CMMC CHANGED THE FSO ROLE.
Understand where industrial security ends, cybersecurity begins, and how FSOs fit into CMMC readiness.
Executive Brief
Think you have until 2027 or later to prepare for Cybersecurity Maturity Model Certification (CMMC)? Many defense contractors believe so, but that assumption is risky.
Your real deadline is not set by regulation alone. It is driven by contracts, prime contractor expectations, and how long readiness takes.
- The 48 Code of Federal Regulations (CFR) rule took effect November 10, 2025, and CMMC requirements are already appearing in real Department of Defense (DoD) (also known as the Department of War) solicitations. Phase 2, which makes Level 2 Certified Third-Party Assessment Organization (C3PAO) certification mandatory for most contracts involving Controlled Unclassified Information (CUI), begins November 10, 2026.
- Most organizations need 6 to 18 months to prepare for a Level 2 assessment. That includes scoping, gap assessment, remediation, documentation, and C3PAO scheduling.
- Roughly 100 authorized C3PAOs currently serve an estimated 118,000[TP1] organizations that need Level 2 certification. Many are already booked through the end of 2026.
- Waiting until a requirement shows up in a solicitation means that window is already closing.
- The contractors moving now are not reacting to deadlines. They are protecting future revenue.
Dig deeper below.
The Phased Rollout Does Not Mean Gradual Risk
The CMMC rollout is structured in four phases, but that structure can create a false sense of runway.
“Whatever time you think you have to get ready, I can almost guarantee the truth is less," says John Nolan, ISI Vice President of IT Services. "Certification is a road with a large number of exits with only one path to full compliance.”
As outlined by the DoD's final 48 CFR rule:
- Phase 1 (November 10, 2025): Level 1 and Level 2 self-assessments required in applicable contracts. Contracting officers (CO) may also require C3PAO assessments in select Level 2 contracts at their discretion.
- Phase 2 (November 10, 2026): C3PAO assessments become mandatory for applicable new awards and solicitations involving CUI. This is not a single switch that covers all contracts at once. The rollout expands through Phase 3 (November 2027) and Phase 4 (November 2028), when requirements extend to option exercises on existing contracts and ultimately all applicable DoD contracts. If your next award or recompete falls after November 10, 2026, a C3PAO assessment is likely required.
- Phase 3 (November 10, 2027): Level 3 assessments introduced. Level 2 certification is a pre-requisite to achieving Level 3 (DIBCAC) certification.
- Phase 4 (November 10, 2028): Full implementation across all applicable DoD contracts.
For any organization whose contracts involve CUI, Phase 2 is the operational milestone, and it is seven months away.
What Contractors Should Be Looking for in Their Contracts
Two Defense Federal Acquisition Regulation Supplement (DFARS) clauses tell you the most about where you stand:
- DFARS 252.204-7021: This is the core CMMC clause. It requires a valid CMMC assessment at the level specified in the contract and covers everything that entails, including certification, documentation, and ongoing compliance obligations.
- DFARS 252.204-7025: This is the contract provision that identifies which CMMC maturity level is required to perform on that specific contract. It is also flowed down to subcontractors, meaning if your prime has it, you likely need to meet it too.
If either clause appears in your contract or flows down from your prime, your timeline is already set.
Your Real Deadline Is Driven by Contracts
The DoD rollout schedule describes when requirements phase into contracts across the Defense Industrial Base (DIB). It does not tell you when they will appear in your contracts.
What drives your deadline:
- Recompetes and option years: If your contract is up for renewal with CMMC language in the new solicitation, your deadline is the proposal date. Phase 3 also explicitly requires Level 2 certification to exercise option periods on applicable contracts.
- New bids: CMMC Level 2 requirements are already appearing in live solicitations. Contracts from the Army, Navy, and Special Operations Command have already specified Level 2 as a condition of award, with some escalating to Level 3 by October 1, 2027.
- Prime contractor flow-downs: Primes are pushing requirements down independently of the DoD rollout. Some are requiring SPRS scores, System Security Plans (SSPs), and compliance attestations as a condition of continued teaming.
