Cyber guide
When Is CMMC Required? 2026 Deadlines and the Phased Rollout
CMMC is already in contractual rollout, but there is no single deadline for every defense contractor. The controlling date is when an applicable solicitation or contract requires a particular CMMC status.
The two rules behind the CMMC timeline
The CMMC program rule in 32 CFR part 170 became effective on December 16, 2024. It defines the model, assessment ecosystem, scoping, status, affirmation, and four-phase implementation structure. The complementary DFARS acquisition rule became effective on November 10, 2025 and supplied the contract provisions and clauses that make CMMC status enforceable in covered acquisitions. [1][2]
Because Phase 1 begins on the later rule's effective date, the operational rollout began November 10, 2025. That date starts the phase calendar; it does not mean every defense contractor became subject to every CMMC assessment on the same day. [1][2]
CMMC status as of July 2026
As of July 2026, the rollout is in Phase 1, scheduled from November 10, 2025 through November 9, 2026. DoD intends in this phase to include Level 1 Self or Level 2 Self status in applicable solicitations and contracts, while retaining discretion to require Level 2 C3PAO status in selected acquisitions. [1][2]
A contractor should read each solicitation rather than infer its obligation from the calendar alone. Before award, the contracting officer checks that each relevant contractor information system has a current SPRS status at or above the level named in the solicitation. [3]
The four rollout phases
Phase 2 begins November 10, 2026 and expands Level 2 C3PAO requirements for applicable awards, with discretion to introduce Level 3. Phase 3 begins November 10, 2027 and broadens Level 2 C3PAO and Level 3 requirements. Phase 4 begins November 10, 2028 and represents full implementation for applicable DoD solicitations, contracts, and relevant option periods. [1]
The phase descriptions express DoD's implementation intent and retain defined discretion during the ramp. A future rule or policy update could change how requirements appear, so any dated guide should name its review month and link the current DFARS text. [1][3]
When CMMC becomes required for your company
For a specific bidder, CMMC becomes an award condition when the applicable solicitation includes the CMMC provision and identifies a required status. The requirement applies to the contractor information systems used in performance that will process, store, or transmit FCI or CUI; subcontract flow-down depends on the information a subcontractor will handle and the clauses in the subcontract. [3][2]
How to plan against the timeline
Track target solicitations and option periods, identify which information types and systems they will involve, and work backward from the likely award date. Scoping, remediation, evidence collection, third-party scheduling where required, SPRS posting, and affirmation all take time; the solicitation is the final authority for the status due at award. [3][1]
The LongLead connection
How LongLead AI helps
LongLead AI reads dated public records and surfaces projects that may create demand for a specialist's scope, typically 12–24 months before that scope is named depending on the signal and project. Every opportunity carries its source and an estimated lead-time window. LongLead prepares a cited evidence dossier naming the likely counterparty; the customer makes the call from its own channels, and nothing leaves the system.
Official sources
- [1]Cybersecurity Maturity Model Certification Program, 32 CFR part 170Department of Defense / Federal Register
- [2]DFARS Case 2019-D041 final acquisition ruleDepartment of Defense / Federal Register
- [3]DFARS subpart 204.75 — Cybersecurity Maturity Model CertificationAcquisition.gov
FAQ
- When will CMMC be required?
- CMMC is required when an applicable DoD solicitation or contract includes a CMMC level and status as an award or performance condition. The phased rollout began on November 10, 2025 and expands through full implementation beginning November 10, 2028.
- When does CMMC go into effect?
- The CMMC program rule took effect on December 16, 2024, and the acquisition rule took effect on November 10, 2025. Contractual rollout began when the later acquisition rule became effective.
- When is CMMC compliance required?
- The required CMMC status must be current when the contracting officer checks award eligibility for a solicitation that contains the CMMC requirement. Some contracts also require the status to remain current through performance and option exercises.