CMMC Phase 2 Deadline: What November 10, 2026 Actually Means for Your Contracts

By The Defense Compliance Report Editorial Team · Last reviewed: June 2026 · Last verified: June 30, 2026

The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. We are not affiliated with the Cyber AB, the Department of Defense, DCMA DIBCAC, NIST, or any U.S. government agency.

The Defense Compliance Report is the independent trade publication and decision resource for CMMC and Defense Industrial Base compliance — explaining the CMMC Final Rule with primary-source citation on every claim and mapping a contractor’s level, CUI scope, assessment type, and timeline to the right provider category, so DIB contractors choose the right CMMC path before they spend six figures.

Which CMMC Phase 2 situation are you in?

Your Phase 2 deadline depends on what you handle, what your contract says, and whether you’re a prime or a sub. Find your row first, then keep reading for the detail and the primary sources behind each one.

Educational research, not legal, contractual, or compliance advice. Confirm applicability with a CMMC Registered Practitioner (RP/RPO) or a qualified federal-contracts attorney.

The right CMMC provider isn’t the same for every contractor — the category you need (a C3PAO, an RPO, an MSSP, a GRC platform, or a CUI enclave) depends on your required CMMC level, whether you handle FCI or CUI, your assessment type, your cloud and IT environment, and your contract timeline. The contract clause sets your level, not a checklist. Because a general answer can’t resolve those for you, use The Defense Compliance Report’s Find My CMMC Path tool to map your situation to the right provider category before you request quotes — and do not submit CUI, drawings, or sensitive contract details.

Is November 10, 2026 a universal CMMC deadline?

This is where most of the internet gets it wrong, and where the anxiety comes from. Vendors talk about November 10, 2026 like a single cliff every company in the Defense Industrial Base (DIB) falls off on the same day. That’s not how the rule is built.

Here’s the word we promised you. In the CMMC Program Rule (32 CFR § 170.3(e)), Phase 2 says the DoD “intends to include the requirement for CMMC Status of Level 2 (C3PAO) for applicableDoD solicitations and contracts as a condition of contract award.” Read the very next paragraph — Phase 3 — and the language changes to “all applicableDoD solicitations and contracts.” That difference between applicable and all applicableis not an accident. It’s the DoD telling you, in its own regulation, that Phase 2 is a rollout that attaches to specific contracts, and that the blanket, everyone-in application arrives later.

We checked the current eCFR version of 32 CFR Part 170 on June 30, 2026. The requirement is also tied to the type of information on your systems: the rule puts DoD program managers in charge of selecting the CMMC status for each procurement based on whether it involves FCI or CUI (32 CFR § 170.3(d)). The DoD can even waive CMMC requirements for a procurement in advance (32 CFR § 170.3(c)) — though, as we’ll cover below, the government’s own watchdog has warned against leaning on that waiver too hard.

So the honest translation is this: the date is real, but it is a contract implementation milestone, not a universal certification cliff. What matters for you is whether — and when — a Level 2 (C3PAO) requirement shows up in the specific work you want to win or keep.

What actually changes on November 10, 2026?

Phase 1 has been in effect since the DFARS acquisition rule took effect on November 10, 2025 (Federal Register, DFARS final rule). The practical shift in Phase 2 is the level of scrutiny for applicable CUI work: from a self-assessment you perform and post, to an independent assessment a third party conducts.

The biggest misunderstanding worth killing right now: Phase 2 does not erase every self-assessment path overnight. It expands the use of Level 2 (C3PAO) requirements for applicable contracts. Whether your specific contract requires “Self” or “C3PAO” is a fact stated in the solicitation — not something the calendar decides for you.

The full CMMC phase-in timeline (Phases 1–4)

Two things to take from this table. First, the phases each begin one calendar year apart, by rule. Second, full implementation — the broadest phase, applying CMMC across applicable DoD solicitations and contracts that involve FCI or CUI — is Phase 4 in November 2028, not Phase 2. That’s the structural reason November 10, 2026 is not the universal deadline it’s often made out to be.