ISI Insight: Your deadline is tied to when revenue is at risk, not when the final rule is fully enforced.
Why the C3PAO Bottleneck Is Your Biggest Scheduling Risk
Most contractors focus on whether their controls are ready. The harder constraint in 2026 is whether they can get an assessment scheduled in time.
According to data presented at the Cyber AB's February 2026 Town Hall:
- Approximately 118,000 organizations need Level 2 (C3PAO) certification
- Around 100 authorized C3PAOs are currently operational
- Current Certified CMMC Assessor (CCA) supply is under 800
Begin C3PAO conversations 9 to 12 months before your target certification date. Organizations with contracts renewing in late 2026 should be initiating those conversations now. Build at least 90 to 120 days of scheduling buffer into your timeline before the contract deadline.
The Hidden Timeline Drivers
Most CMMC delays are not technical. Documentation, coordination, and evidence collection are what slow organizations down.
- Readiness takes longer than expected. Gap assessments routinely uncover CUI in systems not originally considered in scope, SSPs that do not reflect actual operations, missing evidence for NIST SP 800-171 controls, and shared responsibility gaps with third-party vendors and cloud providers.
- SPRS score pressure. Your score is already visible to primes and DoD procurement officials. A low or unsupported score affects teaming decisions and subcontract awards before you ever reach a formal assessment. Improving it requires closing real gaps and updating your SSP — not just a score adjustment.
- Internal alignment stalls execution. CMMC touches legal, HR, finance, operations, and leadership. Budget cycles are often the single biggest constraint. For organizations with tight option year timelines, waiting for the next fiscal year budget can be decisive. For a detailed look at how to plan for CMMC compliance costs, download the ISI Compliance Without Compromise guide.
- An assessment date is not a certification date. C3PAOs are turning contractors away at Phase 1 for arriving unprepared. If your environment, documentation, or evidence does not meet the bar when assessors arrive, you can be rescheduled. That delay can directly impact contract eligibility and option year timelines at the worst possible moment.
What Early Movers Are Doing Differently
Organizations ahead of CMMC are treating readiness as a competitive advantage, not a compliance task.
What distinguishes them:
- Formal gap assessments completed against all 110 NIST SP 800-171 controls and 320 assessment objectives
- SSPs that are current, accurate, and reflect live systems and real configurations
- CUI environments segmented to reduce scope and documentation burden
- A C3PAO already on the calendar, creating accountability and forcing internal prioritization
- Proactive communication of SPRS scores and assessment plans to primes, reducing supply chain risk
Your CMMC timeline is not defined by when the rule is fully enforced. It is defined by when your contracts require it, how long readiness takes, and how early your partners expect proof of posture.
With Phase 2 enforcement beginning November 10, 2026, and C3PAO capacity already constrained, the organizations that start now will have options. The organizations that wait will not.
FAQs
Do I really need to start now if my contracts do not require CMMC yet?
Yes. Most organizations require 6 to 18 months to close gaps, document controls, and prepare for an assessment. With fewer than 100 authorized C3PAOs serving over 80,000 organizations, waiting until a requirement appears typically means you will not secure an assessment slot before your contract deadline.
What is the biggest mistake companies make with CMMC timelines?
Underestimating remediation timelines and overestimating internal capabilities. Most organizations do not realize how much work precedes a formal assessment until they are already behind. Scoping, gap analysis, documentation, remediation, and assessor scheduling each take meaningful time, and they largely must happen in sequence.
How does my SPRS score impact my timeline?
Your SPRS score is already being used as a risk indicator by primes and DoD procurement officials. A low score, or an unsupported score, may trigger your CO or prime's supply chain rep to reach out for additional documentation and conversations around your CMMC timelines and goals.
Can prime contractor requirements accelerate my CMMC deadline?
Absolutely. Primes are already requiring subcontractors to demonstrate readiness through SPRS scores, SSPs, or formal attestations as a condition of continued teaming — often months before a formal contract clause appears.
