CMMC is not a one-week project. Where you land depends on three things: scope discipline, internal capacity, and how much of the readiness work is automated. This guide walks the path phase by phase, with the places where months can be lost. One clarification up front: we are a readiness Agent-as-a-Service (AaaS) provider. We are not a C3PAO and do not issue certifications.
Status note, September 2026. On July 13, 2026 the Department of War suspended the November 2026 Phase 2 transition. During the suspension, solicitations may designate only CMMC Level 1 (Self) or Level 2 (Self), and Level 2 (C3PAO) requirements are to be removed from active solicitations and existing contracts (DoW CIO memorandum, Attachment 1, cleared for open publication July 13, 2026). This guide describes the Level 2 (C3PAO) path as written in 32 CFR Part 170. See what the suspension changed and what still applies.
The short answer
The timeline scales with scope and starting maturity. A small CUI enclave with prior NIST SP 800-171 work and automation across documentation and evidence moves fastest. A complex, multi-site environment with no prior 800-171 work takes the longest. The C3PAO assessment itself is a short window of execution; the scheduling lead time before it depends on assessor availability you do not control. Confirm current C3PAO scheduling lead times for your region, since they shift with assessor supply and demand.
Phase 1: Scoping and gap assessment
Identify every system, asset, person, and location that processes, stores, or transmits CUI. Decide what is in scope and what gets segmented out. Run a gap assessment against the 110 NIST SP 800-171 Rev 2 requirements. Output: scope diagram, asset inventory, control gap list, and a decision on enclave architecture.
Where time is lost: arguing about scope after the fact. Decide on scope, write it down, and lock it before anyone touches an SSP.
Phase 2: SSP, policies, and POA&M
Author the System Security Plan, with all 110 controls described against your environment. Draft or update policies covering each control family. Stand up the POA&M with each open gap, its owner, target close date, and risk. Output: SSP draft, policy set, POA&M v1.
Where time is lost: the SSP. Much of the cost here is preparation and documentation, which is work AI can compress. On a readiness subscription, Enclave AI drafts the SSP from your intake, the read-only configuration of the sources you connect, and your attestations, and your Affirming Official reviews it and decides what is affirmed.
Before you commit weeks to an SSP, get a directional read. The free gap check asks ten questions on ten NIST SP 800-171 requirements; it is a directional self-assessment, not an official SPRS score, and a place to start. Run the free gap check →
Phase 3: Remediation
Close the technical gaps: multifactor authentication, FIPS-validated cryptography protecting CUI, audit logging with retention, malicious code protection such as EDR, patch and vulnerability management, configuration baselines, segmentation, backup with restoration testing, privileged access management, and incident response procedures. Output: a remediated environment with evidence.
Where time is lost: tool sprawl. Picking several tools when one would do, then spending months integrating them. Remediation is real engineering work and it takes the time it takes.
Phase 4: Evidence collection and mock assessment
For every control you need evidence: screenshots, configuration exports, log samples, policy excerpts, training records. Organize it by control. Run a mock assessment with someone who is not on your team, and fix what they find. Output: an evidence package and a pre-assessment readiness report. See the CMMC assessment readiness checklist for the full list of what to have ready.
Where time is lost: evidence chaos. Scattered folders, several trackers, and nobody sure where the firewall config lives. This phase is where automation helps.
Phase 5: C3PAO assessment
The C3PAO conducts a formal assessment: interviews, technical inspections, documentation reviews. Each requirement is found MET, NOT MET or NOT APPLICABLE (32 CFR 170.24). Output: assessment results posted to the CMMC instantiation of eMASS and, if the result qualifies, a Final or Conditional Level 2 (C3PAO) status (32 CFR 170.17).
Where time is lost: scheduling. Book your C3PAO early, because the assessment date depends on assessor availability you do not control.
Phase 6: POA&M closure and steady state
POA&M items must pass a closeout assessment within 180 days of the Conditional status date, or the status expires (32 CFR 170.17 and 170.21). Not every requirement is POA&M-eligible, so confirm the rule for your situation. From there, annual affirmation, ongoing monitoring, and triennial re-assessment continue.
Where months can be lost
Five places: SSP authoring, evidence chaos, tool selection without scope discipline, waiting on C3PAO scheduling, and late discovery that a flowdown clause requires CMMC before a contract renewal. Pre-empt all five and you remove five causes of delay.
How Agent-as-a-Service compresses the CMMC timeline
Agent-as-a-Service targets the documentation and evidence phases. Enclave AI re-scans the read-only configuration of the sources you connect about every seven days, drafts the SSP and POA&M and re-issues them on your tier’s cycle, and keeps the relevant excerpt of the API response behind each measured finding on file with a SHA-256 hash. Requirements no connected source can show are answered from your team’s evidence. Remediation still takes time because it is real engineering work. Your Affirming Official decides what is affirmed. This is operational leverage for your team, not a replacement for it.
A timeline you can hand to your CEO
The honest framing for leadership: the C3PAO assessment is the same regardless of how you get there. What compresses is the work to get there. Disciplined scope and Agent-as-a-Service handling documentation and evidence target the preparation work, without cutting compliance corners. If you are deciding whether you even need a C3PAO, read CMMC self-assessment requirements.