For the deep dive on each level, see our CMMC levels overview and CMMC certification process guides.

So when is your real CMMC Phase 2 deadline?

This is the part no one else will give you in one place, so we built it. We call it the CMMC Phase 2 Deadline Triage Matrix. It combines the phase timing from 32 CFR Part 170, the contract-trigger language from the DFARS clauses, the FCI-versus-CUI split, and the option-period and flow-down mechanics into a single grid. If you had to assemble this yourself, you’d be opening the CFR, two DFARS clauses, and a stack of vendor blogs. Here it is on one screen.

This matrix is educational research, not legal or contractual advice. Your contract clause and CUI handling set your level — this table helps you ask the right questions.

Do you need a C3PAO assessment, or does a self-assessment still count?

The distinction matters because the two paths differ in cost, timeline, and who has to sign off. A self-assessment is something your team performs and posts to the Supplier Performance Risk System (SPRS). A C3PAO assessment brings in an accredited third party to examine, interview, and test your environment against all 110 requirements. Same underlying standard — very different level of scrutiny.

Not sure you’re even in scope? Read this before you spend a dollar. If you handle only FCI and never touch CUI, the Phase 2 C3PAO requirement is not aimed at you — start with our CMMC Level 1 guidance instead of an assessor. And if your work won’t involve DoD contracts at all, you likely don’t need CMMC; confirm applicability with a Registered Practitioner or a federal-contracts attorney before you buy anything. We’d rather you leave this page correctly than pay for the wrong step. For a full side-by-side, see our CMMC Level 2 self-assessment vs C3PAO comparison.

The honest part: if you have CUI and no scope yet, here’s the truth

We’re going to tell you something most vendors won’t, because we don’t sell readiness services or assessments and we don’t rank “best providers” — so we have no reason to soften it.

That’s not us being pessimistic. It’s what assessors are seeing. In Alluvionic’s 2025 State of CMMC report — a survey of C3PAO assessors — only about 25% of surveyed assessors said organizations are typically well prepared when they arrive, about half reported delaying or turning away clients roughly half the time due to readiness gaps, and around 80% pointed to “assumed readiness without validation” as the leading cause of reschedules. Translation: the most expensive mistake in CMMC isn’t failing an assessment. It’s walking into one you weren’t ready for.

Here’s the pivot, and it’s genuinely good news. This is fixable, and the fix changes who you should call first. If you’re not ready, the first move is notto book a C3PAO — it’s readiness: scope your CUI, build the SSP, close your highest-weighted gaps, and get an honest self-assessment score. Do that now, and you’re in a strong position even with a tight calendar. There’s also a formal safety valve — Conditional certification — which we explain in the next section. And if you can’t get a clean certificate before a specific contract needs it, knowing that early lets you adjust your bid strategy instead of getting surprised.

What happens if you’re not certified in time?

The scoring and POA&M rules are precise, and they’re where a lot of contractors get an unpleasant surprise. Here’s what the rule actually requires (32 CFR § 170.21 and § 170.17):

• →You must hit 80% to qualify for Conditional status. Your score divided by total requirements must be at least 0.8. Level 2 starts at 110 points, so the floor is 88 of 110.
• →Only 1-point requirements can go on a POA&M. Every 3-point and 5-point requirement must be fully implemented at the time of assessment.You cannot defer your most important controls (think multifactor authentication, encryption) to a later date. If a high-weighted control isn’t in place when the assessor arrives, it’s a disqualifying finding, not a documented exception.
• →One narrow exception:FIPS-validated cryptography (SC.L2-3.13.11) can go on a POA&M at a 3-point cost ifencryption is in place but not yet FIPS-validated. If there’s no encryption at all, it’s a 5-point gap and not eligible.
• →Six specific 1-point requirements are excluded from POA&M eligibility by name in the rule, even though their point value would otherwise allow deferral.
• →You have 180 days.A POA&M closeout assessment must confirm the open items are fixed within 180 days of your Conditional CMMC Status Date. Miss it and your Conditional status expires, and standard contractual remedies apply.

