Phase 1 — November 10, 2025 through November 9, 2026
Phase 1 began when DFARS 252.204-7021 took effect on November 10, 2025. During Phase 1, DoD solicitations may include CMMC requirements at any Level, but the primary focus is on Level 1 self-assessments and Level 2 self-assessments for contracts where a C3PAO-assessed Level 2 is not yet required. During Phase 1, contractors on applicable contracts must post a current NIST SP 800-171 self-assessment score in SPRS and provide a senior official affirmation of compliance with the required Level.
Level 1 self-assessments require annual affirmation. Level 2 self-assessments are triennial with annual affirmation. Level 2 C3PAO assessments are triennial with annual affirmation. Level 3 DIBCAC assessments are triennial.
Phase 2 — November 10, 2026 and beyond
Phase 2 begins November 10, 2026. Starting with that date, new DoD solicitations on applicable programs require C3PAO-assessed Level 2 CMMC status where the program office or requiring activity has designated C3PAO assessment as the required assessment type. This is the enforcement phase that triggers the need for a formal third-party assessment for contractors who have not yet achieved and posted a C3PAO-assessed Level 2 status.
Phase 2 does not uniformly apply to all contracts — the assessment type (self-assessment vs. C3PAO) remains determined by the specific contract clause and the DoD program office's designation. Contractors should read the actual DFARS 252.204-7021 clause in their solicitation to determine the required Level and assessment type.
The contract clause that operationalizes CMMC in DoD solicitations. Specifies the required Level, assessment type (self-assessment or C3PAO), and timing. Effective November 10, 2025.
View at Acquisition.govWhat ~80,000 DIB contractors need to know
The DoD estimates approximately 80,000 companies across the Defense Industrial Base are affected by CMMC at Levels 1, 2, and 3. The largest population is Level 2, where the majority of CUI-handling contractors sit. For Level 2 contractors with a C3PAO assessment requirement appearing in a Phase 2 or later solicitation, the practical consequence is clear: C3PAO assessment — not self-attestation — is required to compete for that contract.
Typical Level 2 readiness investments range from $50K for small organizations at relatively high starting maturity to $300K+ for mid-size organizations with complex CUI environments or GCC High migration requirements. C3PAO assessment fees are a separate line item on top of readiness costs.