The CMMC Certification Process, Step by Step

The sequence below is the one that works, and the order is not arbitrary. Nearly every expensive mistake in this process comes from doing step four before step two.

One framing note: third-party certification is currently suspended, so what follows is the path to a defensible self-assessment rather than a certificate. The work is identical up to the final step, which is why pausing the programme is rarely the right response to the pause. See program status.

1. Establish what applies — days

Read the clauses in your contracts and subcontracts. FAR 52.204-21 means FCI and Level 1. DFARS 252.204-7012 means CUI and Level 2. This takes an afternoon and determines whether you owe 17 practices or 110. Full test on does CMMC apply to my company.

2. Scope the boundary — one to six weeks

Trace where CUI enters, where it comes to rest, and what supports those systems. This is the single largest cost driver in the entire process, and the step most often rushed.

The output is a defensible boundary and a data flow you can explain system by system. Get it wrong wide and you pay to harden things that never needed it; get it wrong narrow and you have CUI outside your controls. See finding CUI in your environment.

3. Score honestly — one to three weeks

Assess against all 110 requirements, at objective level. Expect the number to be lower than you hoped and lower than a quick self-assessment suggested; that gap is the point of doing it properly.

The calculator gives a working figure in about ten minutes. A defensible figure takes longer and involves looking at configurations rather than recollections.

4. Remediate in point order — three to twelve months

This is where the time and most of the money goes. Sequence by points per unit of effort rather than by what is interesting: four families — Access Control, System and Communications Protection, Configuration Management, System and Information Integrity — hold 160 of the 313 points at risk.

The two most-failed requirements in DIBCAC’s published data are FIPS-validated cryptography and multi-factor authentication, both of which are also partial-credit controls. They are a sensible place to start.

5. Document — four to eight weeks, overlapping

The System Security Plan under requirement 3.12.4, policies written to objective level, the POA&M limited to what may lawfully be deferred, and an evidence package mapped to objectives rather than to requirements.

Documentation written after remediation is faster and more accurate than documentation written in parallel with it, but it should never be left until the end — assembling evidence for work done eight months ago is how projects lose a month. See the SSP template.

6. Post and maintain — ongoing

Post the score to SPRS with the standard, the date and the scope. Then keep it current: refresh whenever the environment materially changes and at least annually.

This step does not end. A score that was accurate when posted and was left standing after it stopped being accurate is the precise shape of False Claims Act exposure, and the reason a contractor settled for roughly $500,000 in June 2026.

What changes when certification resumes

Only the final step gains a stage. Steps one through six are what an organisation owes under DFARS 252.204-7012 regardless of the programme’s status, which is why the suspension is a change in verification rather than in obligation. If and when third-party assessment restarts, a seventh step appears: engaging an authorised C3PAO, submitting the System Security Plan and evidence package for review, and sitting the assessment itself. See C3PAO assessments.

The organisations that will find that step cheap are the ones whose evidence was assembled continuously rather than reconstructed. An evidence package built to objective level as remediation completed is a package an assessor can work through; a package assembled retrospectively from memory and screenshots is where assessment costs escalate, because every ambiguity becomes a question and every question consumes assessor hours you are paying for.

Realistic timelines

Small contractor, tight enclave, willing to change how people work: three to six months.

Mid-sized, CUI across several systems, multiple primes: nine to eighteen months, with scoping alone taking two of them.

Anyone who starts at step four: longer than either, because the remediation gets redone once the boundary is finally established.

If you want the first three steps done properly and quickly, that is what a readiness assessment is.

For the third-party step, see how a C3PAO assessment works; for budgeting, CMMC certification cost. If you want the scoping and scoring done with you, that is a CMMC readiness assessment.