CMMC Calendar

Two federal actions in 2002 set the stage for the compliance framework Hawaii and Guam defense contractors follow today. The Federal Information Security Management Act (FISMA) required every federal agency to build, document, and continuously assess a formal information security program, establishing that cybersecurity was a matter of ongoing management, not a one-time checkbox. That same year, the Cybersecurity Research and Development Act directed new funding to the National Institute of Standards and Technology (NIST) and the National Science Foundation for network security research.

Neither action mentioned CMMC by name, since the program did not exist for another 17 years, but both created the research base and legal precedent that federal cybersecurity requirements eventually built into DFARS, NIST SP 800-171, and the CMMC framework contractors comply with now. For a CMMC provider explaining program history to a new client, 2002 is the year cybersecurity compliance first became a documented, agency-wide federal obligation rather than an informal best practice.

For Hawaii and Guam organizations working defense contracts today, 2002 is a useful answer to the question of why an IT provider needs to document everything rather than just fix problems as they arise. FISMA-style documentation requirements are the ancestor of the System Security Plan and Plan of Action and Milestones every CMMC Level 2 contractor now maintains.

In 2003, NIST's Risk Management Framework effort, sometimes called the FISMA Project, began publishing the standards documents that still underpin CMMC assessment criteria: FIPS 199 for security categorization, FIPS 200 for minimum security requirements, and the first version of NIST Special Publication 800-53 for security and privacy controls on federal systems.

These publications established the control-based approach to cybersecurity that NIST later adapted for nonfederal systems in NIST SP 800-171, the standard that defines CMMC Level 2 requirements today. For contractors seeking a CMMC gap assessment now, these decades-old federal control families are the direct ancestor of the 110 security requirements they must implement, and the same control-family structure still shapes how a CMMC consultant organizes a remediation roadmap.

Contractors preparing for a CMMC Level 2 assessment often ask why NIST 800-171 controls feel so granular and interrelated rather than a simple checklist. The answer traces back to the control-family structure NIST built in 2003, which every subsequent NIST publication, including 800-171, inherited almost intact.

President Obama signed Executive Order 13556 in November 2010, establishing the Controlled Unclassified Information (CUI) program and rescinding the patchwork of agency-specific "sensitive but unclassified" designations that came before it. EO 13556 created a single, government-wide framework for identifying, marking, and safeguarding CUI, the category of information that now defines CMMC Level 2 scope.

Without this order, there would be no consistent legal basis for the CUI protections written into DFARS clause 252.204-7012 or the 110 controls in NIST SP 800-171. For Hawaii and Guam contractors handling Controlled Unclassified Information today, CMMC scoping still starts with the same question EO 13556 first forced federal agencies to answer: what is CUI, and where does it live in your environment? Answering that question correctly is still the first step in any CMMC gap assessment, and getting it wrong is one of the most common reasons contractors either over-scope their CMMC Enclave boundary or miss CUI entirely.

Hawaii and Guam subcontractors that receive CUI-marked deliverables from a prime contractor are seeing EO 13556's labeling framework in action every day. Getting CUI identification right at the subcontractor level is one of the most common gaps Intech Pacific finds during a CMMC gap assessment.

The Department of Defense proposed DFARS Case 2011-D039 in 2011, introducing rule 252.204-7000 to require contractors to safeguard unclassified DoD information related to fundamental research. It was a narrow rule focused on research contracts, but it marked the first time DFARS explicitly required contractors to protect sensitive unclassified information on their own systems rather than only inside government networks.

This proposed rule opened the door to the much broader safeguarding requirements that followed later in the decade, and it remains a useful reference point for understanding how DFARS cybersecurity requirements evolved from narrow, contract-specific clauses into the sweeping CMMC framework in place today. It is also a reminder that CMMC compliance obligations have always started as proposed rules with a public comment period, the same process the CMMC Program itself went through more than a decade later.

This early, narrow rule is a reminder that CMMC obligations rarely arrive all at once. Contractors that build a habit of monitoring DFARS case numbers each year tend to be far better positioned to anticipate change than those who wait for a prime contractor to forward a new clause after the fact.

DFARS clause 252.204-7000 became effective in 2013, formally requiring contractors to protect sensitive unclassified defense information on non-federal systems. While the clause applied to a limited set of contracts, its effect on the defense industrial base (DIB) was significant: contractors could no longer treat cybersecurity as optional or assume that government-owned networks were the only systems that needed protecting.

