CMMC Regulatory Timeline
Major CMMC milestones from initial rulemaking through the current Phase 1 implementation and Phase 2 suspension.
Current status as of August 28, 2026
Phase 2 transition suspended
DoD suspended the transition to Phase 2 and future implementation milestones on July 13, 2026 while it reviews the program. Phase 1 remains in effect; there is no current authoritative November 2026 Phase 2 deadline.
Read the current official DoD statusCMMC 1.0 Released
The Department of Defense released the initial Cybersecurity Maturity Model Certification (CMMC) framework with 5 maturity levels and 171 practices across 17 domains.
DoD and CMMC-AB MOU Announced
DoD announced a memorandum of understanding with the CMMC Accreditation Body defining their roles in accrediting assessors and C3PAOs for the original program.
CMMC 2.0 Announced
DoD streamlined the framework from 5 levels to 3, aligning Level 2 directly with NIST SP 800-171 Rev 2's 110 controls. Eliminated CMMC-unique practices and reduced burden on small businesses.
CMMC Proposed Rule Published
The CMMC proposed rule (32 CFR Part 170) was published in the Federal Register and opened for public comment.
NIST SP 800-171 Rev 3 Published
NIST released Revision 3 of SP 800-171, reorganizing the requirements and adding new families. CMMC Level 2 currently uses Rev 2; DoD has not published a CMMC transition date for Rev 3.
CMMC Final Rule Published
The CMMC final rule (32 CFR Part 170) was published in the Federal Register, establishing the program's regulatory foundation. Effective December 16, 2024.
32 CFR Part 170 Takes Effect
The CMMC program rule became effective on December 16, 2024. Contract implementation still required the companion DFARS acquisition rule.
CMMC Phase 1 Begins
The DFARS CMMC rule took effect on November 10, 2025. During the current suspension, DoD directs program managers and requiring activities to designate only Level 1 Self or Level 2 Self in applicable solicitations and contracts.
Transition to Phase 2 Suspended
DoD suspended the transition to Phase 2 and future implementation milestones while it conducts a comprehensive review. Phase 1 remains in effect; current DoD direction prohibits designating Level 2 C3PAO or Level 3 assessments.
Unified Agenda Identifies Planned Rev 3 Amendment
The Unified Agenda identifies RIN 0790-AM01 as planned rulemaking for a Revision 2-to-Revision 3 transition. Revision 2 remains the current CMMC baseline. The agenda is not an effective rule, and no standalone transition rule or legally effective transition deadline has been published.
Future CMMC Milestones
DoD has not announced replacement dates for Phase 2 or later milestones. Contractors should monitor official DoD guidance and the requirements in each solicitation and contract.
Potential Transition to NIST SP 800-171 Rev 3
NIST published Revision 3 in May 2024, but CMMC Level 2 continues to use Revision 2. DoD has not published a CMMC transition date for Revision 3.
Prepare for Your Contract's Requirements
Review each solicitation and contract for DFARS 252.204-7021 and the specified CMMC level and assessment type. You can start with a free 110-requirement self-assessment and estimated SPRS score.
Start Your Self-Assessment