Almost every defense contractor I talk with these days opens with the same question, usually in a slightly anxious tone: how long is this going to take, and how long is the audit itself? This fall the question comes with a complication. On July 13, 2026, the Department of War suspended Phase 2 of the CMMC rollout, which had been scheduled to make C3PAO certification a condition of award starting November 10, and as of this writing no restart date has been announced.
So I will answer in two parts: where the pause leaves you today, and how long certification takes on its own merits, assuming the requirement comes back, which nearly everyone I work with expects it will in some form. On that second point the honest answer has not changed. A typical small or midmarket organization should plan on nine to eighteen months to reach an assessment ready posture, and roughly thirteen to twenty six months to a Level 2 certificate in hand once the assessor queue is counted, and the formal assessment, the part everyone worries about, accounts for only two to four weeks of that window.
The pause removed the mandate, not the obligation. Under the CMMC Reform Memorandum and its companion implementation memo, program offices can no longer designate Level 2 C3PAO assessments, and DFARS Class Deviation 2026-O0025, Revision 3, signed September 3, directs contracting officers to remove C3PAO requirements from active solicitations and existing contracts at the next option period or administrative modification.
What stays in force is the part that carries the legal risk. DFARS 252.204-7012 and NIST SP 800-171 Rev. 2 still apply to anyone handling CUI, Phase 1 self assessments and SPRS submissions remain in place, and the annual affirmation still needs a senior executive's signature. False Claims Act exposure has not gone anywhere either, and Honeywell Aerospace's $2 million settlement on September 1 was a pointed reminder that an inaccurate SPRS score is a liability whether or not a C3PAO ever looks at it.
The reform effort itself is unresolved. The Reform Task Force's 60-dayy review closed in mid September, the RFI drew roughly 1,100 responses, and reporting from late October indicates the task force has floated restarting Phase 2 for a narrower population within 90 days, though that is still a recommendation rather than a decision. Some primes are also holding their own certification deadlines regardless of the federal pause, so check what your customers are asking for before you shelve anything.
If you survey the published estimates, you will find a surprisingly wide spread, and that spread tells you something important about where the effort sits. The more optimistic guidance puts Level 2 preparation at six to twelve months for an organization with reasonable security hygiene. Practitioners who track their own engagements tend to land higher, with one firm reporting twelve to eighteen months for organizations starting from scratch and eight to twelve months for those that already run a NIST SP 800-171 program. Coalfire Federal, which operates as a C3PAO, tells contractors to plan for twelve to twenty-fourty four months from the initial gap analysis to a final certification decision, and Redspin's research on DIB readiness found that the preparation phase alone runs longer than a year on average.
My own experience sits squarely in that middle band. A midmarket firm running Microsoft 365 with a competent IT partner, some existing policy documentation, and executive sponsorship can usually reach a defensible, assessment ready posture in nine to twelve months. An organization that is discovering for the first time where its CUI actually lives should expect closer to eighteen.
Three variables account for most of the difference between a nine-month program and an eighteen month one, and none of them are about which tools you buy.
Scoping comes first, and it pays for itself
Organizations that finish a thorough scoping exercise before they start remediating save roughly four months compared with those that try to scope while they remediate. Defining a tight CUI enclave, rather than dragging the entire enterprise into the assessment boundary, shrinks the number of assets, users, and processes an assessor has to examine, and it keeps your engineering effort pointed at the systems that matter.
Documentation is the critical path, not the afterthought
Most technical teams can deploy MFA, logging, and endpoint controls faster than leadership expects. What drags is the System Security Plan, the policies and procedures behind each of the 110 requirements, and the evidence that proves those controls operate the way the paperwork says they do. Assessors examine, interview, and test, and an SSP that describes an environment your administrators do not recognize will surface quickly.
Starting posture sets the floor
An honest SPRS score and a gap assessment you trust tell you more about your timeline than any vendor brochure. A firm sitting at a strongly negative score with no POA&M discipline has a very different road ahead than one that has been maintaining NIST SP 800-171 alignment for a few years.
Here is the part that tends to surprise people: the formal C3PAO assessment is short. Lazarus Alliance recently published benchmark data from 47 completed Level 2 assessments conducted between January 2025 and June 2026, and the median formal assessment ran 17 days. Well prepared organizations, those at the 25th percentile, finished in 11 days, while the 75th percentile came in at 26. The outliers that stretched past 35 business days were almost always multisite enterprise boundaries or organizations trying to remediate evidence gaps in the middle of the assessment, which is precisely the situation good preparation is meant to prevent.
Once fieldwork wraps, plan on roughly two to four more weeks for the C3PAO's internal quality review and the Cyber AB process before the certification decision lands. The result, if things go well, is a Level 2 certificate valid for three years, with an annual affirmation of continued compliance required in between.
Before the pause, getting onto a C3PAO's calendar had quietly become the longest single step in the process. As of early 2026, C3PAOs were reporting average waits of about six months just to begin a formal assessment, against roughly 80 authorized assessment organizations and an estimated 80,000 contractors that would need Level 2 certification.
The pause has drained that queue for now, and some C3PAOs are reportedly cutting staff. That is not a reason to relax. When the requirement returns, every contractor that shelved its program in July will try to schedule at the same moment, against an assessor community that may be smaller than it was this spring. Setting the pause aside, the end to end math is roughly nine to eighteen months of preparation plus a scheduling wait that ran three to six months before July, and it is reasonable to expect that wait to return, possibly longer, once a restart date is set.
When a client asks me how long this will take, I give them the range, but I spend more time on sequencing, because the order in which you do the work matters more than the speed at which you do it.
None of this is glamorous, but a program built this way holds up under scrutiny, and watching a client walk out of a clean assessment after a year of disciplined work is, frankly, awesome. The firms that struggle are almost never the ones with the weakest technology; they are the ones that started late, scoped loosely, and treated the paperwork as something to finish the week before the assessor arrived.