CMMC Certification by the Numbers: DoD Expects 118,289 Contractors to Need a Level 2 Certificate, and About 2,000 Have One

CMMC certification demand is far ahead of supply. The Defense Department’s 2025 acquisition rule estimates 118,289 contractors will need a Level 2 certificate from a third-party assessor, up 54% on its 2024 estimate. The Cyber AB reports about 2,000 certified so far and over 110 authorized assessment firms, and Phase II was suspended on July 13, 2026.

The phase-in timeline, and where it stopped

Dates from 32 CFR 170.3(e), the DFARS final rule (effective November 10, 2025), and the Department of War press release and memo of July 13, 2026. Hollow markers are planned dates that are now suspended or uncertain. Each phase was to begin one calendar year after the previous one.

The press release says the department “will suspend the transition to Phase II requirements of CMMC, as well as pending and future CMMC implementation milestones”. The implementing memo tells program managers they “may not designate CMMC Level 2 (C3PAO) or Level 3 (DIBCAC) assessments during this period” and orders amendments to remove those requirements from active solicitations. The DFARS clause 252.204-7012 obligation to implement NIST SP 800-171 stays in effect.

How many contractors need which CMMC level

DoD has published two estimates. The 2024 program rule (32 CFR part 170) counted 221,286 entities. The 2025 acquisition rule recalculated from Federal Procurement Data System awards, assuming two offerors per solicitation and five subcontractors per offer, and reached 337,968. Level 2 certification, the level that needs a C3PAO, rose from 76,598 to 118,289.

2024 rule: Table 5 of the Regulatory Impact Analysis, 89 FR 83176. 2025 rule: Year 4 mix table in the DFARS final rule’s regulatory flexibility analysis, 90 FR 43560, with its published totals (the size columns differ from the row sums by one because of DoD rounding). Both are DoD planning estimates, not counts of contractors.

Is there enough assessor capacity? The math

The test is simple: divide the certification assessments DoD expects each year by the number of firms allowed to perform them. A Level 2 certificate lasts three years, so at steady state one third of certified entities are assessed each year. We use the Cyber AB’s own lower bounds for capacity (over 110 C3PAOs and over 1,100 CCAs) and DoD’s own assessment hours (a 3-person, 120-hour C3PAO engagement for a small business and a 5-person, 200-hour engagement for a larger one).

Assessor hours tell the same story. At DoD’s engagement hours, the 2025 rule’s steady state is 5.7 million C3PAO team hours a year. Spread over 1,100 CCAs, that is 5,219 hours each, 2.5 times a 2,080-hour full-time year. Even if CCAs worked only the minimum share the rule requires (a Lead CCA and one other CCA per team, 32 CFR 170.9(b)(12)), each would need 2,868 hours, 1.4 full-time years, before counting the separate CCA the rule requires for quality assurance.

Team hours: small entities 120 hours, other entities 200 hours, from the RIA’s C3PAO cost lines. Minimum CCA share assumes hours split evenly across the team and two CCAs per team. Full-time year = 2,080 hours with no leave. Fees use DoD’s $31,234 and $52,056 C3PAO engagement costs. The “pace so far” row annualizes Cyber AB’s count over January 2025 to mid-August 2026; the start month is our assumption from “since early 2025”.

DoD’s phase-in path vs what has been certified

The 2024 rule modeled Level 2 certification over seven years, peaking at 16,610 new entities in Year 4 and 76,598 in total. The roughly 2,000 certificates the Cyber AB reports are above DoD’s Year 1 figure of 517 but below the 3,116 it expected by the end of Year 2 and far below the 11,782 expected by the end of Year 3.

Bars: new Level 2 certified entities per phase-in year, DoD Table 8. Line: cumulative. Red dot: Cyber AB’s reported count, August 2026, plotted at Year 1 for scale. The rule does not tie its model years to calendar dates; we treat Year 1 as beginning with Phase 1.

The renewal column adds back every assessment three years after it happens, per the three-year validity in 32 CFR 170 Table 1. The rule’s preamble text gives 4,452 C3PAO assessments for other-than-small entities in Year 4, while its Table 7 gives 4,317; we use the table.

What CMMC certification costs, by DoD’s estimate

RIA Tables 9 and 10, 89 FR 83178, 2023 dollars, per contractor information system, including planning, the assessment, reporting, and affirmations. Excludes the cost of implementing the security requirements themselves, which DoD treats as already required since 2016 (FAR 52.204-21) and 2017 (DFARS 252.204-7012). Level 3 figures exclude the separate implementation costs (for a larger entity, $21.1 million nonrecurring and $4.12 million recurring).

