CMMC Phase 2 timeline: paused for small contractors, and what still applies
DoD has paused Phase 2 requirements for small contractors while a task force reviews the cost burden on small business. That changes the schedule, and it does not change what your existing contracts already require. Here is the rollout as it was written, what the pause means for you, and the obligations that apply today either way.
What still applies right now. DFARS 252.204-7012 requires you to implement NIST SP 800-171 and report incidents within 72 hours. DFARS 252.204-7019 and 7020 require a current self-assessment score in SPRS, refreshed at least every three years. Contracting officers and primes read that score before award. None of that waits for a phase date.
The phased rollout
Self-assessment enters solicitations
DoD began including CMMC Level 1 and Level 2 self-assessment requirements in solicitations. Contractors attest to their own posture and post a score.
Level 2 C3PAO certification can be required
DoD may begin requiring a Level 2 certification from an authorized C3PAO as a condition in solicitations. Self-attestation alone is no longer sufficient for the contracts that carry this requirement. This phase is currently paused for small contractors pending DoD’s cost-burden review, so treat this date as under revision rather than fixed.
Certification required for award, and Level 3 begins
Level 2 certification can become a condition of award on more contracts, and the highest tier, Level 3, enters the picture for the most sensitive programs.
CMMC applies across applicable contracts
The requirements apply broadly across DoD solicitations and awards that handle controlled unclassified information.
Exact appearance in any given solicitation is at DoD and program discretion within this phased schedule. Treat the dates as the window in which the requirement can apply to you, not a guarantee of when it will.
What to do during the pause
A pause is the least expensive time to do this work, because nothing is forcing a rush. In order:
- Measure your gap against all 110 controls. You cannot plan remediation you have not scoped.
- Remediate by impact. Close the highest-weight controls first so your score moves fastest.
- Assemble your evidence and documentation (System Security Plan and POA&M) as you go, not at the end.
- Keep your SPRS score current and accurate so what the government sees matches what you actually run.
Every one of those steps is faster and cheaper when you start from a measured baseline rather than a guess.
Get your baseline while there is no rush
The free gap check gives you a directional read in about 2 minutes. The CMMC Readiness Snapshot measures your environment against all 110 NIST 800-171 controls and returns a PDF within minutes of intake, for $799 one time.
Enclave AI™ builds AI-driven CMMC Level 1 and Level 2 readiness software. We are not a C3PAO and we will not seek C3PAO authorization, that separation is permanent. The free gap check is a directional self-assessment and is not an official SPRS score. Phase dates reflect the DoD phased implementation schedule and are subject to DoD discretion. Patent Pending. ElasticD3M, LLC, Texas.