One terminology trap worth flagging: the post-assessment POA&M (time-bound, 180 days) is not the same thing as the ongoing Operational Plan of Action (OPA) the rule also defines. The OPA tracks day-to-day deficiencies and has no fixed remediation deadline. The CMMC Final Rule split these deliberately, and assessors will expect you to know the difference. For the full edge-case treatment, see our Conditional CMMC Level 2 Certificate page.

Did the 2026 FAR overhaul change the Phase 2 deadline?

This is where a lot of contractors got spooked in early 2026, so let’s clear it up carefully — because the truth is more nuanced than either “nothing happened” or “everything got renumbered.” On February 1, 2026, the DoD issued class deviations under the broader “Revolutionary FAR Overhaul,” directing contracting officers to use reorganized information-security constructs — a new FAR Part 40 and DFARS Part 240 — in solicitations that use the deviation. That’s real. But a class deviation runs aheadof formal rulemaking, so the codified regulation text hasn’t caught up. The result is a transition period in which both the old and new clause numbers are live, depending on where you look and which solicitation you’re reading.

We checked the primary sources ourselves. Here’s the honest ledger.

The practical takeaway: none of the underlying obligations went away, the CMMC-specific clauses that govern your Phase 2 deadline weren’t touched, and if you’re reading a solicitation, check which construct it uses rather than assuming.

There is also a proposedFAR rule (FAR Case 2026-001, published at 91 FR 37550 in June 2026) with a public comment period. As of this writing it is a proposal, nothing is final, and — importantly — it does not change the CMMC Level 2 requirements or the November 10, 2026 Phase 2 date. We’re flagging it so that if you see headlines about it, you know it hasn’t changed your obligations. We re-check the Federal Register and Acquisition.gov on this every month.

What contract language should you check first?

The single most useful thing you can do this week costs nothing: read your contract documents with the right questions in hand. DFARS 252.204-7025 is explicit — the contracting officer names the required CMMC level in the solicitation, and that level “is required prior to award” for each system that will handle FCI or CUI; an offeror without it is not eligible for award. Run this checklist against your documents.

• •DFARS 252.204-7025 in the solicitation? That’s your notice that a CMMC requirement is coming.
• •DFARS 252.204-7021 in the contract? That’s the binding clause.
• •What CMMC level is listed — 1, 2, or 3? Sets your requirement baseline.
• •What assessment type — Self, C3PAO, or DIBCAC? Determines who must assess you.
• •Does your work involve FCI, CUI, or both? Determines which level path applies.
• •Which information systems process, store, or transmit that data? Defines your assessment scope.
• •Which CAGE codes are tied to the work? SPRS entries are cage-code specific.
• •Is the CMMC requirement due at award or at an option period? Sets your real deadline.
• •Is a prime imposing an earlier flow-down date than the DoD’s? Primes can be faster than the phase schedule.
• •Are cloud providers, an MSP, or external service providers in scope? ESPs can expand scope significantly.

If you can answer those, you know your real deadline. If a few of them are fuzzy — especially the CUI and scope questions — that fuzziness isthe problem to solve first, and it’s exactly what a Registered Provider Organization (RPO) or scoping engagement is for.

What if your cloud, MSP, or CUI enclave is in scope?

This is the section that quietly saves companies the most money and pain, because scope drives everything downstream: your cost, your timeline, and your odds of passing. The core principle from the rule is simple — if a system processes, stores, or transmits CUI, it’s in scope, and you need to document who is responsible for each control in a customer responsibility matrix and your SSP. Use the grid below to pressure-test your own environment.

A few realities to internalize. Buying a GRC (governance, risk, and compliance) platform is genuinely useful for managing evidence and your SSP, but software is a supporting layer, not the whole solution — it does not implement your controls or make you compliant on its own. A CUI enclave can dramatically reduceyour scope, but only if it’s implemented and governed correctly and your SSP reflects reality. And for any external provider, you need a clear customer responsibility matrix: who owns which control, and who produces the evidence. If your CUI is scattered across commercial IT with no boundary, the most valuable early conversation is usually with a managed-environment or enclave provider to shrink and define scope — long before you talk to an assessor.

