For years, DoD cybersecurity compliance operated on the honor system. Contractors self-attested to NIST 800-171 compliance and the government mostly took them at their word. That era is over.
The Cybersecurity Maturity Model Certification program is in active enforcement. Phase 1 of the rollout began November 10, 2025. The CMMC clause is appearing in new solicitations today. By the end of 2027, every DoD contract involving CUI will require a verified certification before award.
No certification, no contract. That's not hypothetical — it's how the solicitation language reads right now.
The Rollout Timeline You Need to Know
Authoritative details on the phase-in come directly from the DoD CMMC program and the Office of the Under Secretary of Defense for Acquisition and Sustainment.
Why "We'll Get to It" Is a Losing Strategy
Certifications Don't Happen Overnight
A realistic Level 2 certification timeline from a cold start is 9-18 months. That includes scoping, gap remediation, SSP development, evidence gathering, mock assessment, and the C3PAO engagement itself. C3PAO capacity is limited — backlogs are already stretching into quarters, not weeks.
If you start today for a Phase 2 November 2026 requirement, you are on time. If you start in Q3 2026, you're probably too late for bids that award that fiscal year.
Primes Are Already Flowing It Down
Large primes aren't waiting for the DoD to force the issue. Lockheed Martin, RTX, Boeing, Northrop, L3Harris, and others are asking their subs — including tier 2 and tier 3 — for SPRS scores, target assessment dates, and CMMC status on every new RFQ. We've seen subs lose recurring orders because they couldn't produce a credible CMMC plan.
A manufacturer in the Midwest lost a five-year machining contract in early 2026 because the prime's procurement team wouldn't approve a new PO without a documented CMMC roadmap. The incumbent lost the follow-on to a certified competitor. The lesson: you don't need to be certified to compete — but you need to be visibly on the path.
Enforcement Has Teeth
Beyond losing awards, non-compliance now carries real legal risk. The Department of Justice's Civil Cyber-Fraud Initiative has collected multi-million-dollar settlements from defense contractors who misrepresented their cybersecurity posture. When CMMC certification becomes a representation on your contract, false claims liability attaches to it directly.
The Four-Step Plan to Get Compliant
1. Identify Your Level and Scope
Read your contracts and expected flow-downs. If you handle CUI in any form, you are almost certainly Level 2. Define your CUI enclave — which endpoints, servers, SaaS applications, and physical spaces touch the data. Smaller enclaves mean fewer controls to prove. Start with our free self-assessment to get a clean read on your starting position.
2. Run a Real Gap Analysis
Not a yes/no spreadsheet. A proper gap analysis against all 110 NIST 800-171 controls, evaluated against evidence — your actual SSP, your real configurations, your current policies and procedures. Our cyber risk assessment maps directly to CMMC evaluator methodology.
3. Remediate Fast
Fix the gaps. Prioritize the highest-scoring controls (MFA, encryption, logging, access control, incident response). Implement the tooling, document the procedures, train the people, and collect the evidence as you go. Don't stockpile it for audit week — your assessor will want artifacts dated across the preceding period, not all from the last month.
4. Get Audited
Engage a Cyber AB-accredited C3PAO. Complete a mock assessment first. Book your real assessment with 2-3 months of buffer ahead of your contract requirement. Plan for a three-year certification cycle with annual affirmations.
Waiting Costs More Than Acting
Every month of delay is a contract bid you can't win. Every month of delay is a prime flowing work to your certified competitor. And every month the C3PAO backlog gets longer, so your eventual engagement date slides further right.
If you supply the Department of Defense, CMMC is no longer a future problem. It's a present condition of doing business. Our CMMC Compliance Services support prime contractors, manufacturers, and subs across the defense industrial base. If you want context on how to pick a partner, start with our post on what to look for in a CMMC consultant. When you're ready, contact our team for a scoping call.