November 10, 2026 is the date DoD starts writing third-party CMMC certification into contracts.  CMMC Phase 2 begins November 10, 2026. From that date, the Department of War (still called DoD in most regulations) starts adding CMMC Level 2 certification requirements, assessed by an authorized C3PAO, to applicable contracts. That includes orders placed on a GSA Schedule: GSA has said that Schedule holders must meet the applicable CMMC level when pursuing DoD requirements, and DoD contracting officers can’t award an order to a company without the CMMC status the solicitation requires.  What Is CMMC Phase 2?  The second step in DoD’s four-phase rollout of the Cybersecurity Maturity Model Certification program. Phase 1 made self-assessments a condition of award; Phase 2 adds third-party certification.                 Phase        Start date        What DoD adds to applicable contracts                        Phase 1        November 10, 2025        Level