How to think about this as a subcontractor

CMMC requirements flow down the supply chain by rule (32 CFR § 170.23), and primes are responsible for making sure their subs meet the required level for the work. Many primes aren’t waiting — they’re auditing their supply chains now, because a non-compliant sub is a risk to theireligibility. That’s why “we’ll deal with it in 2026” can be the wrong answer for a subcontractor whose prime needs proof this year.

Before you respond to a prime’s request, pin down the specifics:

• What CMMC level are you requiring of us?
• Is it Level 2 (Self) or Level 2 (C3PAO)?
• What CUI will we receive or generate?
• Which of our systems do you expect to be in scope?
• What evidence do you need before award — SPRS score, annual affirmation, CMMC UID, certificate status?
• Is this requirement from a solicitation, a contract clause, or your internal policy?

Getting those answers in writing does two things: it tells you your real deadline, and it tells you which provider category to talk to first. If you’re staring at a prime’s email right now and not sure how to answer it, the fastest path is to map your requirement in Find My CMMC Path before you reply — no CUI required.

What the government’s own watchdogs say about the deadline

We lean on primary and government sources here on purpose, and these two are worth reading.

The Government Accountability Office (in GAO-26-107955, published March 12, 2026) found that the DoD had addressed six of seven elements of a comprehensive CMMC strategy but had not fully assessed the “external factors” that could impede the program. The report is blunt about capacity: as of December 2025, the Cyber AB had authorized 92 C3PAOs, and the DoD relies on the private sector to grow enough assessors to meet demand across a defense supply chain the GAO puts at roughly 200,000 companies. GAO also flagged that DoD’s fallback — issuing waivers when capacity gets tight — could undermine the program if overused, and it noted the same Revision 2 versus Revision 3 gap we cover below (CMMC is still pinned to the older standard). For context on demand, the Cyber AB reported at its February 2026 town hall that roughly 1,000 companieshad earned a third-party CMMC certification or were in the process. Ninety-two authorized C3PAOs for a roughly 200,000-company defense supply chain is the math behind every “book early” warning you’ve read — but note the more precise point the data supports: the binding constraint is as much contractor readiness as it is assessor supply.

The DoD Office of Inspector General (DODIG-2025-056) reviewed how C3PAOs get authorized and found the process wasn’t being effectively implemented — it identified cases where organizations were authorized without a fully verified quality-control lead or fully confirmed assessor staffing, because the DoD lacked a quality-assurance step. Why this matters to you: because Level 2 (C3PAO) status is tied to contract eligibility, relying on an inadequately authorized assessor can create real downstream contract risk if a certification is later called into question. The practical defense is simple. Before you sign an engagement letter, confirm the firm is listed as an Authorized C3PAO on the Cyber AB Marketplace on the day you sign, and put a dated copy of that listing in your file. A screenshot from six months ago is not evidence of current status.

Here’s how to hold the “who says so” straight — what the regulation states versus what’s been verified in practice:

What we verified for this page

We take primary-source citation seriously, so here’s exactly what we checked and when. This is educational research, not legal or contractual advice.

Bottom line and your next step

November 10, 2026 is a real, fixed milestone — the start of Phase 2 — but it is not a universal certify-by-this-date deadline. What decides your timeline is the level and assessment type your contract requires, the information you handle, and whether a prime is moving faster than the DoD. Read your contract for DFARS 252.204-7025 and 252.204-7021, confirm your FCI/CUI scope, check your SPRS status, and figure out whether your first call should be to a readiness provider, a managed-environment or enclave provider, a GRC platform, or — only when you’re truly ready — a C3PAO.

If any of that is still unclear, don’t guess and don’t panic-buy. Take one small, concrete step.

Frequently asked questions about the CMMC Phase 2 deadline