Short answer: the deadline already started. CMMC enforcement began phasing into DoD contracts on November 10, 2025, and if you're seeing the requirement in a new contract or a flowdown letter from your prime, your deadline isn't a future date on a government roadmap - it's whenever you next need to sign something. Here's how the phase-in works, what applies when, and the two dates worth writing on your shop wall.
Update, July 2026: the Department suspended the CMMC Phase 2 transition on July 13, freezing Phases 2 through 4 until further notice. For a Level 1 shop the self-assessment obligation is unchanged - here's exactly what got paused and what didn't. The table below reflects that suspension, with the original schedule in parentheses.
The phased rollout, plainly
The DoD didn't flip one switch. The CMMC program rule (32 CFR 170) phases requirements into contracts over roughly three years:
| PHASE | WHEN | WHAT IT MEANS FOR A SMALL SUB |
|---|---|---|
| Phase 1 | Began Nov 10, 2025 | Self-assessments required in most new DoD contracts: Level 1 annual self-assessment for contractors handling FCI, Level 2 self-assessment for some CUI handlers. Results and an executive affirmation go into SPRS. |
| Phase 2 | Suspended Jul 13, 2026 (was Nov 2026) | Would have made third-party (C3PAO) assessment standard for most Level 2 contracts. Frozen until further notice. Level 1 was never part of this phase - it stays a self-assessment. |
| Phases 3-4 | Suspended (was through ~2028) | Would have extended requirements to option periods and existing contracts. Frozen with the rest of the transition, pending the CMMC Reform Task Force review. |
The pattern for a Level 1 shop is simpler than the table looks: Phase 1 is live, your annual self-assessment is due whether the later phases resume or not, and waiting doesn't shrink your obligation - it shrinks your runway.
Want to know how much runway you'd actually need? The free 5-question check shows you which gaps you'd have to close in about three minutes, no email to start.
Why your real deadline is earlier than the official one
Three forces move the date up for small subcontractors:
- Primes move faster than the DoD. Primes are responsible for flowing requirements down their supply chain, and many started checking subcontractor SPRS status before the rule required it. Major primes began contacting suppliers with unimplemented controls well ahead of their own deadlines. If your prime asks today and you have nothing in SPRS, "the official phase-in says..." is not a winning reply.
- Contract timing is lumpy. Your deadline arrives with your next award, renewal, or option period - whichever comes first. A shop bidding work in August needs a current SPRS entry in August, whatever phase the calendar says. Chasing DoD work you haven't won yet? Here's how to weigh preparing before you have a contract.
- SPRS access takes longer than the assessment. SAM renewals, PIEE registration, and the Cyber Vendor User role approval can eat one to two weeks before you can even submit. The submission walkthrough covers the sequence.
The honest planning math: a typical 5-50 person shop needs two to four weekends to close its Level 1 gaps, plus a week or two of government-portal lead time. Working backward from your next bid or renewal, "start now" isn't marketing urgency - it's arithmetic.
What "compliant" means at Level 1
For contractors handling Federal Contract Information, the obligation is an annual self-assessment against the 15 requirements of FAR 52.204-21, entered in SPRS with an affirmation by a senior official. It's pass/fail - all 15 met, no partial credit, no POA&Ms at Level 1 - and the affirmation is a legally binding statement that renews every year. If you handle CUI or your contracts carry DFARS 252.204-7012, you're in Level 2 territory with 110 requirements and a different clock.
The two dates for the shop wall
Your next contract event - award, renewal, or option period. That's your real deadline for a defensible SPRS entry. And eleven months after you affirm - the reminder to re-assess before the annual affirmation lapses, because an expired affirmation quietly makes you ineligible again.
Where does your shop stand right now?
Five yes/no questions, instant grade, no email required. Know before you're asked.
Take the free 5-question check