The CMMC Marathon: Preparation, Pacing, and Long-Term Performance

Preparing for a CMMC assessment is a long-term journey. Learn how DoD contractors can plan, pace, and sustain CMMC compliance.

• 

  Bill Wootton

  Chief Growth Officer

Getting ready for a marathon is about more than just showing up to run on race day; it means building the endurance, habits, and mindset that will carry you through every step of your 26.2-mile journey. The formal Cybersecurity Maturity Model Certification (CMMC) assessment is your marathon day, when all of your training is put to the test and your organization has to perform to rigorous cybersecurity standards. Preparing for, and successfully completing, a CMMC assessment is the event that validates months of disciplined work and confirms that you meet the standard for protecting government information.

Long-term success, however, depends on more than crossing the finish line once; it grows out of your early choices, the routines you build, and your ability to maintain a steady focus on improvement after the race is over. Maintaining your compliance status between assessments is the expected outcome and goal of the CMMC program. We explored how to build these skills in a recent webinar, walking through how organizations can plan for assessment and beyond.

The habits you create during preparation are the same habits that will sustain the cyberhealth of your organization over the years to come. Thoughtful planning, ongoing education, and regular check-ins become the building blocks for resilience in an ever-changing compliance landscape. The real payoff for early, deliberate effort is the peace of mind that your organization can keep pace for the entire journey, no matter how the course twists and turns.

Pacing Yourself: Understanding CMMC Timing

Organizations that are just beginning their CMMC preparation can use the assessment as the catalyst to build healthy cybersecurity habits. Every policy, process, and record developed during training shapes your ability to meet ongoing requirements year after year. Recognizing CMMC compliance as a long-term journey helps your team avoid the temptations of fad diets and fast fixes and instead be clear-eyed about where they are strong, where they need more practice, and where to focus resources for maximum long-term impact.

Deciding when to schedule your formal CMMC assessment is as much a strategic decision as a timing decision. For organizations in the U.S. Defense Industrial Base (DIB), the schedule for certification is closely tied to your upcoming contract deadlines, the government’s contract requirements, and the expectations of prime contractors.

The CMMC rule took effect on November 10, 2025, and the Department of Defense (DoD) is planning to implement the program in four phases over the next three years. Think of this phased rollout as an official race calendar that defines when different sections of the DIB must be ready:

• Phase 1: The DoD will begin to require CMMC Level 1 or Level 2 self-assessments in applicable contracts. At its discretion, it can start to require more stringent requirements, such as Level 2 Certification.
• Phase 2: Starting November 10, 2026, applicable solicitations will require Level 2 Certification by a Certified Third Party Assessing Organization (C3PAO). The DoD may allow some contracts to delay this requirement until the start of an option period.
• Phase 3: A year later, applicable solicitations will require a Level 3 Certification, with the same delay option as in Level 2.
• Phase 4 (Full Implementation): On November 4, 2028, all solicitations and contracts will include applicable CMMC requirements as a condition of receiving a contract award.

Keep in mind that the DoD has also indicated it may require CMMC in some contracts before these planned phases.

Because only a subset of contracts will require CMMC early on, the first few years will feel like limited-entry races, with the DoD controlling the number of contracts subject to CMMC:

• Year 1: About 1,100 contracts will include CMMC, out of approximately 28,000 non-Commercial Off-The-Shelf (COTS) contracts handled each year. That’s roughly 4% of non-COTS contracts.
• Year 2: This increases to between 6,000 and 8,000 contracts (21%–29%).
• Year 3: It increases again, to 16,000 contracts (57%).
• Year 4: CMMC requirements apply to all contracts.

Prime contractors bear the responsibility to set CMMC deadlines for subcontractors. Waivers are extremely rare, only available at the contract level (not the company level), and must be obtained before an award.

Subcontractors should not count on waivers. Primes will usually choose companies that are already compliant; delaying certification could mean losing out to competitors who are ready to run.

CMMC Prep: Building Your Assessment Plan

Just like starting any training program, building a solid plan for your CMMC assessment begins with an honest and objective review of your organization’s current cybersecurity posture. This means reviewing existing policies, technical controls, and evidence to identify gaps between where you are and where CMMC requires you to be.

The amount of work needed will depend on whether you have improved your processes over time or are starting from scratch. For some organizations, three or four months of structured work might be sufficient. For most, however, especially those new to the requirements in CMMC, which are built on the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Rev. 2, preparation may take anywhere between nine to 18 months to address every objective adequately. In either case, the training cycle will need to be followed by a “burn-in” period to showcase continued adherence to those controls, as well as a period to gather the documentation and evidence needed to confidently pass the assessment.

Before you step up to the starting line on assessment day, take the following actions to ensure you are operating in a compliant state:

• Determine where you store, process, and transit CUI data in order to identify your compliance boundaries.
• Conduct a gap assessment to identify where your current practices fall short of CMMC requirements. In many cases, it may make sense to build a new environment from scratch rather than attempt to “fix” your current environment.
• Implement the appropriate technology upgrades to meet the technical requirements of NIST 800-171 Rev2.
• Review and update your cybersecurity policies and procedures to align with each of the 320 assessment objectives.
• Implement missing safeguards and ensure practical, consistent use across your organization.
• Gather evidence showing ongoing compliance, such as logs, screenshots, training records, and workflow artifacts.
• Schedule regular progress checks and stakeholder meetings to monitor your preparation progress.
• Ensure you have a Customer Responsibility Matrix from any relevant vendors.

