On November 10, 2025, the DoD's CMMC phased rollout began. We are six months in, and most subcontractors barely felt it. Phase 1 lets contracting officers require self-assessments at their discretion, and adoption has been uneven. That changes on November 10, 2026.
The phased rollout, in plain English
The CMMC final rule splits implementation across four phases over three years. Each phase tightens the requirement.
| Phase | Start | What changes |
|---|---|---|
| Phase 1 | November 10, 2025 | Self-assessments (Level 1 and Level 2) may be required on a per-contract basis. |
| Phase 2 | November 10, 2026 | C3PAO third-party certification required for Level 2 contracts handling CUI. |
| Phase 3 | November 10, 2027 | DIBCAC-led Level 3 assessments begin for the highest-risk programs. |
| Phase 4 | November 10, 2028 | Fully phased in. All applicable DoD contracts include CMMC requirements. |
If you handle CUI, your Phase 2 deadline is now under six months away.
Still on the fence? See it on your data.
30 minutes, live screen-share against your real SSP or POA&M. No slides, no card on file.
Book a demo
What actually changes on November 10, 2026
Two things, mostly.
Certifications stop being optional for Level 2. Today, primes can ask for a Level 2 self-assessment. Starting Phase 2, contracts that involve CUI will require a Level 2 certification performed by a CMMC Third-Party Assessor Organization (C3PAO). You cannot self-attest your way through this one.
The C3PAO bottleneck hits. Fewer than 100 C3PAOs are authorized as of writing. The DoD has been candid that supply will lag demand for at least the first 18 months of Phase 2. Contractors who wait until they have a contract to start scheduling a certification will lose bids to those who already have one.
What this means for a small DoD subcontractor
If you are a sub with 5 to 50 employees, here is the brutal version:
- If you bid on contracts involving CUI, the bid sheet starts asking for proof of certification, not a checkbox.
- The C3PAO calendar fills fastest in October through December every year. The right time to schedule was last quarter. The next-best time is now.
- A Level 2 readiness gap takes most contractors 4 to 9 months to close. That number is from observation, not from a brochure.
What to do in the next six months
Most posts on this topic list twenty-seven actions. We will list four.
- Inventory CUI. You cannot scope a Level 2 boundary if you do not know which systems touch CUI. The single highest-leverage thing you can do this quarter is finish that inventory.
- Pick your assessment scope. A smaller, well-fenced scope passes faster and costs less than a sprawling enterprise scope. Most subs benefit from a dedicated CUI enclave.
- Write your SSP and POAM. If you do not have a System Security Plan and a Plan of Action & Milestones, your C3PAO conversation cannot start. These are the two artifacts a C3PAO asks for first.
- Get on a C3PAO calendar. Even a tentative slot 6 to 9 months out is worth more than a confident "we will do it later."
Where Readyline fits
We built Readyline because most CMMC software is sold to primes with seven-figure budgets, not to subs with twenty employees and a November 2026 deadline. Our platform is built around the four steps above:
- A CUI scoping wizard that produces a defensible boundary in an afternoon.
- SSP and POAM generation tied to your actual control implementations, not generic templates.
- A POAM tracker that does not require a consultant to maintain.
- Air-gapped and on-prem deployment for contractors who cannot send CUI to a public cloud.
If November 10 has a date on your calendar, we are happy to walk through your scope on a 30-minute call. Book a demo.
Ready to ship CMMC?
L1 for subcontractors, L2 for primes, L3 for enterprise. Same tenant, transparent pricing.
See plans