This rule is a direct predecessor to today's CMMC Level 1 and CMMC Level 2 requirements, and it is often the starting point Intech Pacific uses when explaining to new clients why CMMC compliance is not a sudden new burden, but the latest step in a rule set defense contractors have been building toward for over a decade. Contractors who trace their compliance obligations back to this rule tend to have an easier time understanding why CMMC cost is proportional to scope, not an arbitrary fee tied to a new certification.

Contractors who signed defense contracts after 2013 have likely carried DFARS 252.204-7000 obligations for over a decade without realizing how directly they connect to today's CMMC Level 1 requirements. A CMMC gap assessment often uncovers these long-standing but neglected obligations hiding in plain sight.

NIST published Special Publication 800-171, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations," in 2015. This publication remains the single most important document in the entire CMMC ecosystem: its 110 security requirements, organized into 14 control families, are the backbone of CMMC Level 2 today.

Every CMMC gap assessment Intech Pacific performs for Hawaii and Guam contractors ultimately measures posture against this document. Understanding NIST SP 800-171 is not optional for any organization that wants to work with a CMMC consultant, pursue CMMC certification, or prepare for a C3PAO assessment; it is the foundation the entire CMMC Level 2 model was built on, and it is the document a CMMC Assessor will reference line by line during a certification assessment.

Any organization asking a CMMC MSP for a CMMC cost estimate should expect that estimate to be driven primarily by how many of the 110 NIST SP 800-171 controls from this 2015 publication are already in place, and how many still need to be built, documented, and operated continuously.

DFARS clause 252.204-7012 took effect in 2016, and it remains one of the most consequential rules in defense contracting history. The clause required all DoD contractors handling covered defense information to implement the 110 security requirements in NIST SP 800-171, report cyber incidents within 72 hours, and flow the same requirements down to subcontractors.

It also introduced the compliance mechanism CMMC would later formalize: contractors were expected to self-assess and attest to their own security posture, without independent verification. That gap between self-attestation and actual, verified compliance is precisely the problem CMMC was created to solve three years later. Any CMMC MSP working with legacy defense contractors today will recognize DFARS 7012 language embedded in decade-old contracts that are still active.

DFARS 252.204-7012 flow-down language is still active in current subcontracts throughout the defense industrial base. CMMC subcontractors in Hawaii and Guam that assume their prime contractor's certification covers them are often surprised to learn this 2016 flow-down obligation still applies directly to their own systems.

By 2017, self-assessment against NIST SP 800-171 was a standing requirement for every DoD contractor and subcontractor handling covered defense information, per the terms of DFARS 252.204-7012. In practice, enforcement was inconsistent.

Many primes and subcontractors submitted System Security Plans (SSPs) and scores to the Supplier Performance Risk System (SPRS) that overstated their actual security posture, whether from misunderstanding the requirements or simply underinvesting in cybersecurity. This enforcement gap, combined with a wave of publicized breaches in the defense supply chain, became the direct catalyst for the Department of Defense's decision to build an independently verified certification model instead of relying on contractor self-attestation. This is the year the industry-wide credibility problem CMMC was built to solve became impossible to ignore.

The enforcement gap that defined 2017 is exactly why CMMC assessment now requires independent verification rather than self-attestation for CMMC Level 2 certification. Contractors who still carry a self-assessment mindset from this era are often the ones most likely to struggle on their first C3PAO assessment.

In 2019, the Department of Defense announced the creation of the Cybersecurity Maturity Model Certification program, developed in partnership with Carnegie Mellon University's Software Engineering Institute and the Johns Hopkins University Applied Physics Laboratory. The announcement followed a string of high-profile breaches across the defense industrial base, including intrusions that compromised sensitive program data through subcontractor networks.

CMMC was designed to close the self-attestation gap exposed by years of inconsistent NIST SP 800-171 compliance: instead of contractors grading their own homework, a formal certification model would require independent verification by a CMMC Third-Party Assessment Organization (C3PAO) for higher-risk contracts. This is the year CMMC, as a named program, was born, and the year the terms CMMC readiness, CMMC certification, and CMMC consultant first entered the defense contracting vocabulary.

For Hawaii and Guam contractors, 2019 marks the year CMMC readiness became a real planning category, distinct from general IT compliance work. Organizations that started building toward CMMC readiness in 2019 or 2020 are generally far ahead today of those only beginning the process now.

2020 was the year CMMC moved from concept to contract language. On September 29, DoD published the DFARS interim rule (Case 2019-D041) in the Federal Register, formally authorizing CMMC requirements to appear in DoD solicitations; the rule took effect on November 30.

