If you search for "CMMC deadline" right now, you get two stories that can't both be true. Some pages still warn that CMMC "becomes mandatory" in October or November 2026. Others say the whole program was "delayed to 2028." Small contractors reading both are understandably confused.
The short answer for a Level 1 company: there is no new deadline this fall, and nothing was pushed to 2028. Your Level 1 requirements already apply today. Here is how the dates actually fit together.
Where the November 2026 date came from
The CMMC program rule (32 CFR part 170) rolls CMMC into contracts in four phases:
- Phase 1, November 10, 2025: solicitations can require Level 1 (Self) or Level 2 (Self).
- Phase 2, November 10, 2026: was set to add Level 2 certification by a third-party assessor (C3PAO).
- Phase 3, November 10, 2027: was set to add Level 3.
- Phase 4, November 10, 2028: full implementation across applicable contracts.
So November 10, 2026 was a real date, but only for Phase 2, the third-party Level 2 assessments. It was never a Level 1 deadline. Level 1 started with Phase 1, almost a year ago.
What changed in July and September
In July 2026, the Department of War suspended Phase 2 and the milestones after it while a CMMC Reform Task Force reviews the program. In September, Class Deviation 2026-O0025, Revision 3, told contracting officers to accept self-assessments for Level 1 and Level 2 and to take third-party assessment requirements out of solicitations and contracts.
Pages written before July, or never updated since, still describe the November 2026 date as if it were coming. That is where the "October or November deadline" warnings come from.
Why "delayed to 2028" is also wrong
The class deviation repeats the November 10, 2028 date, and some readers took that as a new delay. It isn't one. That date is the original Phase 4 date from the rule. The deviation reprinted it; it didn't create it or move CMMC to it.
The Task Force's report has not been made public. Until it is, nobody knows what the next timeline looks like, and anyone quoting a new firm date is guessing.
What applies to a Level 1 contractor today
None of the above changes these obligations:
- The 15 safeguarding requirements in FAR 52.204-21. They have been in federal contracts since 2016, before CMMC existed. If your contract has the clause, you are expected to meet them now.
- The Level 1 self-assessment. Under Phase 1, a solicitation can require Level 1 (Self). You check yourself against the 15 requirements and enter the result in the Supplier Performance Risk System (SPRS). Every requirement must be met; there is no plan of action for Level 1.
- The annual affirmation. A senior official affirms in SPRS each year that the company meets the requirements and will keep meeting them. That is a statement to the federal government, and it should be accurate.
A current self-assessment and affirmation in SPRS is a condition of award when the solicitation calls for it. That is the real deadline: the day you want to bid on, or receive, a contract that requires Level 1, not a date on a calendar this fall.
What this means in practice
- If you haven't done your Level 1 self-assessment, don't wait for a date. A solicitation with the requirement can arrive at any time, and fixing gaps after the fact is too late for that award.
- If you already affirmed, put the renewal on the calendar. The affirmation is annual.
- If you handle CUI, the Level 2 picture is the part that is genuinely on hold. Keep working on NIST SP 800-171 anyway: DFARS 252.204-7012 and your SPRS score still apply.
- Be skeptical of urgent dates. If a page gives you a hard CMMC deadline, check whether it was written before July 2026 and whether it is talking about Level 1 or Level 2.
A quick way to check where you stand
Start with our free CMMC Level 1 checklist, a plain-English list of the 15 requirements. If you want to go further, Fix&Affirm walks through each requirement, shows how to fix gaps and produces the document pack behind your SPRS affirmation. The assessment is free.
Start your free Level 1 assessment
This article is general information, not legal advice. CMMC timelines may change after the Task Force review; check your solicitation and the current rules before you act.