There is one date every DoD contractor needs on the wall: November 10, 2026. That is when CMMC Phase 2 starts, and it changes what it takes to win or keep a contract that involves Controlled Unclassified Information. This is a binary cutoff written into the acquisition rule, not a soft target an agency can wave you past.
What Actually Happens on November 10, 2026
The CMMC rollout is phased over three years. Here is the timeline that matters, with the dates verified against the published rulemaking:
- November 10, 2025 — Phase 1 began. Sixty days after the 48 CFR acquisition rule published in the Federal Register, CMMC requirements started appearing in new DoD solicitations. At this stage, most contracts could be satisfied with a Level 1 or Level 2 self-assessment posted to SPRS.
- November 10, 2026 — Phase 2 begins. This is the one that bites. DoD contracts handling CUI start requiring a full Level 2 assessment performed by a certified third party (a C3PAO). Self-attestation is no longer enough for most CUI work.
- November 10, 2027 — Phase 3. Level 2 C3PAO requirements expand, and Level 3 (the highest tier) certification requirements come into scope for the most sensitive programs.
- November 10, 2028 — Phase 4. Full implementation. CMMC requirements apply across essentially all applicable DoD contracts and option periods.
What You Lose If You Are Not Compliant
If a solicitation carries a Level 2 C3PAO requirement after November 10, 2026 and you do not hold the certification, you are not eligible for award. A contracting officer cannot legally award a CUI contract to a firm that lacks the required CMMC status — the same way they cannot award to a firm with an inactive SAM.gov registration. There is no waiver you fill out at the last minute.
The risk is not limited to brand-new contracts. As existing contracts hit option years and get re-solicited, the CMMC clause comes with them. A recompete you have held for years can become unwinnable overnight if a competitor shows up certified and you do not.
Why the Clock Is Already Out of Time for Some
Most organizations need 6 to 18 months to prepare for a Level 2 assessment — scoping, gap analysis, remediation, documentation, and then waiting in line for a C3PAO that has the availability to assess you. Work backward from November 10, 2026, and a firm starting an 18-month effort needed to begin in spring 2025. A firm that can move in 6 months still has a window, but it is closing.
The supply side makes this worse. As of February 2026, only about 1,042 organizations out of roughly 76,598 that need certification had completed it. That is around 99% of the defense industrial base still uncertified, all of them about to compete for a finite number of C3PAO assessment slots. The contractors who wait until summer 2026 to start will be fighting for appointments that no longer exist.
The SDVOSB and VOSB Stakes
Veteran-owned and service-disabled veteran-owned firms are concentrated in exactly the agencies and NAICS codes where CUI shows up — defense, intelligence support, IT services for DoD. For a lot of SDVOSBs, the DoD pipeline is the business. November 10, 2026 is not a compliance footnote for those firms; it is whether the company can keep bidding its core market.
The firms that come through this in the best shape are the ones treating CMMC as a 2025–2026 capital project with a hard delivery date, not a thing to handle once a specific contract demands it. By the time a solicitation names the requirement, the 12-to-18-month runway is gone.
What To Do This Quarter
1. Confirm whether you handle CUI at all. If you only touch Federal Contract Information, you may only need Level 1, which is a self-assessment. If you handle CUI, you are on the Level 2 path.
2. Scope it now. Figure out exactly which systems, people, and data touch CUI. Shrinking that footprint is the cheapest lever you have.
3. Run a gap assessment against all 110 NIST SP 800-171 controls. Know your SPRS score honestly before an assessor does.
4. Get in a C3PAO queue early. Availability, not readiness, is becoming the binding constraint.
The deadline is fixed. The only variable left is how early you start.