CMMC certification is not a single event. It is a process with ten distinct steps, each with its own deliverable and its own way of eating your calendar if you run it out of order. This is the real sequence, what each step produces, and roughly how the time breaks down for a contractor that wants the certification, not a participation trophy.
Before You Start: Confirm Your Level
Level 1 if you handle Federal Contract Information only. Level 2 if you handle Controlled Unclassified Information under DFARS 252.204-7012. Level 3 only if the contracting officer has explicitly identified the program as Level 3. Most defense contractors are at Level 2. If someone tells you you are probably Level 1, verify the data type before you spend a dollar. Our Level 1 vs. Level 2 guide walks through the distinction.
Step 1: Define and Minimize Scope
Map where CUI actually lives, moves, and is processed, then make that footprint as small as possible. Scope is the single biggest cost driver in CMMC. An enclave that contains the CUI keeps the assessment narrow and the tooling spend rational. A flat network that touches CUI everywhere makes the entire corporate environment in-scope, and the bill follows. Deliverable: a documented system boundary and data-flow diagram.
Step 2: Gap Assessment
A control-by-control evaluation against the applicable control set. Level 2 covers the 110 NIST SP 800-171 controls; Level 1 covers the 15 basic FAR 52.204-21 requirements. The deliverable is a finding set: each control rated Met, Not Met, or Partially Met, with evidence references. Do not skip this. Going into an assessment without a real gap finding is how contractors discover, in front of an assessor, that their MFA is not actually enforced on the right accounts.
Step 3: Remediate
Close the gaps. This is the longest step in calendar time and the largest line item in dollars: network segmentation, MFA, FIPS-validated cryptography, EDR, centralized logging, vulnerability management, incident response, training, configuration management, encrypted backups, and physical and personnel controls. Sequence the work by risk and by control dependency. Implementing audit logging before you have defined what to log produces an expensive nothing.
Step 4: Document the SSP and Policies
An SSP is not a binder of policies. It is the narrative of how each control is implemented in your specific environment. The SSP that survives an assessment is the one an outsider could read and then predict what they will see when they look at your systems. Policies must be specific to your environment, dated, version-controlled, and signed. Boilerplate is immediately recognizable to a competent assessor.
Want your scope map and control status before you commit to the full process? The free 2-minute gap check gives you a directional self-assessment, not an official SPRS score, to start from.
Run the free gap check →Step 5: Build the Evidence Pipeline
Assessors do not accept verbal assurance. They accept evidence: configuration exports, log samples, training rosters, incident reports, change tickets, vulnerability scans, access reviews. Build the pipeline before the assessment, not during it. The contractors who treat evidence as a continuous capability, rather than a binder-stuffing exercise, pass faster and at lower cost.
Step 6: Pre-Assessment
A dry run, ideally with a different team than the one that wrote your SSP. The goal is to find your weak controls before the C3PAO does. Time-box it; a couple of weeks is plenty. The output is a tight list of fixes you can close in the runway before the real assessment.
Step 7: Schedule the C3PAO or Finalize Self-Assessment
C3PAOs have lead times, so book early. For self-assessment paths, finalize the SPRS affirmation workflow and the executive signoff so the affirmation is defensible. Either way, confirm scope with the assessor in writing before they walk in. We are a readiness software provider, not a C3PAO, so the assessment itself always sits with an authorized third party.
Step 8: The Assessment
An assessment is interviews, document review, and technical examination. Expect the assessor to verify that what your SSP claims is what your systems actually do. Common failure modes: stale documentation, unowned controls, inconsistent answers across interviewees, and unmet foundational practices like MFA, FIPS validation, and audit logging.
Step 9: POA&M and Affirmation
Depending on level and contract type, not every control must be Met at assessment time; POA&M closure timelines apply, so confirm the current windows against the 32 CFR Part 170 final rule. The executive affirmation is yours to own. Treat it like a financial certification, because it functionally is one.
Step 10: Maintain
CMMC is not annual. It is continuous. Annual affirmations, evidence freshness, change-management discipline, and reassessment readiness all need to be operating capabilities, not project artifacts. The contractors who skip this step pay full freight on the reassessment three years later, because they let everything decay.
A Realistic Timeline
The honest answer is that timelines vary widely with starting posture and scope. Most schedule slip is not in remediation, which proceeds at a known rate, but in documentation and evidence: the writing-things-down work. That is the part worth attacking first if you want a predictable calendar.
Where AaaS Removes Time and Cost
Documentation and evidence are the two biggest schedule consumers, and both are where AI-as-a-Service (AaaS) gives a contractor real operational leverage. AI agents draft SSP sections from observed configuration, build control maps automatically, watch for evidence freshness, and prepare assessor-ready artifacts as a byproduct of normal operations. The executive still reviews and signs. The labor that used to sit underneath the authorizing official becomes machine work, watched by a human. For the condensed seven-step view, see our step-by-step process guide, and for budget, our Level 2 compliance cost breakdown.