Plain-English timeline guide · primary sources
How long does CMMC Level 2 certification take?
CMMC Level 2 certification typically takes 12–24 months: about 2–6 months for a gap assessment, 3–6 months for remediation, and 3–5 months for C3PAO scheduling and assessment. Contractors already following NIST SP 800-171 can compress this to 6–9 months; those starting from scratch should budget 18–24 months. With Phase 2 beginning November 10, 2026, contractors aiming for 2027 awards must start now.
The phases, and how long each takes
| Phase | Typical duration | What happens |
|---|---|---|
| Gap assessment | 2–6 months | Scope your environment, walk the 110 NIST SP 800-171 requirements, and compute an honest SPRS score against the DoD methodology. The output is your delta to a passing posture and the System Security Plan (SSP) skeleton that everything else hangs off. |
| Remediation | 3–6 months | Close the gaps: implement controls, write policies and procedures, finish the SSP, and build a POA&M for anything eligible to defer. This is the heaviest lift and the most variable — it scales with how far below 110 you start and how much of your stack must change. |
| C3PAO booking / waitlist | 6–9 months (queue) | Get on an authorized C3PAO’s schedule. With only 103 authorized C3PAOs (Apr 2026) and a long demand backlog, scheduling waitlists are commonly reported at 6–9 months — so you book the slot while remediation is still underway, not after. |
| The assessment | 3–5 months | The C3PAO assessment itself plus scheduling lead time: evidence review, interviews, testing, and the final scoring decision. Plan for findings — almost no first assessment is spotless — and the back-and-forth to resolve them. |
| Conditional closeout (≤ 88 path) | up to 180 days | If you score ≥ 88 with only 1-point items left on a POA&M, you can earn a Conditional Level 2 and have 180 days to close those items for a Final certification (32 CFR 170.21). Below 88, or with higher-weight gaps open, you do not pass — you remediate and re-assess. |
These durations are typical practitioner estimates, not regulatory deadlines — your actual timeline depends on your starting score and scope. The one number you least control is the C3PAO queue: with only 103 authorized C3PAOs (April 2026) and roughly 1% of obligated companies certified so far, the waitlist (commonly 6–9 months) is the real wildcard. Book your assessment in parallel with remediation, not after it.
Where you land on the 12–24 month range
The spread is driven almost entirely by your starting point. Already operating to NIST SP 800-171 — a real SSP, controls implemented, an honest SPRS score in the 90s — and remediation is light, so the whole path can compress to roughly 6–9 months. Starting from scratch, with controls to stand up and policies to write, and you should budget 18–24 months. Either way, the C3PAO scheduling queue runs on its own clock; the contractors who finish fastest are the ones who get on a schedule early and let the waitlist run concurrently with their remediation work.
One hard gate sits before any of this: the SSP. Requirement 3.12.4 is unscored but mandatory — no SSP, no assessment (32 CFR 170.24). You start at 110 points and subtract for gaps, and a score of ≥ 88 with only 1-point items left on a POA&M can earn a Conditional Level 2 with a 180-day window to reach Final (32 CFR 170.21). Knowing your number before you spend a dollar on remediation is the whole point of the SPRS calculator.
Sources: 32 CFR part 170 (170.21 conditional Level 2; 170.24 SSP requirement); CMMC phase rollout under 32 CFR 170.3(e). Capacity figures: 103 authorized C3PAOs (April 2026); 1,391 final Level 2 certifications and 140 assessments in progress as of May 2026; roughly 1% of an estimated 76,600–80,000 obligated companies certified (GAO via cmmc.com, March 2026). For budgeting alongside the schedule, see the CMMC Level 2 cost guide and the Phase 2 deadline.
Straight answers
Can I speed up CMMC Level 2 certification?
Yes, within limits. If you are already operating to NIST SP 800-171 — a real SSP, controls implemented, an honest SPRS score in the 90s — you can compress the whole path to roughly 6–9 months because remediation is light. Starting from scratch, budget 18–24 months. What you cannot fully control is the C3PAO queue: book your assessment slot early, in parallel with remediation, so the waitlist runs concurrently rather than tacking 6–9 months onto the end. These are typical practitioner estimates, not regulatory deadlines.
How long is the C3PAO waitlist?
Scheduling waitlists are commonly reported at 6–9 months and are the single biggest wildcard in your timeline. The math is structural: only 103 C3PAOs were authorized as of April 2026, and as of May 2026 just 1,391 final Level 2 certifications had been issued against roughly 76,600–80,000 obligated companies — about 1% certified. Demand far exceeds assessor capacity, so the queue, not your own remediation, often sets your finish date. Get on a schedule as early as you reasonably can.
Does a SPRS self-assessment buy me time?
Yes. CMMC Phase 1 has been live since November 10, 2025, so new DoD solicitations can already require a current NIST SP 800-171 self-assessment with the score posted to SPRS. Posting an honest score lets you bid and win now while you prepare for the Phase 2 C3PAO requirement that begins November 10, 2026. Treat the self-assessment as both a bidding credential today and a head start on the third-party assessment you will need next.
When do I need to start for a 2027 award?
Now. Phase 2 begins November 10, 2026, after which a C3PAO-assessed Level 2 becomes the default for new contracts involving CUI, applied per-solicitation at contracting-officer discretion (32 CFR 170.3(e)). If you want to be eligible for 2027 awards and you are starting from scratch, a 12–24 month path plus a 6–9 month assessment queue means the runway is already tight. Contractors aiming for 2027 should be in a gap assessment today.
Timeline figures here are typical practitioner estimates, not regulatory deadlines; the only fixed date is Phase 2 beginning November 10, 2026. This is compliance information, not legal advice. Only an authorized C3PAO can certify you — Muster helps you prepare and drafts the documentation you review and attest to. For contract-eligibility questions, consult qualified counsel.
Related guides
How to submit your SPRS score
The step-by-step PIEE → SPRS submission walkthrough, the email alternative, and why the score you post is a representation to the government you have to stand behind.
What counts as CUI?
What CUI actually is for a defense contractor — technical data, drawings, export-controlled material — the three questions everyone asks, CUI vs. classified, and what to do when you receive it.
NIST 800-171 SSP template
What an SSP must contain per 3.12.4, what assessors flag first, and a free blank template (Markdown or Word) — no email gate.
POA&M template (NIST 800-171)
The 32 CFR 170.21 eligibility rules — 88-point minimum, the never-eligible six, the 180-day clock — plus a worked example and a free blank template.
Tools: SPRS score calculator · scoring methodology · CMMC Phase 2 deadline
The clock starts when you know your gap.
Get an honest SPRS score in your browser today, and you will know whether you are looking at a 6–9 month sprint or an 18–24 month build before you spend a dollar on remediation.
Get your free Muster ScoreThe free score is live now. Join the waitlist for early access to the done-for-you Level 2 Readiness Sprint and founding-cohort pricing.