CMMC phase-in timeline: what changes in each phase

CMMC requirements do not switch on all at once. Under 32 CFR 170.3(e), DoD is phasing them into solicitations over four phases. Phase 1 began when the DFARS rule that implements CMMC in contracts took effect on November 10, 2025, and each later phase starts one year after the one before it. During the phase-in, program offices decide which solicitations include a CMMC requirement and at what level, so the solicitation, not the calendar alone, tells you what you need.

The four phases#

Two consequences follow from the table. First, a Level 2 (C3PAO) requirement can appear before Phase 2: DoD kept the discretion to require it in Phase 1. Second, existing contracts are not frozen: option periods are a point where CMMC requirements can be added, and by Phase 4 they apply to options on older contracts too.

How to read a solicitation during the phase-in#

Look for these signals in every DoD solicitation you pursue:

• DFARS 252.204-7025, the notice of CMMC level requirements. It tells offerors which CMMC status is required and that it must be current in SPRS for the information systems that will handle FCI or CUI.
• DFARS 252.204-7021, the contract clause. It requires you to keep that status for the life of the contract and to flow the requirement down to subcontractors that handle FCI or CUI.
• The level and assessment type: Level 1 (Self), Level 2 (Self), Level 2 (C3PAO) or Level 3 (DIBCAC). "Level 2" without the assessment type is not enough information to plan a team.
• Timing: whether the requirement applies at award or only when an option is exercised.
• DFARS 252.204-7012, -7019 and -7020, which continue to apply where CUI is involved: adequate security under NIST SP 800-171, incident reporting, and a current NIST SP 800-171 assessment in SPRS (see assessment currency).

A planning timeline for subcontractors#

There is no single right schedule, but the work runs in a predictable order. Use the target contract's expected RFP date and work backwards:

1. Define the scope. List the contracts you want, the information each involves (FCI, CUI, export-controlled data) and the systems and people that will touch it.
2. Run a gap assessment against the 15 FAR 52.204-21 requirements (Level 1) or the 110 NIST SP 800-171 Rev. 2 requirements (Level 2), and score it with the DoD methodology.
3. Write or refresh the system security plan and remediate the highest-weight gaps first (see SPRS scoring).
4. Book the assessment. Self-assessments are on your schedule; C3PAO assessments depend on assessor availability, and demand rises as each phase takes effect.
5. Post results and affirm in SPRS, then put the annual affirmation and the expiration date on the company calendar.
6. Tell your primes. Update your capability materials and partner profiles with the exact status and dates.

Common pitfalls#

• Waiting for Phase 4. Many solicitations will carry CMMC requirements long before full implementation, and primes are already screening partners for them.
• Assuming Phase 2 means every contract needs a C3PAO. Phase 2 adds Level 2 (C3PAO) for applicable solicitations; plenty of work will still call for Level 1 or Level 2 (Self). Read each requirement.
• Ignoring option periods. An incumbent can face a new CMMC requirement at an option exercise, and a subcontractor without the right status can be dropped from the team mid-contract.
• Treating the phase dates as deadlines for your readiness. They are the dates DoD's intent changes. The deadline that matters is the proposal due date of the contract you want.

How TeamingIndex helps#

• Find partners whose status already meets a future gate: CMMC Level 2 (C3PAO), verified.
• Profiles show each partner's Final or Conditional status, expiration date and affirmation due date, so you can see whether a status will still be current at award.
• Saved searches alert you when new partners meeting your CMMC filter appear, which matters most as assessments ramp up around each phase.
• The Team Builder records the CMMC gate for a pursuit and flags partners that will not meet it.