November 10, 2026 is the date DoD starts writing third-party CMMC certification into contracts.
CMMC Phase 2 begins November 10, 2026. From that date, the Department of War (still called DoD in most regulations) starts adding CMMC Level 2 certification requirements, assessed by an authorized C3PAO, to applicable contracts. That includes orders placed on a GSA Schedule: GSA has said that Schedule holders must meet the applicable CMMC level when pursuing DoD requirements, and DoD contracting officers can’t award an order to a company without the CMMC status the solicitation requires.
What Is CMMC Phase 2?
The second step in DoD’s four-phase rollout of the Cybersecurity Maturity Model Certification program. Phase 1 made self-assessments a condition of award; Phase 2 adds third-party certification.
| Phase | Start date | What DoD adds to applicable contracts |
|---|---|---|
| Phase 1 | November 10, 2025 | Level 1 and Level 2 self-assessments as a condition of award |
| Phase 2 | November 10, 2026 | Level 2 certification by an authorized C3PAO |
Through November 9, 2028, DoD program offices decide which contracts carry a CMMC requirement. From November 10, 2028, the requirement applies whenever a contractor’s systems will process, store or transmit Federal Contract Information or Controlled Unclassified Information.
Does CMMC Apply to DoD Orders Placed on a GSA Schedule?
Yes, when the DoD requirement calls for it. CMMC is set at the level of the solicitation and the order, not the vehicle, so a DoD order on your Schedule can carry a CMMC requirement even though your MAS contract itself doesn’t.
Three things point the same way:
- DFARS 204.7502 says contracting officers shall not award a contract, task order or delivery order to an offeror without a current CMMC status at the level the solicitation requires.
- DFARS 204.7504 prescribes the CMMC clause, 252.204-7021, for solicitations and contracts including those using FAR Part 12 commercial procedures, except buys solely for commercially available off-the-shelf (COTS) items.
- GSA’s own guidance, published February 12, 2026, says CMMC certification is mandatory for Department of War contracting opportunities and that GSA contract holders must meet the applicable level when pursuing or proposing on those requirements.
In practice, the DoD ordering officer’s RFQ will state the CMMC level. If you can’t show that status in SPRS, you can’t win the order.
What Does CMMC Level 2 Certification Require?
An assessment by an authorized third-party assessment organization (C3PAO) against the security requirements of NIST SP 800-171, covering the systems that handle Controlled Unclassified Information. Certification is valid for three years, with an annual affirmation from a senior company official.
Not every company needs Level 2 certification. Firms that only handle Federal Contract Information may need Level 1 self-assessment instead, and some Level 2 requirements allow self-assessment. The solicitation sets the level.
Does CMMC Affect My Existing DoD Orders?
It can at option time. DFARS 204.7503 requires contracting officers to check CMMC status in SPRS before exercising an option or extending a period of performance, not just before a new award.
That makes your option dates part of your CMMC timeline. An order you already hold can become a problem the day its next option comes up.
Do Civilian Agency Orders Require CMMC?
No. CMMC is a DoD program. Civilian agencies don’t require CMMC certification on their orders.
That doesn’t mean civilian work is free of cybersecurity requirements. GSA has its own requirements for contractors that handle Controlled Unclassified Information, which we covered in GSA’s Cybersecurity Review Is Now a Contract Eligibility Threshold.
Is DoD Worth the Cost of Certification for My Schedule?
That’s the real decision. Certification takes time and money, and it only pays back if DoD orders are a meaningful part of your Schedule sales now or in your plan.
If DoD is a small share of your Schedule sales today, certification cost may not pay back, and civilian agencies may be the better focus. A federal market strategy session runs that math with you before you commit to an assessment.
Our Take
CMMC Phase 2 turns cybersecurity into a market-access decision for Schedule holders. Contractors who sell mostly to civilian agencies can plan around it; contractors who depend on DoD orders can’t. Either way, the choice should be deliberate, made before November 10, not discovered on an RFQ you can’t answer.
Frequently Asked Questions
When does CMMC Phase 2 start?
November 10, 2026. From that date, DoD begins adding Level 2 certification by an authorized C3PAO to applicable contracts.
What does CMMC Level 2 certification require?
A third-party assessment by an authorized C3PAO against the security requirements of NIST SP 800-171 for systems that handle Controlled Unclassified Information. Certification lasts three years with an annual affirmation.
Does CMMC apply to DoD orders placed on a GSA Schedule?
Yes, when the DoD solicitation requires it. DFARS bars contracting officers from awarding task or delivery orders to companies without the required CMMC status, and GSA says Schedule holders must meet the applicable level for DoD requirements. Buys solely for COTS items are excluded from the CMMC clause.
Do civilian agency orders require CMMC?
No. CMMC is a DoD program. GSA has separate cybersecurity requirements for contractors that handle Controlled Unclassified Information.
Does CMMC affect orders I already hold?
It can. DoD contracting officers must check CMMC status before exercising an option or extending a period of performance, so your option dates matter.
Decide If DoD Is Worth the Certification
Phase 2 doesn’t force every Schedule holder to certify. It forces a decision: pursue DoD work with a certification plan, or focus your Schedule on civilian agencies that don’t require one. We’ll look at your DoD sales, your option dates and your pipeline, and help you make that call on the numbers.
→ Start Your DoD Readiness Review
The contractors who decide early are the ones who don’t lose an order to a checkbox.
