CMMC Phase-In Timeline: What November 2026 Really Means for Primes and Subs

The CMMC final rule dropped on October 15, 2024, and with it came a phase-in schedule that every prime contractor and subcontractor in the defense industrial base needs to internalize. The 32 CFR Part 170 timeline is not a suggestion. It is a contractual gate that will determine who can bid on DoD work and who gets locked out. After walking dozens of contractors through this timeline, I can tell you the biggest risk is not the complexity of the controls. It is the false sense of time people carry until it is too late.

Phase 1: Self-Assessment Is Already Here

Phase 1 went into effect when the 48 CFR CMMC acquisition rule became active. As of late 2025, DoD contracting officers can include CMMC Level 1 self-assessment requirements in new solicitations and contracts. This means any contractor handling Federal Contract Information (FCI) may already be required to complete a Level 1 self-assessment and submit an affirmation into the Supplier Performance Risk System (SPRS).

For Level 2, Phase 1 also allows self-assessments for certain programs where the DoD determines a third-party assessment is not required. These self-assessments still demand full implementation of all 110 NIST SP 800-171 Rev 2 controls, a completed System Security Plan, and an honest SPRS score submission. The word "self" does not mean "easy." It means the government is trusting you to tell the truth, and the False Claims Act applies if you do not.

Phase 2: The C3PAO Assessment Gate

Phase 2 is where the real pressure hits. Approximately one year after Phase 1, DoD will begin requiring CMMC Level 2 certification assessments conducted by accredited C3PAOs (Certified Third-Party Assessment Organizations) for contracts involving CUI. This is the phase that most contractors are focused on, and for good reason: without a passing C3PAO assessment, you cannot be awarded contracts that require Level 2 certification.

The November 2026 target date is not arbitrary. It represents the point at which DoD expects the C3PAO ecosystem to have sufficient capacity to handle assessment demand. But here is the problem: there are roughly 80,000 companies in the defense industrial base that handle CUI, and the number of accredited C3PAOs is still ramping up. The math does not work in your favor if you wait.

Phase 3: Level 3 and DIBCAC

Phase 3 introduces CMMC Level 3 requirements, which add 24 controls from NIST SP 800-53 on top of the 110 Level 2 controls. Level 3 assessments are conducted by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), not C3PAOs. This phase targets contractors working on the most sensitive programs involving critical national security information.

If your contracts involve CUI that the DoD categorizes as requiring enhanced protection against advanced persistent threats, you will need Level 3. The good news is that Phase 3 is approximately two years after Phase 1, giving you more runway. The bad news is that Level 3 requires a passing Level 2 certification first, so you cannot skip ahead.

Who Needs Level 2 and By When

The answer depends on your contract vehicle and the type of information you handle. Here is the decision framework:

What Happens If You Miss the Deadline

There is no grace period. When a solicitation includes a CMMC requirement, you must have the specified certification level at the time of contract award. Not at proposal submission. Not at option exercise. At award. If you do not have it, the contracting officer cannot award you the contract regardless of how strong your technical proposal is.

For primes, this creates a cascading problem. If your subcontractors are not certified at the required level, you cannot flow CUI to them. That means you either find new subs, bring the work in-house, or restructure your supply chain. None of those options are fast or cheap.

Realistic Preparation Windows

Based on our experience preparing contractors across the DIB, here are realistic timelines for achieving certification readiness:

How AeoliTech Compresses the Timeline

The timelines above assume traditional consulting-driven preparation. AeoliTech's PolicyCortex platform compresses those windows by approximately four months on average. Here is how:

The Bottom Line

November 2026 is not a cliff. It is the point at which the first C3PAO-assessed Level 2 requirements will appear in solicitations. But the preparation window is closing fast. If you are a prime, you need to be assessing your supply chain now. If you are a sub, you need to be demonstrating progress to your primes now. The contractors who treat this as a 2027 problem will find themselves locked out of the contracts they depend on.

The phase-in schedule is designed to give the ecosystem time to build capacity. Use that time wisely. Start your gap assessment, engage a preparation partner, and get on a C3PAO's calendar early. The queue is only going to get longer.