From 10 November 2026, applicable DoD solicitations move from a self-assessment to a Level 2 certification assessment. If you hold CUI and have been waiting, the waiting is over.
CMMC applies to contractors and subcontractors that process, store or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). The programme rule and the acquisition rule are both final, and the requirement is phasing into contracts on a published timetable.
What is the CMMC timetable?
| Phase | When | What applicable solicitations require |
|---|---|---|
| Phase 1 | from 10 November 2025 | Level 1 or Level 2 self-assessment, where the requirement applies |
| Phase 2 | from 10 November 2026 | Level 2 certification assessment, where the requirement applies |
| Phase 3 | the following year | Level 3 certification requirements begin to appear |
| Phase 4 | from 10 November 2028 | all applicable solicitations and contracts carry a CMMC requirement |
The dfars acquisition rule (48 cfr, dfars case 2019-d041) took effect on 10 November 2025, following the CMMC Program rule (32 CFR), published in the Federal Register on 15 October 2024. CMMC status has to be posted in the Supplier Performance Risk System (SPRS).
What does Phase 2 change?
Phase 1 allowed a self-assessment for Level 1 and Level 2 where the requirement applied. Phase 2 requires a Level 2 certification assessment instead — assessed by a third party rather than by you. The practical consequence is lead time: assessment capacity is finite and the queue is not short.
Where does training fit?
An assessment tests whether your people and systems actually do what the controls describe. The gaps we are asked to close most often are security operations, incident response, identity and access, and management-level governance. Courses we run that bear directly on that work: CompTIA Security+ and CySA+, ISC2 CISSP, ISACA CISM and EC-Council CEH. See our cyber security training.
Our CMMC Level 2 readiness courses
Two instructor-led courses built on the CMMC rule itself. The three-day course takes your implementers through all 110 requirements of NIST SP 800-171 Revision 2, scoping, scoring, the System Security Plan and a hands-on gap assessment. The one-day course is for the owners and managers who have to fund the work and sign the annual affirmation.
- CMMC Level 2 Readiness: NIST SP 800-171 for Defense Contractors — 3 days, $1,797
- CMMC Level 2 Readiness: Executive Overview — 1 day, $695
Who needs which level?
Broadly: Level 1 for Federal Contract Information, Level 2 for Controlled Unclassified Information, Level 3 for the most sensitive programmes. The level that applies to you comes from the contract, not from us — read the solicitation and check the rules linked below.
Related pages
Government and military training
- DoD 8140 certification training
- NICE Framework training
- Military credentialing
- Government training and discounts
Frequently asked questions
When does CMMC Level 2 certification become required?
Phase 2 begins 10 November 2026, when applicable solicitations require a Level 2 certification assessment rather than a self-assessment.
When did the CMMC DFARS rule take effect?
10 November 2025. The CMMC Program rule was published in the Federal Register on 15 October 2024.
Does CMMC apply to subcontractors?
It applies to contractors and subcontractors that process, store or transmit Federal Contract Information or Controlled Unclassified Information.
Do you teach the CCP or CCA assessor courses?
No. Those are delivered by CMMC Licensed Training Providers. We train the technical and management staff whose work an assessment examines.
Where is CMMC status recorded?
In the Supplier Performance Risk System, SPRS.
Do you offer a CMMC readiness course?
Yes: a three-day CMMC Level 2 Readiness course covering all 110 NIST SP 800-171 requirements, and a one-day Executive Overview for owners and managers. They prepare you for an assessment; they are not the assessment itself.
Talk to us about your requirement
Government agencies and military personnel get a 10% discount on our training. Private group delivery is available on your dates, on site, at our Miami and Fort Lauderdale campuses or live online.
Official sources: CMMC Program rule (32 CFR) · DFARS rule (48 CFR)
Written by The Academy. Last updated October 2026. This page summarises public federal guidance and is not legal or contractual advice — confirm requirements against the official sources above or with your security manager.
