For years, most defense contractors met their cyber requirements by attesting to them — checking the box in SPRS and moving on. CMMC Phase 2, which begins November 10, 2026, is where that starts to end for companies handling CUI. It's the point at which a Level 2 third-party certification begins appearing as an actual condition of award. Here's what the date means and how to be ready.
The phased rollout at a glance
CMMC doesn't switch on all at once. It rolls out over four phases, each one year apart, with the requirement biting harder at every step:
| Phase | Begins | What it introduces |
|---|---|---|
| Phase 1 | Nov 10, 2025 | Level 1 & Level 2 self-assessment as a condition of award on applicable contracts |
| Phase 2 | Nov 10, 2026 | Level 2 C3PAO certification begins appearing in applicable solicitations |
| Phase 3 | Nov 10, 2027 | Level 2 and Level 3 certification requirements expand further |
| Phase 4 | Nov 10, 2028 | Full implementation across applicable DoD contracts and options |
The underlying 48 CFR (DFARS) acquisition rule took effect November 10, 2025, which started the clock; the contractual requirement (DFARS 252.204-7021) phases in from there.
What Phase 2 actually triggers
On and after November 10, 2026, the Department of Defense can begin including a Level 2 C3PAO certification requirement in applicable solicitations and contracts that involve CUI. In plain terms: for a growing set of CUI work, attesting to your own compliance is no longer enough — a Certified Third-Party Assessment Organization has to verify it before you can be awarded the contract.
The self-attestation era is closing
This is the strategic shift. Through Phase 1, a CUI contractor could self-assess and affirm. From Phase 2 onward, third-party certification steadily becomes the price of entry for CUI work, with full implementation by Phase 4 in 2028. The contractors who treat the 2026 date as their planning horizon — not their starting line — are the ones who won't get caught flat-footed.
What to do before November 10, 2026
Work backward from the date. A C3PAO assessment isn't something you book the week you need it — assessor capacity is limited and the queue is real. A sensible runway:
- Confirm your data type. If you handle CUI, you're Level 2. Not sure? See do I need CMMC.
- Self-assess against the 110 controls. Calculate your SPRS score to find your gaps and your number.
- Document. Stand up your SSP and a POA&M for anything not yet met.
- Remediate the high-impact gaps first. Start with the 5-point controls that move your score most.
- Get in the assessor queue early if you expect to need certification — don't wait for a contract to force the timeline.
Start your Phase 2 readiness — free
The first move is knowing exactly where you stand against the 110 controls. Our free calculator gives you a SPRS score and a prioritized gap list in minutes — no signup, runs in your browser.
Calculate your SPRS score free →CMMC Phase 2 — frequently asked
When does CMMC Phase 2 start?
November 10, 2026 — one year after Phase 1. It's when Level 2 C3PAO certification begins appearing as a condition of award in applicable CUI solicitations.
Does Phase 2 require a C3PAO for every contract?
No. The requirement phases into new and renewing applicable contracts at the Department's discretion. Some lower-risk CUI contracts still allow self-assessment — but the direction is toward third-party certification, fully implemented by Phase 4 in 2028.
What's the full rollout timeline?
Phase 1 (2025) self-assessments; Phase 2 (2026) Level 2 certification begins; Phase 3 (2027) Level 2/3 expand; Phase 4 (2028) full implementation.
What should I do before the deadline?
Confirm you handle CUI, self-assess against the 110 controls, document your SSP and POA&M, post your SPRS score, and get in the assessor queue early if you'll need certification.
Get ahead of the date
Phase 2 rewards preparation and punishes procrastination. Find your starting point now: calculate your SPRS score, build your plan with the free SSP generator, and read up on the self-assessment vs C3PAO decision so you know which path your contracts will demand.