Article Summary: Companies handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) under a Department of Defense (DoD) contract move through six phases to reach Cybersecurity Maturity Model Certification (CMMC) compliance: assessment, infrastructure buildout, controls implementation, readiness verification, third party audit, and ongoing compliance. The core requirements are unchanged for organizations of any size. Company size and complexity change the scope of work inside each phase, while the phases themselves stay the same.
If you handle FCI or CUI on a DoD contract, one of the first things you probably want to know is how long CMMC compliance takes. That depends on your company size and how much of your organization touches CUI.
The process itself follows a set sequence of phases, and each one produces something the next phase builds on. In this article, you’ll learn what happens in each phase, what it produces, and how the final phase keeps you compliant after certification.
Phase 1: Assessment and Documentation
Every CMMC effort starts with an honest look at where your business stands today.
That means reviewing your environment against the 110 security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171. They are grouped into 14 control families covering areas such as access control, incident response, and system integrity, as outlined in the CMMC model overview from the DoD Chief Information Officer (CIO).
The review produces two documents you will rely on for the rest of the process. The gap assessment shows how your current setup compares to each requirement. The Plan of Action and Milestones (POA&M) lists the work still needed to close those gaps.
This is also the right time to start your System Security Plan (SSP). The SSP describes how your organization implements the security requirements. Starting it early gives you one place to record decisions as they happen, so you are not reconstructing them months later.
Phase 2: Infrastructure Buildout
This is where the environment itself gets built to handle FCI and CUI properly. For most organizations, that means a Microsoft Government Community Cloud (GCC) environment, or GCC High if your CUI involves export controlled data under the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR).
The main decision in this phase is scope. You can move the entire organization into that environment, or isolate only the users and systems that touch CUI in a smaller enclave while the rest of the business stays on its existing setup.
Smaller organizations usually find a full move simpler to manage. For larger or more complex organizations, a carefully scoped enclave can reduce both cost and ongoing overhead.
Phase 3: Controls Implementation
With infrastructure in place, this phase works through the POA&M item by item. That includes building out policies and procedures, setting up security awareness training for employees, establishing a regular vulnerability scanning schedule, and drafting an incident response plan.
The System Security Plan gets finalized here, so it documents what is in place today.
Phase 4: Readiness Verification
Before bringing in an outside assessor, take one more internal pass to confirm your business is ready. Phase 1 mapped your gaps. This check confirms they are closed: all 110 controls are in place, and your SSP and POA&M match what exists.
This is also when you collect the evidence the auditor will need to see, showing that every control has been implemented. Taking this step now helps you catch gaps before an outside party does, which means fewer surprises during the formal audit.
Phase 5: Third Party Audit
A third party audit is an independent review of your security program by an outside organization.
Under the CMMC program rule in the Code of Federal Regulations (CFR) at 32 CFR Part 170, Level 2 certification for contractors that handle CUI is built around this review. It is performed by a CMMC Third Party Assessment Organization (C3PAO), which evaluates whether your business meets all 110 security requirements.
Phase 6: Ongoing Compliance
Once you reach compliance, the work shifts to keeping it. That means continuous monitoring, regular vulnerability scanning, access reviews, refresher training, and reporting to leadership on where things stand.
Requirements can also shift as regulations evolve. Any agreement covering ongoing compliance work should spell out how scope changes get handled if the rules change again. The DoD CIO’s CMMC program page is the best place to track those changes as they happen, since the program office updates it directly.
Conclusion
CMMC tends to feel overwhelming when it sits on the calendar as one large deadline. Breaking it into phases changes that. Each phase produces something the next one builds on, and your company’s size changes how much work sits inside each phase without changing the order. That turns a distant deadline into a project plan you can budget for.
If you want to know where your organization stands today, a gap assessment is the place to start. Let’s talk through what closing your gaps would involve.
FAQ
Do all six phases apply to small companies too?
Yes. Every company moves through the same phases. The amount of work inside each one depends on size, since a company of 15 people has a smaller environment to assess, build, and verify than one with 400.
What is a CMMC third party audit?
It is an independent assessment in which an authorized C3PAO, an outside organization, evaluates whether your business meets all 110 NIST SP 800-171 requirements. Under 32 CFR Part 170, a passing result earns a Certificate of CMMC Status.
Is the CMMC third party audit requirement currently paused?
Yes, for now. On July 13, 2026, the Department of War suspended CMMC Phase II requirements, which would have made third party assessments a contract requirement starting November 10, 2026. The Department also formed a CMMC Reform Task Force to review the program over 60 days.
The pause does not change your underlying obligations. Self assessment requirements remain in place, and defense contractors are still contractually required to safeguard covered defense information under Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012. During the pause, the Department says it will enforce compliance with NIST SP 800-171 through self assessments and select government led assessments.
What’s the difference between the System Security Plan and the POA&M?
The SSP describes how your organization meets each of the 110 controls in practice. The POA&M tracks what’s still outstanding and the plan to close it. Both start in Phase 1 and get finalized by Phase 3.
Does GCC High apply to every organization?
Not necessarily. A standard Microsoft GCC environment covers most CUI handling. GCC High becomes relevant specifically when your CUI includes export controlled data subject to ITAR or EAR.
How long does the full process take?
It depends heavily on company size, existing infrastructure, and how much of the organization touches CUI, which is exactly what Phase 1’s assessment is designed to determine.
About the Author: scott
Commercial Microsoft 365 falls short of CMMC requirements for protecting CUI. Here’s how to tell whether GCC or GCC High is the right fit for your contract.
FCI and CUI carry very different obligations. Which one your company handles decides your CMMC level and how much compliance work you’re signing up for.
A GCC migration means building a new Microsoft 365 environment from scratch and moving your business into it. Here's what the process involves and what tends to catch people off guard.
The Department of War suspended the CMMC third party assessment requirement in July 2026, and self assessment and DFARS obligations remain in force. Here is what changed and what contractors still need to do.
CMMC compliance comes down to five phases that take you from your first gap assessment to a third party audit. A sixth phase of ongoing maintenance keeps you compliant once you get there.
Boeing has been messaging its supply chain about CMMC readiness, on a schedule separate from the government’s. Here’s what that means in practice.
Phishing emails used to give themselves away through bad spelling. AI has closed that gap, so your team needs a better way to tell what is real.
Most compromised business websites were never singled out. An automated tool found an outdated plugin and took it from there. Here's how to tell if your site carries that same risk, and what a fix actually looks like.
A cloud outage does not need a hacker behind it to shut down your business for a few hours. A short continuity plan is what keeps your team working and your customers informed until service returns.
Zero Trust is no longer just for large enterprises. For small businesses, it offers a practical way to limit access, reduce risk, and protect critical data as cloud tools, remote work, and modern threats change how security needs to work.
STAY IN THE LOOP
Subscribe to our free newsletter.
