CMMC Phase 1 vs. Phase 2: What Do These Terms Actually Mean?
- Brandon Alsup
- May 11
- 6 min read
CMMC has created a lot of new language for defense contractors.
Level 1.
Level 2.
Self-assessment.
C3PAO assessment.
SPRS.
Affirmations.
CUI.
FCI.
POA&M.
SSP.
And now many contractors are hearing another set of terms: Phase 1 and Phase 2.
That can be confusing because “phase” sounds like something inside your own compliance project. A company may hear “Phase 1” and assume that means the first step of becoming CMMC-ready. Or it may hear “Phase 2” and assume every contractor suddenly needs the same third-party assessment at the same time.
Neither assumption is quite right.
CMMC Phase 1 and Phase 2 are not the steps your company follows to become compliant. They are part of the Department of Defense’s phased rollout of CMMC requirements into solicitations and contracts.
Your internal project may include contract review, CUI scoping, gap assessment, remediation, documentation, evidence collection, and assessment preparation. That is your readiness timeline.
The CMMC phases are different. They describe how the government is introducing CMMC requirements into the acquisition process over time.
That distinction matters.
The short answer
Phase 1 is the initial rollout period. It began on November 10, 2025 and runs through November 9, 2026. The DoD CIO describes Phase 1 as focused primarily on CMMC Level 1 and Level 2 self-assessments, along with the need to submit affirmations with CMMC assessments in SPRS (list of CMMC acronyms).
Phase 2 begins on November 10, 2026. In Phase 2, where applicable, solicitations will begin requiring CMMC Level 2 certification. The DoD’s CMMC 101 briefing also notes that the Department may choose to delay a Level 2 certification requirement to an option period in a contract.
In plain English:
Phase 1 is when CMMC begins entering contracts mainly through self-assessment requirements. Phase 2 is when Level 2 certification pressure becomes much more significant for applicable contracts involving CUI.
Phase 1 and Phase 2 are rollout phases, not your internal project plan
This is the most important point.
A contractor can be operating during CMMC Phase 1 and still need to do many internal readiness steps. The company may still need to determine whether it handles Controlled Unclassified Information (CUI), define its CMMC boundary, review its Microsoft 365 environment, clarify vendor responsibilities, build documentation, or prepare evidence.
Those activities are part of the contractor’s readiness work.
They are not the same thing as CMMC Phase 1.
The same is true for Phase 2. Phase 2 does not mean every contractor automatically receives the same requirement on the same day. It means the government’s rollout has moved into a stage where Level 2 certification requirements become more common and more important in applicable solicitations.
The phase tells you something about the government rollout.
It does not, by itself, tell you whether your company handles CUI, which CMMC level applies, whether you need a self-assessment or certification assessment, or how ready your environment is.
What is CMMC Phase 1?
Phase 1 is the first 12 months of CMMC implementation.
During this period, the DoD begins incorporating CMMC requirements into applicable procurements. The DoD FAQ states that implementation begins November 10, 2025, when the revised DFARS clause becomes effective, and that the first 12 months primarily focus on self-assessments.
For many contractors, the practical Phase 1 issue is not a full C3PAO assessment.
It is more likely to be questions like:
Do we need a CMMC Level 1 self-assessment?
Do we need a CMMC Level 2 self-assessment?
Have we submitted the right information in SPRS?
Has the proper official submitted the required affirmation?
Do we understand whether the contract involves FCI, CUI, or both?
That does not mean Phase 1 is unimportant. It means the first wave of pressure is often about getting the basics right: assessment status, SPRS visibility, affirmations, and a clear understanding of which requirement applies.
The DoD FAQ also clarifies an important nuance: during Phase 1, the Department’s intent is that solicitations focus on the right self-assessment requirement, meaning Level 1 when only FCI is involved and Level 2 Self when CUI is processed, stored, or transmitted in contractor-owned information systems. The FAQ also notes that Program Managers have discretion to include Level 2 C3PAO requirements during Phase 1, but that this is not required.
Phase 1 does not mean “CMMC can be ignored.” It also does not mean “every Level 2 contractor must immediately complete a C3PAO assessment.”
It means CMMC has started entering the contract process, primarily through self-assessment requirements, with some discretion for more advanced requirements in certain cases.
What is CMMC Phase 2?
Phase 2 is the next stage of the rollout.
According to the DoD CMMC 101 briefing, Phase 2 begins on November 10, 2026. Where applicable, solicitations will require Level 2 certification. The briefing also notes that the Department may delay the Level 2 certification requirement to an option period.
