CMMC Key Dates & Compliance Clocks

CMMC: the dates that are actually operative

Program status as published, not as commonly reported. The program phase was suspended on 13 July 2026. The acquisition regulation behind it was not. Verified against primary sources on 13 August 2026.

1. 31 Dec 2017 In force DFARS 252.204-7012 full-implementation deadline NIST SP 800-171 became the contractual baseline for covered defense information. Still the floor under everything that followed. DFARS 252.204-7012.
2. 30 Nov 2020 In force DFARS 252.204-7019 and 7020 take effect The interim rule: a current self-assessment score in SPRS became a condition of award, and the Government reserved the right to run medium and high assessments. DFARS interim rule, effective 30 Nov 2020.
3. 16 Dec 2024 In force 32 CFR Part 170 takes effect The CMMC Program rule. Levels, assessment types, POA&M rules and the SPRS scoring method all originate here. Final rule published 15 Oct 2024, effective 16 Dec 2024.
4. 10 Nov 2025 In force The acquisition rule takes effect 48 CFR Subpart 204.75. This is what puts CMMC into a solicitation, through clauses 252.204-7021 and 252.204-7025. A contracting officer may not award to an offeror without a current CMMC status. DFARS Case 2019-D041, published 10 Sep 2025, effective 10 Nov 2025.
5. 13 Jul 2026 Suspended Phase 2 requirements suspended Immediate, with no stated end date. In the interim the Department enforces NIST SP 800-171 Rev 2 through self-assessment and select government-led assessments. Phase 1 self-assessment obligations remain in effect, and existing contractual obligations to protect covered defense information are unchanged. Department of War release and memo 26-P-1023, 13 Jul 2026. Our analysis.
6. 14 Aug 2026 Comment closes Two comment windows close on the same day The CMMC reform Request for Information, and separately the public draft of NIST SP 800-219 Rev 2, the publication that documents the macOS Security Compliance Project. Mac fleets have a stake in both. RFI per the 13 Jul 2026 release. SP 800-219r2 draft open 22 Jun to 14 Aug 2026. How to submit a comment that gets used.
7. ~11 Sep 2026 Derived date CMMC Reform Task Force report due The task force was given a 60 day mandate to deliver a final report. This date is 60 days from the suspension and is calculated, not published. Treat it as a window, not a deadline. Derived from the 13 Jul 2026 release. No date published.
8. 22 Sep 2026 Transition FIPS 140-2 certificates move to the Historical list The day after the last day of acceptance. This lands differently on Mac fleets than on Windows fleets, because the validation status of the client-side modules differs by platform and by silicon. CMVP. Re-verify in the week of the date; certificate status is perishable. Why this matters for FileVault evidence.
9. 10 Nov 2026 No longer operative Original Phase 2 start date Superseded by the 13 July 2026 suspension. Shown because a great deal of published guidance, and a great many internal plans, still count down to it. Superseded. What changed.
10. 10 Nov 2027 On hold Phase 3 scheduled start Level 3 certification requirements were to phase in for applicable programs. The phase schedule inherits the 13 July 2026 suspension pending the review outcome. 32 CFR 170 phasing; suspension per the 13 Jul 2026 release.
11. 9 Nov 2028 In force Last day of the narrower clause trigger Until this date, 252.204-7021 applies when the program office or requiring activity determines that a specific CMMC level is required. 48 CFR 204.7503, current text.
12. 10 Nov 2028 Scope widens The clause trigger broadens to any FCI or CUI handling From this date, 252.204-7021 applies whenever a contractor will use contractor information systems to process, store or transmit FCI or CUI. This was also Phase 4, full implementation, in the original schedule, now subject to the review. Either way, this is the date that pulls in companies who assumed CMMC was somebody else's problem. 48 CFR 204.7503, current text.

Reading this correctly: the suspension paused a program phase. It did not repeal 32 CFR 170, and it did not touch the acquisition rule that puts CMMC clauses into contracts. Rev 2 self-assessment is the standard being enforced today.