The November 2026 CMMC Deadline
What It Means for You
The Date Shapes Your Contract Timeline
The November 2026 deadline marks a contract eligibility threshold. A current Cybersecurity Maturity Model Certification (CMMC) status in the Supplier Performance Risk System (SPRS) is required to maintain award eligibility from that date.
Starting November 10, 2026, a current CMMC status in SPRS becomes a condition of award for new Department of Defense (DoD) contracts. Any recompete, any renewal, any option period exercise triggers the requirement. Existing contracts do not extend that window indefinitely. Companies that start now finish with time, budget, and options to spare.
A Four-Phase Rollout.
Already Underway
CMMC is being phased into DoD contracts on a defined schedule. Each phase expands the requirement. Phase 1 is already live. Knowing where your contracts sit in this timeline clarifies how much time remains to act.
CURRENT PHASE
NEXT PHASE
EXPANDING
FINAL
CONDITION
Four Contractor Profiles.
One Deadline
The deadline applies the same way regardless of company size, contract value, or how long your company has worked with the DoD. Starting posture and time to compliance vary by organization.
You hold the DoD contract directly and you are registered in SAM.gov. Your organization falls within scope. A self-assessment started today can close before the deadline. Most Level 1 engagements take 4 to 12 weeks from first scoping call to SPRS submission.
- Award eligibility after November 10, 2026
- Contract renewal and option rights
- Affirming official personal liability
- Confirm which systems touch Federal Contract Information (FCI)
- Designate an affirming official for SPRS
- Book a scoping call
Your obligation comes from your prime, not directly from the DoD. CMMC requirements flow down through the contract. Most subcontractors in logistics, staffing, facilities, and professional services confirm this through a prime contractor audit or a new solicitation requirement.
- Active SPRS compliance protects against prime termination exposure.
- Supply chain position depends on SPRS status
- Prime termination rights apply to compliance gaps
- Review subcontract language for Defense Federal Acquisition Regulation Supplement (DFARS) clauses
- Confirm SPRS requirements with your prime
- Check whether your contract involves FCI or Controlled Unclassified Information (CUI)
Web apps are one of the most targeted surfaces across enterprise environments. Business logic flaws, broken authorization, and API vulnerabilities give attackers access that automated scanners consistently miss.
- Each in-scope contract requires its own SPRS coverage.
- Consolidated engagements cover all scopes in a single submission cycle.
- Every contract in scope requires its own affirmation
- List every active DoD prime and subcontract
- Identify contracts containing FAR 52.204-21 or DFARS 252.204-7021
- Request a consolidated scoping call
Option period exercises and recompetes are the most missed trigger. An existing contract relationship does not provide continuity at renewal. Every contract action that brings work back into competition or extends it formally triggers CMMC status as a condition of award.
- Renewal eligibility depends on active SPRS status
- Enforcement begins the moment the contract action initiates
- Recompetes require prior compliance
- Check renewal and recompete dates on every contract
- Confirm assessment completion fits within the timeline
- Start the engagement at least 12 weeks out
Every Signatory Carries
Personal Legal Responsibility
Level 1 compliance is affirmed by name. That affirmation is a legal attestation, not an administrative checkbox.
Steps From Scoping To SPRS Submission
The first call establishes your contract timeline, your starting posture, and which service path fits the time you have left.
Contract scope and timing vary by solicitation. The first step identifies which contracts are in scope and when the relevant contract action occurs.
Identify every system, device, and location that touches FCI. Scope determines how long the engagement takes and which areas require remediation first.
Evaluate current posture against all 15 Federal Acquisition Regulation (FAR) 52.204-21 requirements. Document each gap with remediation priority.
Complete remediation, finalize documentation, and support the affirming official through SPRS submission before the contract action triggers the requirement.
Why Companies
Miss a Deadline
They Saw Coming
Most companies in scope know the deadline exists. The same set of delays appears on almost every scoping call, and every one of them is resolvable before assessment begins.
