting officers retain discretion to require a Level 2 C3PAO certification even in Phase 1 for select high-sensitivity programs. Do not assume self-assessment is sufficient for every contract.
• SPRS posting requirement: Contracting officers shall not award, extend, or exercise options without a verified current CMMC status posting at the required level. The affirmation must be entered in SPRS alongside the assessment results.
• Subcontractor flow-down: Prime contractors must ensure subcontractors handling FCI or CUI meet the applicable CMMC level as a condition of the subcontract.

This is the most consequential phase for contractors handling CUI. Mandatory third-party C3PAO assessments become the standard for Level 2. Self-assessments will no longer be sufficient for most CUI-handling contractors.

• Level 2 C3PAO required for new awards: Organizations handling CUI must obtain certification from an accredited C3PAO as a condition of award. Results are entered into CMMC eMASS. The certificate must reflect Final CMMC Status — not Conditional.
• Certificate validity: CMMC Level 2 C3PAO certificates are valid for 3 years from the assessment date. Annual affirmations of continued compliance must be submitted in SPRS each year within that window. Failure to annually affirm lapses the assessment.
• POA&M limitations: A Conditional CMMC Status with open POA&M items may allow award in limited cases, but all items must be closed within 180 days of the Conditional Status Date via a formal POA&M closeout assessment by the C3PAO.
• C3PAO capacity constraint: The DoD estimates approximately 8,350 DIB entities require Level 2 C3PAO assessments. With limited authorized C3PAO capacity, organizations should engage C3PAOs 8–12 months before their contract deadlines. Do not wait.

Level 2 certification requirements expand to cover contract option exercises. Level 3 DIBCAC assessments are formally introduced for programs involving the most sensitive CUI and advanced persistent threat exposure.

• Level 2 C3PAO required for option exercises: Organizations without a current Final CMMC Status at Level 2 cannot have options exercised on applicable contracts awarded after November 10, 2025.
• Level 3 (DIBCAC) required for applicable new awards: CMMC Level 3 assessments, conducted by DCMA’s Defense Industrial Base Cybersecurity Assessment Center, are required for programs involving the most sensitive CUI. A Final Level 2 C3PAO certification for the same assessment scope is a prerequisite.
• Level 3 requirements — 134 total: All 110 NIST SP 800-171 Rev. 2 requirements plus 24 selected requirements from NIST SP 800-172, for a total of 134 security requirements.

Full CMMC program implementation. All applicable DoD solicitations and contracts must include the appropriate CMMC level as a condition of award.

• Universal applicability: CMMC requirements apply to all DoD solicitations above the micro-purchase threshold where the contractor processes, stores, or transmits FCI or CUI. The only exclusion remains contracts solely for COTS items.
• Continuous compliance: CMMC is not a one-time checkpoint. Annual affirmations, ongoing implementation, and three-year reassessments are permanent obligations across all levels.