CMMC Key Dates & Compliance Clocks

Reference

The dates that govern CMMC and DFARS obligations - the fixed calendar and the recurring clocks. Verified against 32 CFR Part 170 and the 48 CFR CMMC acquisition rule, and the July 13, 2026 Phase 2 suspension (memo 26-P-1023) - July 14, 2026. Dates in regulation can move; this page is updated when they do.

The fixed calendar

2017-12-31 DFARS 252.204-7012 full-implementation deadline - NIST SP 800-171 became the contractual baseline for covered defense information.

2020-11-30 DFARS 252.204-7019/-7020 interim rule effective - self-assessment scores required in SPRS before award.

2024-12-16 32 CFR Part 170 effective - the CMMC Program rule becomes law.

2025-11-10 48 CFR rule effective - DFARS 252.204-7021 begins appearing in solicitations. Phase 1: self-assessment requirements.

2026-07-13 Phase 2 suspension - DoW suspends the Phase 2 transition and pending CMMC milestones (memo 26-P-1023) pending a 60-day Reform Task Force review, report due ~mid-September 2026. Phases 3-4 below inherit the suspension until post-review guidance. Analysis.

2026-09 FIPS 140-2 certificates move to Historical status on the CMVP list - why that matters for FileVault evidence.

2026-11-10 Phase 2 was scheduled to begin - suspended July 13, 2026, before taking effect: C3PAO and DIBCAC certification requirements may not be designated during the DoW program review. What changed.

2027-11-10 Phase 3 begins - Level 3 certification requirements phase in for applicable programs.

2028-11-10 Phase 4 - full implementation: CMMC requirements in all applicable DoD solicitations and contracts.

The recurring clocks

3 years CMMC certification validity - a Level 2 certificate stands for three years from the assessment decision.

Annual Affirmation - a senior official affirms continuing compliance in SPRS every year, including within the three-year certificate window.

Annual Level 1 self-assessment cadence for FCI-only scopes.

180 days POA&M closeout - conditional certification requires closing eligible NOT MET items within 180 days.

The November 10, 2026 Phase 2 clock is suspended - but the standard it enforced is not. The free readiness pack builds the 30-60-90 plan, and the Suite is the documentation system behind it. Companion references: the acronym glossary, the controls list, the ecosystem map, and the DFARS clause guide - or browse the full reference shelf.