CMMCDocs.comThe first full year of CMMC implementation is ending, and the defense industrial base is looking ahead to 2026 — the year that Phase 2 brings mandatory third-party assessments to contracts involving prioritized CUI. Here is what we expect and how contractors should prepare.
Phase 2: Mandatory C3PAO Assessments
Phase 2 is expected to begin approximately one year after Phase 1's December 2024 effective date, placing it in late 2025 or early 2026. During Phase 2, the DoD may require CMMC Level 2 C3PAO assessments as a condition of contract award for solicitations involving prioritized CUI. This means contractors bidding on these contracts must hold a current CMMC Level 2 certification from an accredited C3PAO.
The transition from self-assessment to third-party assessment is the most significant change in the CMMC rollout. Self-assessments allow contractors to evaluate themselves. Third-party assessments bring independent verification by trained assessors who will examine your controls, interview your personnel, review your evidence, and determine whether your implementation meets the standard.
C3PAO Capacity Concerns
The single biggest risk for Phase 2 is C3PAO capacity. The current pool of authorized C3PAOs, while growing, may not be sufficient to handle the volume of assessments that Phase 2 will trigger. Contractors who wait until Phase 2 is active to engage a C3PAO may find scheduling delays of six months or more. Those who engaged C3PAOs early and completed voluntary assessments during Phase 1 will have a significant competitive advantage.
Expected Contract Activity
During Phase 2, expect to see the CMMC clause (DFARS 252.204-7021) appearing in a growing number of solicitations. Program offices that have been waiting for the assessment infrastructure to mature will begin exercising the clause. Contracts that previously required only self-assessment may be recompeted with C3PAO assessment requirements. Prime contractors will increasingly require subcontractor CMMC certification as a teaming prerequisite.
NIST 800-171 Rev 3 Transition
2026 may also bring clarity on the timeline for transitioning CMMC from NIST 800-171 Rev 2 to Rev 3. The DoD has indicated that a transition will occur but has not published a specific date. A rulemaking process is required, which typically takes 12-18 months from proposed rule to effective date. Watch for announcements from the DoD CIO and the Cyber AB.
How to Prepare
If you are Phase 2 ready: Ensure your certification is current, maintain your annual affirmation, keep your evidence fresh, and be prepared for prime contractor verification requests.
If you are still working toward readiness: Accelerate. Close remaining POA&M items, engage a C3PAO for a pre-assessment or gap assessment, finalize your evidence collection, and schedule your assessment as early as possible.
If you have not started: You have a narrow window. CMMC Level 2 compliance from zero typically takes 12-18 months. Begin immediately with a scoping exercise, gap assessment, and SSP development. Consider engaging a compliance platform and consulting support to compress the timeline.
The Competitive Landscape
CMMC certification is becoming a competitive differentiator, not just a compliance requirement. Certified contractors are winning work over non-certified competitors. Prime contractors are building teaming arrangements with certified subcontractors. The contractors who invested early in CMMC readiness are now seeing the return on that investment in contract awards and partnership opportunities. 2026 will accelerate this trend.