This is where many contractors handling CUI need to pay closer attention.
Phase 2 does not mean every business in the defense supply chain has the same requirement. But it does mean that contractors expecting Level 2 requirements should be thinking beyond self-assessment.
The practical question becomes:
If a contract requires Level 2 certification, will we be ready before contract eligibility becomes the issue?
That is why Phase 2 matters even before it begins. Level 2 readiness can take time. If your company waits until a solicitation requires certification, it may be too late to scope, remediate, document, collect evidence, and schedule an assessment without disrupting business opportunities.
Phase 1 vs. Phase 2 at a glance
Question | Phase 1 | Phase 2 |
What is it? | Initial rollout of CMMC into applicable contracts | Expanded rollout with more Level 2 certification requirements |
When does it start? | November 10, 2025 | November 10, 2026 |
Main focus | Level 1 and Level 2 self-assessments | Level 2 certification where applicable |
Main contractor issue | SPRS status, affirmation, correct assessment path | C3PAO readiness and certification timing |
Biggest mistake | Assuming CMMC still does not matter | Waiting until certification is required in a solicitation |
Why the terminology causes confusion
The word “phase” gets used in several different ways.
A contractor may talk about the phases of its internal project: discovery, scoping, remediation, documentation, and assessment preparation.
A consultant may talk about the phases of a readiness plan.
The DoD, however, is using Phase 1 and Phase 2 to describe the phased implementation of CMMC requirements in procurement.
Those are related, but they are not the same.
A company might say, “We are in Phase 1,” but that does not answer the real questions:
Do you handle CUI?
Does your contract require Level 1, Level 2 Self, or Level 2 Certification?
Is your assessment status current in SPRS?
Has the required affirmation been submitted?
Would your current environment withstand deeper review?
That is why Phase 1 and Phase 2 should be treated as contract-timing language, not as a complete compliance plan.
The practical takeaway
Contractors should not ask only, “What phase are we in?”
A better set of questions is:
Does our current or future contract include CMMC language?
Do we handle FCI, CUI, or both?
Does the contract require Level 1, Level 2 Self, or Level 2 Certification?
Do we have the required assessment status and affirmation in SPRS?
If Phase 2 creates Level 2 certification pressure for our work, are we realistically preparing early enough?
That is the real business issue.
CMMC Phase 1 and Phase 2 are not just regulatory vocabulary. They affect contract timing, eligibility, planning, and how soon a contractor needs to move from “we know CMMC is coming” to “we can show where we stand.”
How TK Compliance helps
TK Compliance helps defense contractors interpret what CMMC requirements mean for their organization.
We help companies understand whether Phase 1 or Phase 2 creates near-term contract pressure, determine which assessment path may apply, and identify what needs to happen before deadlines become urgent.
CMMC is not just about tools. It is about contract requirements, evidence, ownership, documentation, and operational readiness.
If you are unsure what Phase 1 or Phase 2 means for your organization, TK Compliance can help you clarify the next step.
Unsure what CMMC Phase 1 or Phase 2 means for your contract? Schedule a CMMC readiness call. 800-710-3785 info@tkcompliance.com
Sources and references
Here are the official source links:
U.S. Department of Defense CIO — Cybersecurity Maturity Model Certification
https://dodcio.defense.gov/CMMC/
This is the main DoD CIO CMMC page and includes the current note that Phase 1 implementation runs Nov. 10, 2025 through Nov. 9, 2026 and focuses primarily on Level 1 and Level 2 self-assessments.
U.S. Department of Defense CIO — CMMC 101 Overview Briefing, November 2025
https://dodcio.defense.gov/Portals/0/Documents/CMMC/CMMC-101-Nov2025.pdf
This is the November 2025 CMMC 101 PDF briefing. It includes the phased implementation overview.
U.S. Department of Defense CIO — CMMC Program Frequently Asked Questions, January 2026
https://dodcio.defense.gov/Portals/0/Documents/CMMC/CMMC-FAQsv4.pdf
This is the January 2026 CMMC FAQ PDF, Revision 2.2. It includes the statement that CMMC assessment requirements begin appearing in applicable procurements on Nov. 10, 2025, and that the first 12 months primarily focus on self-assessments.
Disclaimer
The information contained in this communication is intended for limited use for informational purposes only. It is not considered professional advice, and instead, is general information tha
t may or may not apply to specific situations. Each case is unique and should be evaluated on its own by a professional qualified to provide advice specifically intended to protect your individual situation. TK Compliance is not liable for improper use of this information.
Comments