Home / Assessments / CMMC readiness
CMMC readiness
CMMC Phase 2 begins November 10, 2026. We show you exactly where you stand against Level 1 or Level 2 and what to fix before an assessor arrives.
A Fortify Experts CMMC readiness assessment measures your environment against CMMC Level 1 (15 requirements) or Level 2 (the 110 requirements of NIST SP 800-171), calculates your SPRS score, and delivers a plan of action and milestones to prepare for self-assessment or C3PAO certification.
CMMC phase-in
| Phase | Starts | What changes |
|---|---|---|
| Phase 1 | November 10, 2025 | Level 1 and Level 2 self-assessments become conditions of award |
| Phase 2 | November 10, 2026 | C3PAO Level 2 certification required for a wider range of contracts |
| Phase 3 | November 10, 2027 | Level 2 certification extends to option periods; Level 3 requirements appear |
| Phase 4 | November 10, 2028 | Full implementation across applicable DoD contracts |
Source: CMMC 2.0 compliance timelines. Always confirm requirements in your specific solicitation.
What you receive
- Scope of your CUI environment and assets
- Assessment against each applicable requirement
- Your current SPRS score
- A plan of action and milestones (POA&M)
- Policy and system security plan gaps
- Preparation for C3PAO certification
Questions we hear
When does CMMC Level 2 certification become required?
CMMC requirements began appearing in DoD contracts on November 10, 2025, starting with self-assessments. Phase 2 begins November 10, 2026, when third-party (C3PAO) Level 2 certification becomes a condition of award for a wider range of contracts.
How many requirements are in Level 2?
Level 2 covers the 110 security requirements of NIST SP 800-171. Level 1 covers 15 basic safeguarding requirements.
Can you perform our certification assessment?
No. Certification assessments are performed by authorized C3PAOs. We prepare you so the certification assessment goes smoothly.
Phase 2 starts November 10, 2026
Find out where you stand while there’s still time to fix it.