There is no single number for how long CMMC certification takes, because the work depends on your starting security posture, the complexity of your CUI environment, the number of requirements that need remediation, and how quickly you can secure a C3PAO assessment slot. The honest way to plan is by phase, not by a single estimate.
This guide breaks the path into phases so you can plan backward from your contract deadlines and start the slow steps early, instead of discovering a scheduling bottleneck at the end. A note on what we are: we are a readiness Agent-as-a-Service (AaaS) provider. We are not a C3PAO and do not issue certifications.
Status note, September 2026. On July 13, 2026 the Department of War suspended the November 2026 Phase 2 transition. During the suspension, solicitations may designate only CMMC Level 1 (Self) or Level 2 (Self), and Level 2 (C3PAO) requirements are to be removed from active solicitations and existing contracts (DoW CIO memorandum, Attachment 1, cleared for open publication July 13, 2026). This guide describes the Level 2 (C3PAO) path as written in 32 CFR Part 170. See what the suspension changed and what still applies.
Phase 1: Initial Assessment and Scoping
Before you can build a timeline, you need to know what you are working with. This phase involves three activities: defining your CUI boundary precisely, conducting an initial self-assessment against all 110 NIST SP 800-171 security requirements, and establishing your current SPRS score to understand the size of your gap.
If you already maintain NIST SP 800-171 compliance and hold a current SSP that reflects your environment, this phase moves quickly. If you are starting with no documentation, no defined boundary, and minimal security infrastructure, it takes longer to define scope, baseline the environment, and inventory every asset that touches CUI.
Where Agent-as-a-Service helps: Enclave AI reads the read-only configuration of the sources you connect (AWS, Azure, Microsoft 365, Google Workspace, Okta, CrowdStrike), measures the requirements those sources can show, and takes the rest from your intake; the Level 2 Readiness Snapshot PDF arrives within minutes of intake. Defining the CUI boundary stays your team’s job, and your Affirming Official decides what is affirmed. The AI does the legwork; the human owns the decision.
Phase 2: Remediation and Implementation
This is the most variable phase and the one that most determines your overall timeline. Duration depends on how many controls need remediation, how complex those fixes are, and how quickly you can implement changes while keeping the business running.
An organization with a mature program and only a handful of controls to address may need only policy updates, configuration tightening, and evidence documentation rather than wholesale technology deployments. Organizations with significant gaps face a longer road that includes procurement, deployment, configuration, testing, and staff training.
Long-lead items can drive the schedule: procuring and deploying security tooling such as SIEM, EDR, and vulnerability scanners; implementing network segmentation around CUI enclaves; developing and rolling out policies with real staff adoption rather than checkbox compliance; and standing up incident response with documented tabletop exercises. Plan for procurement approval cycles, not just install time.
Not sure how many of the 110 controls you would need to remediate? Start with a free, 10-question gap check. It is a directional self-assessment, not an official SPRS score, but it tells you where the work is. Run the free gap check →
Phase 3: Documentation and Evidence Preparation
Your documentation effort produces the evidence package the C3PAO evaluates. This phase is easy to underestimate when a team focuses on implementing controls and defers documentation until the end, which turns it into a bottleneck.
Key activities: finalizing your System Security Plan so it describes every control implementation accurately, compiling evidence for all 110 controls with screenshots, configurations, logs, and policy documents, organizing that evidence by control family for efficient review, and running a completeness check to find gaps before the assessor does.
If you document controls as you implement them, this phase overlaps remediation and adds little to your total. If you defer it, it becomes its own phase. Platforms that generate and maintain documentation every cycle turn assessment prep into a validation step rather than a from-scratch writing effort. See our CMMC assessment readiness checklist for what the evidence package needs to contain.
Phase 4: C3PAO Scheduling and Pre-Assessment
This phase catches contractors off guard because it depends on factors outside your control. C3PAO scheduling depends on each C3PAO’s backlog, your location, and the complexity of your assessment. Ask for lead times in writing.
Starting C3PAO selection and scheduling early, even before remediation is complete, lets the scheduling wait run in parallel with the work. Whether a booked date can be moved depends on the C3PAO’s terms, but availability that does not exist cannot be created.
Phase 5: The Assessment
Assessors apply three methods, examine, interview, and test (NIST SP 800-171A), to each requirement’s assessment objectives. How long it takes depends on your scope and the C3PAO’s plan, so ask for that plan in writing. Expect documentation and evidence review, technical verification, and interviews with the people who run the controls.
Phase 6: Post-Assessment and Certification
After the assessment, the C3PAO enters the results into the CMMC instantiation of eMASS, which transmits them to SPRS, and issues the Assessment Findings Report (32 CFR 170.17). If every requirement is MET, the status is Final Level 2 (C3PAO). If the score is at least 80 percent and every NOT MET requirement is one 32 CFR 170.21 allows on a POA&M, the status is Conditional Level 2 (C3PAO), and a POA&M closeout assessment by a C3PAO must follow within 180 days or the Conditional status expires. Your Affirming Official then affirms, and affirms again annually (32 CFR 170.22).
How to Compress the Timeline Without Cutting Corners
Four strategies can shorten the path without cutting corners. First, start C3PAO selection and scheduling during remediation, not after, so the scheduling wait runs in parallel. Second, document controls as you implement them so the documentation phase overlaps remediation. Third, use Agent-as-a-Service to keep your gap analysis current and your documentation maintained, so documentation is not written from scratch at the end. Fourth, define your CUI boundary as tightly as you can defend, because a smaller boundary means fewer assets in scope.
Treat compliance as an ongoing system rather than a time-boxed project. Enclave AI re-scans the sources you connect about every seven days and re-issues your readiness package on your tier’s cycle, and your Affirming Official decides what to affirm, so assessment preparation starts from a current record rather than a blank page. For a deeper phase-by-phase view, see our CMMC certification process timeline, and if you are weighing your assessment path, read CMMC self-assessment requirements.