On December 8, the CMMC Accreditation Body and DoD released an updated implementation timeline projecting full rollout by September 2021, and the Department announced seven pathfinder contracts to pilot the model, requiring contractors on those specific awards to complete a third-party assessment. Days later, on December 31, the General Services Administration signaled that CMMC's reach would extend beyond the DoD alone, noting in its Polaris IT services solicitation that all government contractors, civilian and military, should prepare for similar requirements.

The pace set in 2020 proved far more ambitious than what actually followed, but it marked the first time CMMC had real regulatory teeth, and the first time contractors and CMMC providers had to plan around an actual effective date rather than a policy announcement.

Contractors who won one of the seven original pathfinder contracts in 2020 remain some of the most experienced organizations in the country at completing a full C3PAO assessment, and lessons learned from that pilot still shape how CMMC Overwatch and CMMC Command engagements are scoped today.

Facing sustained industry criticism over cost, complexity, and an unrealistic assessor pipeline, the Department of Defense announced CMMC 2.0 on November 4, 2021. The revised model eliminated two of the original five maturity levels and removed CMMC-unique practices that didn't map directly to NIST SP 800-171, leaving three levels: CMMC Level 1 for Federal Contract Information (FCI), CMMC Level 2 for Controlled Unclassified Information (CUI) aligned entirely to the 110 NIST SP 800-171 controls, and CMMC Level 3 for the highest-risk programs, layering in select NIST SP 800-172 enhanced requirements.

CMMC 2.0 also expanded the use of annual self-assessment for a subset of Level 2 contracts, rather than requiring a C3PAO assessment for every one. This is the version of CMMC that exists today, and it is the model Intech Pacific's CMMC Overwatch, CMMC Sentry, CMMC Command, and CMMC Enclave services are built around. Every CMMC Level referenced anywhere on this site, and everywhere else in the industry, refers to this 2021 restructuring.

CMMC 2.0's three-level structure is the direct reason Intech Pacific organizes its service menu around CMMC Overwatch, CMMC Sentry, CMMC Command, and CMMC Enclave: each service model maps to a different combination of CMMC Level and internal IT capability defined by this 2021 restructuring.

With the CMMC 2.0 model set, 2022 became the year the assessor and training ecosystem caught up. In September, the Cyber AB, the official accreditation body for the CMMC ecosystem, established the Cybersecurity Assessor and Instructor Certification Organization (CAICO) to manage training and certification for CMMC Certified Professionals (CCPs) and CMMC Certified Assessors (CCAs).

The following month, CAICO launched the Certified CMMC Professional exam, giving individuals a formal path to earn the CCP credential that now defines who is qualified to guide contractors through CMMC readiness. This is the year the credentials behind terms like CMMC consultant and CMMC provider started to mean something specific and verifiable, rather than a marketing claim. When Intech Pacific describes its team as certified CCPs and CCAs, this is the credentialing structure that claim refers to.

When evaluating a CMMC consultant or CMMC provider, confirming that its staff hold active CCP or CCA credentials created in 2022 is one of the fastest ways to separate genuine CMMC expertise from general IT marketing language.

2023 delivered two milestones that moved CMMC from policy to practice. In January, CMMC third-party assessor RedSpin completed the first successful assessment under the Joint Surveillance Voluntary Assessment Program (JSVAP), an early, voluntary trial run of the formal C3PAO assessment process later required under CMMC 2.0.

Then, on December 26, the Department of Defense published the CMMC Program proposed rule in the Federal Register, formally proposing to codify the CMMC 2.0 model as 32 CFR Part 170. This rule opened a public comment period and set the stage for the finalized program requirements that followed the next year, giving contractors, C3PAOs, and CMMC consultants their first detailed look at exactly how the finalized certification and assessment requirements would function in practice.

The JSVAP assessments conducted in 2023 gave early C3PAOs and CMMC Assessors real-world experience before the final rule made certification assessments mandatory, which is part of why assessment quality and consistency have improved industry-wide since the rule took effect.

On October 15, 2024, the Department of Defense published the CMMC Program final rule in the Federal Register, formally establishing the CMMC Program under 32 CFR Part 170. The final rule confirmed the three-level structure introduced in CMMC 2.0, detailed the assessment and affirmation requirements for each level, and set out how Plans of Action and Milestones (POA&Ms) could be used to close narrow, non-critical gaps after an assessment.

