CMMC deadline: the dates that bind your shop today
Published 2026-10-23, 9 min read
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Contracts may require CMMC Level 1 (Self) or Level 2 (Self): your own assessment, scored and entered in SPRS, with a senior official's affirmation. Class Deviation 2026-O0025 Rev 3; 32 CFR 170.15, 170.16
- The CMMC rule itself, 32 CFR Part 170, is unchanged since it took effect on 2024-12-16. eCFR, 32 CFR Part 170
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Existing contracts that carry CMMC requirements have them removed at the next option period or the next scheduled administrative modification. Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
- DoD's 2026 Regulatory Plan lists an interim final rule amending 32 CFR Part 170 (RIN 0790-AM01) to set a deadline and transition from NIST SP 800-171 Rev 2 to Rev 3. It was timetabled for July 2026 and has not been published as of 2026-10-23. 91 FR 52824
- Class Deviation 2026-O0025, Revision 3 (DFARS part 240), read 2026-10-23
- DFARS 252.204-7012, -7019, -7020, -7021 (acquisition.gov), read 2026-10-23
- 32 CFR Part 170 (eCFR), read 2026-10-23
- Federal Register 2026-16603, 2026 Regulatory Plan (RIN 0790-AM01), read 2026-10-23
- Federal Register: CMMC documents, read 2026-10-23
Your deadline, by situation
There is no single CMMC deadline. There is the date a clause in your own contract set, and the date a solicitation you want to bid on will check. Find the row that describes your shop; most shops that hold CUI are in the first row and one of the next three.
| If your shop | Deadline | What is due | Today |
|---|---|---|---|
| You hold CUI under a contract with DFARS 252.204-7012 | 2017-12-31, passed | NIST SP 800-171 was due “not later than December 31, 2017”. Every cyber incident is reported within 72 hours of discovery. 7012(b)(2)(ii)(A), (c) | Already due |
| A solicitation asks for Level 1 (Self) | Before award | Status and an affirmation in SPRS before the contract is awarded, then a new self-assessment and affirmation every year. 32 CFR 170.15(b) | In force |
| A solicitation asks for Level 2 (Self) | Before award | A Conditional or Final status and an affirmation in SPRS before award. A Conditional status has 180 days to close its POA&M. 32 CFR 170.16(b), 170.21(b) | In force |
| Your contract comes up for an option or an extension | Before the option | The contracting officer checks SPRS for a current status at the required level before exercising it. DFARS 240.371-4, deviated | In force |
| You were waiting for a Level 2 (C3PAO) requirement | No date | Phase 2 was due in November 2026 and is suspended for every contractor. No new date has been set. The Cyber AB says C3PAO Level 2 assessments remain available if you want one now. Class Deviation 2026-O0025 Rev 3 | Suspended |
| Your contracts carry no CMMC clause yet | 2028-11-10 | Until 2028-11-09 the clause goes only where the program office requires a specific level; from 2028-11-10, any contract whose systems hold FCI or CUI. DFARS 240.371-5(a), deviated | As deviated |
The first row surprises people. The "CMMC deadline" most shops worry about is the assessment, but the security work it checks has been owed since 2017 under the clause already in their contracts. The DFARS 252.204-7012 guide walks through what that clause asks, and the level finder tells you which row a contract puts you in.
The schedule as Part 170 wrote it
The CMMC rule does not print a single calendar date for its phases. It ties Phase 1 to another rule's effective date and counts every later phase from the one before. That is why you will see the dates quoted differently: they are arithmetic, not text.
The 48 CFR rule is the DFARS CMMC rule. Phase 1 began on 2025-11-10, when the DFARS CMMC rule took effect, so the rule as written puts Phase 2 on 2026-11-10, Phase 3 on 2027-11-10 and Phase 4 on 2028-11-10. The last two are arithmetic on the rule's text; with Phase 2 suspended, neither is confirmed. The chart shows those dates against where each phase stands today.
Phase 1
2025-11-10
In force. Level 1 (Self) or Level 2 (Self) in new contracts
Phase 2
2026-11-10
Suspended. Adds Level 2 (C3PAO); Level 3 at DoD's discretion
Phase 3
2027-11-10
Not confirmed. Level 2 (C3PAO) on all applicable contracts
Phase 4
2028-11-10
Not confirmed. Full implementation, older contracts' options too
7021, deviated
2028-11-10
As deviated. Clause on any contract with FCI or CUI
Dashed mark: status as of 2026-10-23. Filled bar: in force. Outlined: as written, not in force. Tinted: set by the deviation.
Two things in the chart matter for planning. Phase 1 is the only phase in force, and it is the one that asks for self-assessments. And the 2028-11-10 date in the bottom row comes from the class deviation, not from Part 170: from that day the deviated clause prescription reaches any contract whose systems process, store or transmit FCI or CUI. It falls on the same day Phase 4 would have begun as written.
Part 170 has not been amended since it took effect on 2024-12-16, so the arithmetic above is still the rule's text. What moved is what contracts ask for. Every dated event behind that, from the proposed rule to the deviation's third revision, is in the program log on CMMC status today; this page stays on the dates you have to meet.
