Reviewed October 6, 2026: the planned November 10, 2026 Phase II expansion is suspended. Phase I self-assessment requirements and DFARS safeguarding duties remain. Check your solicitation, contract, and amendments before choosing an assessment path. Sources: official CMMC status and implementation memorandum.
The rules behind the clock
32 CFR Part 170 — the CMMC Program rule — became effective December 16, 2024. It defines the levels, the assessment types, and what "certified" means.
48 CFR (the acquisition rule, revised DFARS 252.204-7021) took effect November 10, 2025. That's the switch that puts CMMC requirements into contracts — and it started a four-phase rollout.
Current status and your contract
Self-assessments required at award
Applicable procurements retain CMMC Level 1 or Level 2 self-assessment and affirmation requirements. Check the required level, assessment currency, and SPRS record against the solicitation.
Former transition date is not a current deadline
The November 10, 2026 expansion is suspended. The implementation memorandum limits current CMMC designations to Level 1 or Level 2 self-assessment and directs amendment or modification of affected third-party requirements.
Do not rely on the former schedule
The phased implementation schedule is suspended. Monitor official guidance for any revised schedule rather than treating the former 2027 and 2028 milestones as confirmed deadlines.
Confirm the instrument that governs
Read the actual solicitation, flow-downs, and signed modifications. Resolve conflicting terms with the contracting officer; a program announcement does not itself rewrite your contract.
Supplier diligence remains relevant: primes may request representations or evidence that applicable subcontract requirements are met. Confirm the actual flow-down and requested evidence; a customer questionnaire does not grant access to another contractor's SPRS record.
Want this as a working document? The free companion Phase Checklist turns this playbook into an interactive this-week / this-month / this-quarter list you can print and put on the wall.
Get the Checklist →Your 90-day action plan
- Weeks 1–2 — verify the obligation. Pull your active contracts and confirm which carry DFARS 252.204-7012 / 7019 / 7020. Obligation drives scope and budget.
- Weeks 2–4 — define the CUI boundary. Where does CUI actually live? Discovery establishes what belongs in scope, including systems that protect CUI; no percentage reduction is guaranteed.
- Weeks 3–6 — get a real SPRS score. Score all 110 controls honestly (our free calculator does the math), document the SSP, and submit. A defensible score beats an inflated one — an inflated one is False Claims Act exposure.
- Weeks 6–10 — sequence remediation by point impact. Close 5-point gaps first. MFA, FIPS-validated crypto, logging, and boundary protection move the score fastest.
- Weeks 8–13 — confirm your assessment path. Review contract amendments and modifications, maintain required self-assessments, and scope readiness work against a confirmed need.
Want this playbook mapped to your contracts?
Tell us where you are and a practitioner will come back with your phase exposure, a defensible-score path, and a fixed-scope plan. Or email rj@indirectit.com directly — and try the CMMC Calculator first if you want numbers in hand.