November 10, 2026 is Phase 2. It is not your deadline.
Starting November 10, 2026, new DoD solicitations involving CUI require third-party CMMC Level 2 certification as a condition of award. Your real deadline is your next CUI solicitation, or the day your prime pushes the requirement down. For most of the defense industrial base, that day comes first.
Four phases, from the rule.
| Phase | Begins | What changes |
|---|---|---|
| Phase 1 | November 10, 2025 | The 48 CFR CMMC acquisition rule takes effect. Self-assessment requirements begin appearing in DoD solicitations. |
| Phase 2 | November 10, 2026 | New DoD solicitations involving CUI require third-party CMMC Level 2 certification as a condition of award. |
| Phase 3 | November 10, 2027 | The Level 2 certification requirement extends to option exercises on existing contracts, and Level 3 requirements begin appearing. |
| Phase 4 | November 10, 2028 | Full implementation. CMMC requirements apply across all applicable DoD solicitations and contracts. |
Source: the 48 CFR CMMC acquisition rule (effective November 10, 2025) and DFARS 252.204-7021.
The queue is the deadline.
About 80,000 contractors need CMMC Level 2; as of March 2026, only 1,074 were certified. That is about 1.3 percent.
Certifications are running at under 200 a month, and C3PAO assessment wait times are 6 to 12 months. The assessment ecosystem physically cannot certify the defense industrial base by the date. Contractors who start readiness now get assessed in time. Contractors who wait inherit the back of the line.
Three deadlines that arrive before the date.
Your next CUI solicitation
From Phase 2, certification is a condition of award on new DoD solicitations involving CUI. No certificate, no award.
Your prime's flow-down
Primes are pushing the requirement down their supply chains ahead of the government's schedule. Their letter is your deadline, whatever the rule says.
Your option exercise
From Phase 3 (November 10, 2027), existing contracts pick up the requirement at option exercise. Renewals stop being automatic.
We do readiness. We do not certify.
Certification only ever comes from a C3PAO, a Certified Third-Party Assessment Organization conducting the official assessment. What comes before that is readiness: closing gaps against the 110 NIST SP 800-171 controls, building the evidence, and running an environment that can pass.
cloudcorps does readiness, remediation, and managed enclave work. We are not a C3PAO. We do not certify. In a category full of overclaiming, we would rather be the clearest explainer of that distinction than the loudest voice in it. If a badge is on this site, it is real.
The questions owners actually ask.
Is November 10, 2026 the deadline for CMMC Level 2?
Not exactly, and the difference matters. November 10, 2026 is when Phase 2 of the CMMC acquisition rule begins: starting that date, new DoD solicitations involving CUI require third-party CMMC Level 2 certification as a condition of award. If your next CUI solicitation drops before you are certified, that solicitation was your deadline. If your prime pushes the requirement down in a flow-down letter, that letter is your deadline.
What happens after November 10, 2026?
The requirement keeps expanding. In Phase 3 (November 10, 2027) certification requirements extend to option exercises on existing contracts, and Phase 4 (November 10, 2028) is full implementation across applicable DoD contracting. The date is a starting gun, not a finish line: contractors who are not certified do not become ineligible for everything overnight, they become ineligible for each new CUI award as it comes up.
How long does CMMC Level 2 certification take?
Plan in quarters, not weeks. C3PAO assessment wait times are running 6 to 12 months, and that clock starts after your environment and evidence are actually ready to assess. Readiness work before the assessment, closing gaps against the 110 NIST SP 800-171 controls, is what most contractors underestimate.
What is the difference between an RPO and a C3PAO?
A C3PAO (Certified Third-Party Assessment Organization) conducts the official assessment that results in certification. An RPO (Registered Practitioner Organization) helps you prepare: gap analysis, remediation, evidence, environment. Certification only ever comes from a C3PAO.
Does cloudcorps certify companies?
No. cloudcorps does readiness, remediation, and managed enclave work: getting you to the point where a C3PAO assessment succeeds. We are not a C3PAO and we do not certify. If a badge is on this site, it is real.
Why is capacity the real story?
About 80,000 contractors need CMMC Level 2; as of March 2026, only 1,074 were certified. That is about 1.3 percent, at a pace of under 200 certifications a month. The assessment ecosystem physically cannot certify the defense industrial base by the date. The queue is the deadline: contractors who start readiness now get assessed in time, and contractors who wait inherit the back of the line.
Find out where you actually stand.
Twelve yes-or-no questions. Three minutes. No email required.