Josef Kamara, CPA, CISSP, CISA · Updated May 2, 2026 · 1 minute read

CMMC Phase-In Schedule

The four-phase rollout that introduces CMMC certification requirements into DoD solicitations between 2025 and 2028. Phase 1 (2025) limits the requirement to Level 1 and Level 2 self-assessments; Phase 2 (2026) adds Level 2 third-party assessments to most CUI-handling contracts; Phase 3 (2027) extends Level 2 third-party assessments to all applicable solicitations; Phase 4 (2028) introduces Level 3 government-led assessments and applies CMMC to all in-scope contracts including option periods.