When Will CMMC Assessments Be Required for Department Contracts?

What This Means for Your Business

If your organization holds or is pursuing Department of Defense contracts, CMMC assessment requirements are already in effect as of November 10, 2025. This is not a future requirement — it's happening now.

The Phased Implementation Timeline

The DoD is rolling out CMMC requirements in four phases:

• Phase 1 (Nov 2025 - Nov 2026): Self-assessments for CMMC Level 1 and Level 2 are required in applicable solicitations. This is the current phase.
• Phase 2 (Nov 2026 - Nov 2027): Third-party assessments (C3PAO) become required for CMMC Level 2 contracts involving CUI.
• Phase 3 (Nov 2027 - Nov 2028): Level 3 assessments (DIBCAC-led) begin for contracts requiring enhanced security.
• Phase 4 (Nov 2028+): Full implementation — all applicable DoD contracts require the specified CMMC level.

Key Actions to Take Now

Even during Phase 1, contractors should not wait. The self-assessment process requires documenting your System Security Plan (SSP), completing a NIST SP 800-171 assessment, and entering your score into the Supplier Performance Risk System (SPRS). Organizations that delay preparation risk being unable to bid on contracts when third-party assessments become mandatory in Phase 2.

Additionally, the annual affirmation requirement means your organization must confirm continued compliance every year after your initial assessment. This is not a one-time activity — it's an ongoing obligation under 32 CFR Part 170.