CMMC certification timeline: how long does it take?

If you are planning CMMC certification, the most common question after “which level?” is how long it will take. Timelines vary widely based on scope, starting maturity, and assessor availability.

This guide covers:

• Factors that expand or compress your schedule
• Typical ranges for Level 1, 2, and 3
• A practical phase-by-phase plan from kickoff to SPRS

Related guides:

• CMMC resource collection
• CMMC certification checklist
• C3PAO guide
• Practical guide to CMMC requirements

---

Key takeaways

• Level 1 can often be achieved in weeks to a few months if scope is narrow and practices are largely in place.
• Level 2 commonly takes 6–12+ months including gap remediation and C3PAO lead time.
• Level 3 typically adds months for 800-172 work and DIBCAC scheduling after final Level 2.
• Phase 2 of the rollout (November 10, 2026) lets DoD require C3PAO Level 2 certification for contract award. Demand for assessors rises with it.

---

What drives your timeline

Factor	Impact
Scope size	More systems and locations = more controls and evidence
Starting maturity	Greenfield vs. existing 800-171 program
POA&M volume	Large gap lists extend remediation
Tooling	Manual evidence slows assessment prep
Assessor availability	C3PAO queues may add 60–120+ days

---

Typical timelines by CMMC level

Level	Typical total time	Notes
1	1–3 months	Self-assessment + SPRS
2	6–12+ months	Gap assessment, SSP, remediation, assessment
3	12–18+ months	Level 2 final + 800-172 + DIBCAC

Mature organizations with prior NIST SP 800-171 programs may move faster; fragmented environments often take longer.

---

Phase-by-phase schedule

1. Scoping (2–4 weeks): Define CUI/FCI boundaries, asset inventory, data flows.
2. Gap assessment (4–8 weeks): Map practices, score SPRS baseline.
3. Remediation (2–6+ months): Close gaps; maintain POA&M with owners.
4. Pre-assessment (2–4 weeks): Mock interviews, evidence packaging.
5. Assessment (2–6 weeks): C3PAO or self-assessment per contract.
6. Closeout & SPRS (1–2 weeks): Submit results; plan annual affirmation.

Start early: Phase 2 of the rollout (November 10, 2026) adds C3PAO Level 2 certification requirements to contracts and increases demand on assessors.

---

The CMMC rollout dates

The DFARS rule that puts CMMC into defense contracts was published in the Federal Register on September 10, 2025, and requirements are phased in over four years:

Phase	Start date	What changes
Phase 1	November 10, 2025	Level 1 and Level 2 self-assessments required as a condition of award in applicable solicitations
Phase 2	November 10, 2026	DoD adds Level 2 certification by a C3PAO where the contract requires it
Phase 3	November 10, 2027	Level 3 requirements begin, assessed by DCMA DIBCAC
Phase 4	November 10, 2028	Full implementation: CMMC requirements in all applicable contracts, solicitations and option periods

Contracting officers decide the required level for each contract, so check upcoming solicitations and talk to your primes. Many prime contractors ask their suppliers for proof of readiness well before the contract clause appears.

A realistic Level 2 timeline

For a small defense supplier with about 40 employees, a cloud-based environment and no existing NIST SP 800-171 program, a realistic Level 2 schedule looks like this:

Month	Work
1	Scope the CUI environment, build the asset inventory and data flow diagrams
2 to 3	Gap assessment against the 110 requirements, first SPRS score, draft System Security Plan (SSP)
4 to 9	Remediation: MFA everywhere, logging and monitoring, configuration baselines, encryption, incident response, training
9 to 10	Mock assessment, evidence review, final SSP and POA&M
10 to 12	Book and complete the C3PAO assessment, close any remaining POA&M items

Companies that already run a mature NIST SP 800-171 program can often compress this to four to six months. Companies with a fragmented environment, on-premises systems or many sites usually take longer.

How to shorten your timeline

• Shrink the scope. Put CUI in a separate, well-defined enclave so fewer systems, people and locations are assessed.
• Use FedRAMP Moderate or equivalent cloud services for CUI, and use their customer responsibility matrices to understand which requirements they cover.
• Write the SSP early. The SSP drives everything else, and assessors start from it.
• Fix the big items first. MFA, logging, encryption and incident response take the longest and score the most points.
• Book your C3PAO early. Assessor capacity is limited, and lead times grow as Phase 2 demand increases.
• Collect evidence continuously, so the pre-assessment phase is a review rather than a scramble.

What happens after certification

A Level 2 certification is valid for three years, but the work does not stop. A senior official must submit an annual affirmation that the company continues to meet the requirements, and the environment must be maintained as assessed. Plan for annual internal reviews, continuous monitoring and an updated SSP whenever the environment changes.

Level 1 in practice

Level 1 applies to contractors that handle Federal Contract Information (FCI) but not CUI. It covers the 15 basic safeguarding requirements in FAR 52.204-21, such as limiting system access to authorized users, identifying and authenticating users, sanitizing media, controlling physical access, and keeping malware protection up to date.

A typical Level 1 project for a small company runs like this:

1. Week 1 to 2: identify where FCI is stored, processed and sent, and list the systems and people in scope.
2. Week 2 to 6: check each of the 15 requirements, fix gaps and write short procedures as evidence.
3. Week 6 to 8: complete the self-assessment, enter the result in SPRS and have a senior official affirm it.

Level 1 does not allow open POA&M items, so every requirement must be fully met before you affirm. The self-assessment and affirmation are repeated every year.

Accelerate readiness with SecureSlate

SecureSlate shortens evidence collection and POA&M tracking so remediation and assessment prep run in parallel.

---

FAQ

Can we certify before a contract requires CMMC?

Yes, many organizations certify proactively to avoid award delays when clauses appear.

Does conditional Level 2 count as “done”?

Conditional status may be acceptable per contract rules, but POA&M items must close within allowed timelines, often 180 days.

How long does CMMC Level 2 certification take?

Most small and mid-size contractors need 6 to 12 months from kickoff to certification, depending on their starting point, scope and how quickly they can book a C3PAO.

When is CMMC Level 2 certification required?

From November 10, 2026 (Phase 2), DoD can require Level 2 certification by a C3PAO as a condition of award in applicable contracts. The required level depends on the contract.

How long is a CMMC certification valid?

Level 2 and Level 3 certifications are valid for three years, with an annual affirmation of continued compliance by a senior official.

What slows down CMMC Level 2 projects the most?

The most common delays are an unclear CUI scope, a System Security Plan written too late, slow rollout of MFA and centralized logging, and booking a C3PAO only after remediation is finished. Fixing scope and the SSP first usually saves the most time.

Disclaimer (legal note)

Timelines are illustrative, not guarantees. Your assessor, scope, and contract terms determine actual schedules.