DoD’s total for the program is $4.00 billion a year in annualized public and government costs (7% discount rate, 20 years). Of a small business’s $104,670 Level 2 cost, $31,234 is the C3PAO fee and $45,809 is outside help: DoD budgets 176 hours of an external service provider at $260.28/hour, because it assumes “small entities are likely to outsource IT and cybersecurity to an External Service Provider”. Our guide to IT compliance explains why MSPs end up inside their clients’ audits.

The ecosystem census

The Cyber AB’s terms of use prohibit bots and automated data gathering on its site, so we did not scrape the CMMC Marketplace and cannot give a state-by-state count. These are the counts the Cyber AB itself published on August 14, 2026, in its response to the department’s reform request for information:

The same document says about 80% of C3PAOs are small businesses, that people and companies from 30 countries take part, and that the program “has been on a capacity-building pace that will result in sufficient C3PAO and CCA participation by the end of the 2028”. The Department of War has not published its own count of Level 2 certificates issued.

What this means for MSPs

The suspension removes the November 2026 deadline, not the obligation: DFARS 252.204-7012 still requires NIST SP 800-171, and Level 2 self-assessments with annual affirmations can be required in new contracts now. DoD’s own cost model assigns about $45,809 of outside help to every small-business Level 2 certification; across the 2025 rule’s 80,436 small entities renewing every three years, that is about $1.2 billion a year of external service provider work at DoD’s rate. The $260.28 hourly rate DoD uses can be set against GSA contract labor rates in our IT hourly rates report. If the third-party requirement returns on anything like the original schedule, assessor capacity, not contractor readiness alone, sets the pace, so clients who want a certificate should book a C3PAO early. MSPs that handle a client’s CUI fall under the external service provider scoping rules in 32 CFR 170.19. Jobs, wages, and establishment counts for managed IT firms are tracked in our MSP industry statistics.

Frequently asked questions

How many companies are CMMC certified?

The Department of War has not published an official count. The Cyber AB, the program’s accreditation body, said on August 14, 2026 that approximately 2,000 defense contractors had attained Level 2 certifications from C3PAOs since early 2025. DoD’s 2025 rule expects 118,289 entities to need one.

What is the current status of CMMC?

On July 13, 2026 the Department of War suspended Phase II, the step that would have required Level 2 certificates from C3PAOs starting November 10, 2026. Phase 1 self-assessment requirements stay in place, contracting officers may only designate Level 1 (Self) or Level 2 (Self), and a reform task force had 60 days to report.

How much does CMMC certification cost?

DoD’s own estimate is $104,670 over three years for a small business Level 2 certification and $117,768 for a larger company, including the C3PAO fee ($31,234 and $52,056), internal labor, and annual affirmations. The estimate excludes the cost of implementing the 110 NIST SP 800-171 requirements.

How long does a CMMC certification last?

A Level 2 or Level 3 certification is valid for three years from the CMMC Status Date, provided the company submits an affirmation of continued compliance every year. Open plan of action items must be closed within 180 days.

Can you self-certify CMMC?

For Level 1 and for some Level 2 contracts, yes: the company assesses itself and posts results in SPRS. DoD’s 2025 rule expects 209,540 entities at Level 1 (Self) and 6,759 at Level 2 (Self). During the 2026 suspension, self-assessments are the only Level 1 and 2 designations allowed in new solicitations.

Are there enough CMMC assessors?

Not for DoD’s own demand estimates. With over 110 C3PAOs, the 2025 rule’s steady state would require about 358 certification assessments per C3PAO per year, against roughly 11 a year delivered so far. The Cyber AB expects sufficient capacity by the end of 2028.

Methodology

References

1. Federal Register, Cybersecurity Maturity Model Certification (CMMC) Program, 89 FR 83092, October 15, 2024. Accessed October 2026.
2. GovInfo PDF of the CMMC Program final rule (RIA tables, pages 83176 to 83178). Accessed October 2026.
3. Federal Register, DFARS: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041), 90 FR 43560, September 10, 2025. Accessed October 2026.
4. U.S. Department of War, “Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements,” July 13, 2026. Accessed October 2026.
5. Department of War CIO, Implementing Suspension of CMMC Phase II (memo and attachment), July 13, 2026. Accessed October 2026.
6. Department of War CIO, Cybersecurity Maturity Model Certification. Accessed October 2026.
7. Department of War CIO, About CMMC. Accessed October 2026.
8. The Cyber AB, response to the DoW’s “Reforming CMMC and Reducing Compliance Burden” RFI, August 14, 2026. Accessed October 2026.
9. The Cyber AB, Terms of Use. Accessed October 2026.