Reviewed October 6, 2026: the planned November 10, 2026 Phase II expansion is suspended. Phase I self-assessment requirements and DFARS safeguarding duties remain. Check your solicitation, contract, and amendments before choosing an assessment path. Sources: official CMMC status and implementation memorandum.
The rules behind the clock
32 CFR Part 170, the CMMC Program rule, became effective December 16, 2024. It defines the levels, the assessment types, and what "certified" means.
48 CFR (the acquisition rule, revised DFARS 252.204-7021) took effect November 10, 2025. That rule puts CMMC requirements into contracts, and it started a four-phase rollout.
Current status and your contract
Self-assessments required at award
Applicable procurements retain CMMC Level 1 or Level 2 self-assessment and affirmation requirements. Check the required level, assessment currency, and SPRS record against the solicitation.
Former transition date is not a current deadline
The November 10, 2026 expansion is suspended. The implementation memorandum limits current CMMC designations to Level 1 or Level 2 self-assessment and directs amendment or modification of affected third-party requirements.
Do not rely on the former schedule
The phased implementation schedule is suspended. The former 2027 and 2028 milestones are not confirmed deadlines. Watch official guidance for any revised schedule.
Confirm the instrument that governs
Read the actual solicitation, flow-downs, and signed modifications. Resolve conflicting terms with the contracting officer; a program announcement does not itself rewrite your contract.
Primes still check their suppliers. They may request representations or evidence that applicable subcontract requirements are met. Confirm the actual flow-down and requested evidence; a customer questionnaire does not grant access to another contractor's SPRS record.
Want this as a working document? The free companion Phase Checklist turns this playbook into an interactive this-week / this-month / this-quarter list you can print and put on the wall.
Get the Checklist →Your 90-day action plan
- Weeks 1 to 2: verify the obligation. Pull your active contracts and confirm which carry DFARS 252.204-7012, 7019, or 7020. The clauses you actually carry set your scope and budget.
- Weeks 2 to 4: define the CUI boundary. Find where CUI actually lives. Discovery establishes what belongs in scope, including the systems that protect CUI. It does not guarantee any percentage reduction.
- Weeks 3 to 6: get a real SPRS score. Score all 110 controls honestly (our free calculator does the math), document the SSP, and submit. Report a score you can defend, because an inflated score creates False Claims Act exposure.
- Weeks 6 to 10: sequence remediation by point impact. Close 5-point gaps first. MFA, FIPS-validated crypto, logging, and boundary protection move the score fastest.
- Weeks 8 to 13: confirm your assessment path. Review contract amendments and modifications, maintain required self-assessments, and scope readiness work against a confirmed need.
Want this playbook mapped to your contracts?
Tell us where you are and a practitioner will come back with your phase exposure, a path to a defensible score, and a fixed-scope plan. Or email rj@indirectit.com directly. If you want numbers in hand first, try the CMMC Calculator.