32 CFR 170.3(e) · verified against primary sources June 2026
CMMC Phase 2 begins November 10, 2026
The day C3PAO-assessed Level 2 becomes the default for DoD contracts involving CUI. Not a single cliff — a rollout. Here's the honest version.
Counting down to Nov 10, 2026, midnight Eastern. No delay has been announced as of June 2026.
The honest part: it's a rollout, not a cliff
Nothing expires on November 10, 2026. What changes is the default: from that date, contracting officers can — and increasingly will — require a CMMC Level 2 certification (a third-party C3PAO assessment, not just your self-assessed SPRS score) as a condition of award on contracts involving CUI.
The requirement lands per-solicitation, at contracting-officer discretion, spreading across new solicitations from 2026 through full implementation in 2028. That's better news than a cliff in one way: not every bid on November 11 will demand certification. And worse news in another: you can't predict which solicitation will carry it first — the award you actually need next year might.
That uncertainty is exactly why readiness can't wait for a solicitation to force the issue: by then, the assessor queue is the timeline, and it's measured in months.
The full CMMC phase-in
| Phase | Starts | What changes |
|---|---|---|
| Phase 1 | Nov 10, 2025 — live now | CMMC self-assessment requirements appear in new DoD solicitations (DFARS 252.204-7021). |
| Phase 2 | Nov 10, 2026 | C3PAO-assessed Level 2 becomes the default for contracts involving CUI — applied per-solicitation at contracting-officer discretion. |
| Phase 3 | 2027 | The phase-in continues ahead of full implementation. |
| Phase 4 | 2028 | Full implementation across DoD contracting; certifications then run on 3-year re-certification cycles. |
Source: 32 CFR 170.3(e); DFARS 252.204-7021 (final rule effective Nov 10, 2025).
What to do now
Know your real number today
Run the free assessment: a 20-minute quick estimate or the full 110-requirement self-assessment, computed with the exact DoD methodology — weighted deductions, partial credit, the works.
Fix what can't sit on a POA&M
Conditional Level 2 status needs a score of at least 88 with every open gap POA&M-eligible — and some gaps never qualify. The SSP (3.12.4) gates everything: without one, no assessment can be completed at all. Start there.
Get assessor-ready before demand spikes
C3PAO waitlists already run 6–9 months. Draft your SSP and POA&M from your own answers now, close the must-fix gaps, and get in the queue while 2026–2027 calendars still have slots.
Straight answers
Is November 10, 2026 a hard deadline for every defense contractor?
No. November 10, 2026 starts CMMC Phase 2, when C3PAO-assessed Level 2 becomes the default for DoD contracts involving CUI. Contracting officers apply it solicitation by solicitation, so the requirement reaches different contractors at different times through full implementation in 2028. You cannot predict which of your bids will carry it first — that is the real risk.
Has the CMMC Phase 2 date been delayed?
No. As of June 2026 the November 10, 2026 date stands, per 32 CFR 170.3(e) and the DFARS rule that took effect November 10, 2025. Phase 1 — CMMC self-assessment requirements in new solicitations — has been live since November 10, 2025.
What actually changes when Phase 2 starts?
Phase 1, live since November 10, 2025, put CMMC self-assessment requirements into new DoD solicitations. From November 10, 2026, Phase 2 makes C3PAO-assessed Level 2 the default for contracts involving CUI — new solicitations can require third-party certification, not just a self-assessed SPRS score, as a condition of award.
What happens if a solicitation requires Level 2 certification and I do not have it?
Certification becomes a condition of award: without it — or conditional status, which requires an assessment score of at least 88 of 110 with every open gap POA&M-eligible and closed within 180 days — you are not eligible for that award. With C3PAO waitlists running 6–9 months, waiting until a solicitation forces the issue usually means missing it.
The countdown is the same for everyone. The queue isn't.
Twenty minutes from now you can know your estimated SPRS score and exactly which gaps stand between you and assessment-ready.
Start the free assessment