The clocks that still run
The suspension paused one requirement: the third-party certification. It did not stop any clock that a clause or a status you already hold has started. These are the periods a small shop keeps on its calendar, each with the event that starts it.
CMMC deadline cheat sheet, cuideck.com
| Clock | Starts at | Length | Rule |
|---|---|---|---|
| DFARS 252.204-7012, in your contract today | |||
| Report a cyber incident to DoD | Discovery of the incident | 72 hours | 7012(a), (c) |
| Keep images and packet capture data of affected systems | The incident report | At least 90 days | 7012(e) |
| CMMC status in SPRS (32 CFR 170, DFARS 252.204-7021) | |||
| Close out a Conditional status's POA&M | Conditional CMMC Status Date | 180 days | 170.21(b) |
| Affirm in SPRS | Each assessment and POA&M closeout | Then every year | 170.22(a); 7021(a) |
| Repeat a Level 1 (Self) assessment | CMMC Status Date | 1 year | 170.15(a)(1); 7021(a) |
| Repeat a Level 2 (Self) or (C3PAO) assessment | CMMC Status Date | 3 years | 170.16(a)(1), 170.17(a)(1) |
| Keep the assessment evidence | CMMC Status Date | 6 years | 170.15(c)(2), 170.16(c)(4) |
| Codified DFARS 7019 / 7020, in contracts that still carry them | |||
| Keep a current Basic Assessment score in SPRS | Date of the assessment | Not more than 3 years old | 7019(b); 7020 |
Counted from the event, not from the calendar year.
The incident clock is the one that bites without warning: 72 hours from discovery, and the report needs a DoD-approved medium assurance certificate, which is worth having before the day you need it. The 7012 guide covers the report itself; the POA&M guide explains what may sit on the 180-day plan and what may not.
Work out your own dates
Every CMMC clock starts from one date: the CMMC Status Date, the day your result went into SPRS. Enter it below with the status you hold, and the helper lists each date that status sets, counted from today.
My CMMC dates, cuideck.com
CMMC dates from your status date
One rule catches people out after a POA&M closeout: the date does not move. The date of the Conditional CMMC Status will remain as the CMMC Status Date after a successful POA&M closeout, so the three years and the yearly affirmations still count from the day you first entered the Conditional result. The helper counts that way. To check whether a score or affirmation is current on a bid or option date, the DFARS 7019 and 7020 guide has a checker for exactly that; to rebuild the score, use the SPRS score calculator.
Dates nobody has set yet
Three dates a bid team would like to know do not exist yet. When third-party Level 2 assessments come back into contracts has no date: the deviation remains in effect until rescinded or incorporated into the FAR, DFARS and DFARS PGI. The CMMC Reform Task Force has published no outcome. And DoD's 2026 Regulatory Plan lists an interim final rule to move Part 170 from NIST SP 800-171 Rev 2 to Rev 3; it was timetabled for July 2026 and has not been published. The "Not yet known" lines in the status box at the top carry the date we last checked each.
A shop that waits for those dates before starting is betting that the work will be easier to do in a hurry. It will not be: whatever a later rule asks, DoD binds NIST SP 800-171 Rev 2 today, and every self-assessment you enter in SPRS is scored against it. Any page that gives you a date for the return of Phase 2 is guessing; we update the status page the day a primary source sets one.
Questions about CMMC deadlines
Is there a CMMC deadline in November 2026?
Not any more. Phase 2 was due on 2026-11-10, one year after Phase 1 began, and it is suspended. The November date you see in older articles was the start of third-party Level 2 (C3PAO) requirements in contracts, and no new date has been set. Contracts may still require Level 1 (Self) or Level 2 (Self).
When do I need CMMC Level 2 certification?
Only when a contract asks for Level 2 (C3PAO), and new contracts are not adding it while Phase 2 is suspended. A Level 2 (Self) requirement is different: it needs your own assessment and an affirmation in SPRS before award. A self-assessment gets no certificate. If you want one before any contract asks: The Cyber AB said on 2026-07-15 that only the Phase 2 requirements were suspended and that C3PAO Level 2 certification assessments remain available. The class deviation is silent on voluntary assessments, so ask the C3PAO what it is booking now and what status it will enter in eMASS. What is a C3PAO? explains the third-party route.
Does the suspension give me more time for NIST SP 800-171?
No. DFARS 252.204-7012 required NIST SP 800-171 “as soon as practical, but not later than December 31, 2017”, and that clause still applies. The suspension changed which assessment a contract asks for, not whether the requirements are owed.
What happens if I miss the 180-day POA&M closeout?
The Conditional status expires. Inside a contract's period of performance, standard contractual remedies apply, and you are ineligible for new awards at that level or higher, for the systems in that scope, until you hold a new status. That is why the helper puts the closeout date first.
Do my subcontractors have the same deadlines?
Their level depends on what they handle: a subcontractor that holds only FCI needs Level 1 (Self), one that holds CUI needs Level 2 (Self) at minimum. Each organization's own Affirming Official affirms in SPRS, prime or subcontractor, so each one keeps its own clock. CMMC for small businesses covers the flow-down from the subcontractor's side.