This rule answered the question defense contractors, subcontractors, and CMMC consultants had been asking since 2019: what, exactly, will CMMC require, and how will it be enforced. With 32 CFR Part 170 finalized, the only remaining step was giving DoD contracting officers the contractual authority to actually require it, which arrived the following year.

Contractors who used the roughly ten-month gap between the 2023 proposed rule and the 2024 final rule to complete a CMMC gap assessment entered Phase 1 implementation in 2025 with a substantial head start over competitors who waited for the rule to finalize before starting any remediation work.

2025 delivered the final piece of the CMMC regulatory puzzle. On September 10, DoD published the companion 48 CFR contract clause rule, giving contracting officers the authority to write CMMC requirements directly into solicitations and contracts.

Two months later, on November 10, Phase 1 implementation officially began: eligible DoD solicitations started requiring CMMC Level 1 or CMMC Level 2 self-assessments, with results and annual affirmations submitted to the Supplier Performance Risk System (SPRS). For Hawaii and Guam contractors and subcontractors, this is the year CMMC readiness stopped being a future planning exercise and became an active condition of contract eligibility.

Hawaii and Guam contractors bidding on solicitations issued after November 2025 should expect CMMC Level 1 or Level 2 self-assessment requirements to appear directly in the solicitation language itself, not as a future condition mentioned only in passing.

Phase 1 implementation continues through November 9, 2026, meaning many DoD solicitations issued this year still rely on CMMC Level 1 and CMMC Level 2 self-assessment rather than independent C3PAO certification. That changes on November 10, 2026, when Phase 2 begins and DoD starts requiring CMMC Level 2 certification through a formal C3PAO assessment for applicable solicitations, rather than accepting self-assessment alone.

Contractors who have relied on self-assessment through Phase 1 face a narrowing runway: a CMMC gap assessment, remediation, and C3PAO scheduling all take months to complete, and C3PAO assessment slots are a finite, in-demand resource. This is the year Intech Pacific expects the sharpest increase in demand for CMMC Overwatch, CMMC Sentry, CMMC Command, and CMMC Enclave engagements, as contractors who delayed readiness work race to avoid losing contract eligibility when Phase 2 requirements take hold.

Organizations that have not yet completed a CMMC gap assessment should treat 2026 as the last full year to prepare before CMMC Level 2 certification becomes a hard, independently verified requirement rather than a self-assessed one.

The Department of War suspended CMMC Phase II requirements, originally set to take effect November 10, 2026, and launched a 60-day CMMC Reform Task Force to review the program's future. Phase I self-assessment requirements remain in place, and contractors are still contractually obligated to protect covered defense information under DFARS 252.204-7012 and NIST SP 800-171. The move aims to cut compliance costs for small and mid-sized defense contractors without lowering the security bar.

Phase 3 begins November 10, 2027, extending certification requirements to CMMC Level 3 for the highest-risk DoD programs. Under the final rule, Level 3 certification requires a contractor to first hold a current CMMC Level 2 (C3PAO) certification, then undergo an additional assessment conducted directly by the Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) against 24 enhanced security requirements drawn from NIST SP 800-172.

Relatively few Hawaii and Guam contractors will need Level 3, since it applies only to programs handling the most sensitive Controlled Unclassified Information against advanced persistent threats, but subcontractors flowing into prime contracts with Level 3 requirements should expect those obligations to cascade down through the supply chain.

Prime contractors managing Level 3 programs in 2027 will increasingly require their subcontractors to demonstrate at least CMMC Level 2 certification as a condition of continued subcontracting, even when a given subcontractor's own scope does not reach Level 3.

Phase 4, full implementation of the CMMC Program, begins November 10, 2028, three years after Phase 1 launched. From this date forward, DoD contracting officers can include CMMC Level 1, Level 2, or Level 3 requirements in any applicable solicitation without the phase-in restrictions that limited enforcement from 2025 through 2027.

By 2028, every active and prospective DoD contractor and subcontractor handling Federal Contract Information or Controlled Unclassified Information in Hawaii and Guam should expect CMMC compliance to be a standard, non-negotiable condition of contract award, not a future requirement to plan around. Phase dates reflect the Department of Defense's currently published implementation plan and are subject to change; Intech Pacific updates this calendar as DoD issues new guidance.

By the time Phase 4 arrives, Hawaii and Guam organizations without a CMMC certification appropriate to their contract's requirements should expect to be ineligible to bid on, or continue performing, applicable DoD work.