How Long Does CMMC Certification Take?

By Shaheer Malik · Updated Oct 28, 2026

The rule sets no preparation time; how long CMMC takes depends mostly on how far you are from meeting the requirements when you start. What the rule does fix is the end: a Conditional status must be closed out within 180 days, and a Final Level 2 or Level 3 status lasts three years with an affirmation every year. Level 1 is redone every year.^[1]

What drives the timeline

Your starting point. A company already meeting most of the 110 requirements needs a short gap review; one starting from scratch needs remediation projects first.
Scope. The more systems and people that touch CUI, the more there is to secure. Many companies shorten this by moving CUI into an enclave.
Assessor availability. Secureframe counted 103 C3PAOs in March 2026, against at least 80,000 organizations then expected to need Level 2 certification.^[2] Book early if your customer asks for a C3PAO assessment.
POA&M items. Passing with a Conditional status gives you up to 180 days to close the allowed open items.^[1]

Fixed dates in the rule

Item	Time
Level 1 self-assessment	Every year
Level 2 and Level 3 status	3 years
Affirmation	After each assessment and every year
POA&M closeout (Conditional status)	Within 180 days
Keeping assessment evidence	6 years

All from 32 CFR part 170.^[1]

How DoD sized the effort

DoD’s cost estimates for a small business assume the requirements are already implemented, and still put the Level 2 self-assessment and affirmation at about $34,277 of staff and adviser time, and a C3PAO certification assessment at about $101,752.^[3] That is the size of the assessment work alone, before any remediation.

For a realistic plan, ask two consultants to scope your environment and give you a timeline in writing. Find consultants by state or get up to 3 quotes.

FAQ

How long is a CMMC certification valid?

A Final Level 2 (C3PAO) or Level 3 (DIBCAC) status lasts three years, with an affirmation every year. Level 1 is a yearly self-assessment.

How long do I have to close a CMMC POA&M?

180 days from the Conditional CMMC Status Date. If the items aren’t closed out in time, the Conditional status expires.

Can I get CMMC certified quickly?

Only if you already meet the requirements. The assessment itself is the short part; scoping and closing gaps take most of the time.

Sources

32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
Secureframe: The CMMC ecosystem (figures as of March 2026) (checked Oct 16, 2026)
Cybersecurity Maturity Model Certification (CMMC) Program, 32 CFR part 170, 89 FR 83092 (Oct 15, 2024) (checked Oct 16, 2026)

Get quotes from matching firms

Describe what you need once. It goes to up to 3 matching firms, never published or sold.

Request quotes

Independent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.