To get ready for the assessment, you should take the following steps:

• Build an assessment playbook that identifies the response, and evidence for each assessment objective.
• Set up a mock assessment with all relevant participants—both internal and external service providers—to test readiness and address weaknesses before the formal assessment.
• Book a date with your C3PAO well in advance: Many reputable C3PAOs have scheduling backlogs of six to nine months.
• Freeze last-minute changes to configurations and documentation before your formal review.
• Leave buffer time for unforeseen delays or remediation just before the final assessment.
• Maintain real-world compliance activities throughout the preparation period.

As CMMC requirements move from phased rollout into active enforcement, preparation and timing become even more important. C3PAOs already get on average about five to eight calls a week from new prospective clients looking for service. They are booked months in advance, so securing a place in their calendar well before you intend to certify helps your organization avoid delays.

Conducting a mock assessment ahead of the formal review also pays off: it gives your teams a trial run of the course to identify weaknesses before they matter, refine documentation, and test your readiness under realistic conditions. Keep in mind, certification assessments must be reported to the DoD, so a failed assessment is logged and visible to any future solicitation, and delays past three weeks can trigger unwanted scrutiny.

Failing a certification after claiming compliance can harm contracts and future opportunities. Mock assessments help you avoid that possibility and ensure that your organization is prepared for both the initial CMMC assessment and the long road ahead of maintaining compliance.

Understanding the Course: Post-Assessment Reality

Once you’re certified, you’ll look back and see how much work, time, effort, and energy it took to cross the finish line of your first CMMC assessment. But now that you have passed, how do you maintain compliance with a cyber-healthy lifestyle every day for the next three years, the length of your certification, and beyond?

The good news is that a third party has validated that you’ve got good policies, plans, procedures, and processes. You have good documentation that everyone in your organization understands, and everyone documents their activities the same way. Now your job is to maintain that discipline. Your business isn’t static, and your documentation shouldn’t be either.

As your business changes, your documentation should reflect those changes. Documentation that hasn’t been changed in three years is going to be a red flag at your next assessment. If you can do that, you’re going to find that your annual affirmation and subsequent assessments will not be nearly as overwhelming as your first one.

The CMMC regulation also requires that a senior person in your organization affirms continuous compliance at the end of every year. The most important thing to do is generate and maintain documentation that shows that you are following all those policies. If there’s a challenge from the DoD or another third party, they will be looking at that documentation as evidence that you are meeting your compliance commitments.

Assembling a Team

Larger organizations with experienced internal teams may choose to manage CMMC compliance in-house, but even these entities often look to outside advisors for specialized skills, technical controls, or to validate readiness for assessments. Choosing trusted partners is an important step for most organizations undertaking the CMMC compliance process. You should prioritize experience and reliability when choosing advisors and service providers. A qualified partner will have deep knowledge of the CMMC framework, a record of success, and clear processes for guiding clients through documentation, technical controls, and assessment preparation.​

For small businesses, external support often proves more efficient than hiring in-house experts. Managed service providers and cybersecurity consultants can provide specialized skills and assist with both technical and compliance requirements, while also keeping costs more predictable. The right partners can not only help you accelerate your readiness plan but also tailor its solutions to the unique size and structure of each company, ensuring that your compliance efforts stay on track.​

C3 Integrated Solutions offers several solutions to help organizations with the CMMC assessment process.

• Microsoft 365 Government Community Cloud (GCC) and GCC High Deployment: Focused on migration and setup of Microsoft 365 environments to meet contract requirements; addresses specific cloud platform compliance needs.
• Microsoft Azure Government Services: Provides migration, deployment, and management specifically for Azure Government Cloud; offers support for critical applications and sensitive data.
• C3 Command: Fast-tracks CMMC Level 2 by combining a proven CMMC reference architecture with managed IT, security, and compliance services. C3 Integrated Solutions takes on most assessment objectives under an 80/20 shared responsibility model and provides guidance for remaining objectives.​
• C3 Catalyst: Provides a fully managed CMMC-ready technical environment built on the same reference architecture, but with more flexibility for organizations that either already have a compliance advisor or need to integrate CMMC into a broader set of requirements.​ Additional compliance services are available.
• C3 Core: Delivers a suite of managed IT and cybersecurity services for federal contractors that need secure, best-practice operations outside or alongside CMMC environments. It provides ongoing expert IT help from managed services for specific IT functions, comprehensive end-to-end IT support, or dedicated, US-based cybersecurity services.

For clients that chose C3 Command, C3 Integrated Solutions will assign a compliance expert to your organization. We’ll meet with you each week and take you through all 110 controls and 320 assessment objectives in order to the document stack of policies, plans, procedures, and other supplemental documentation. Our team then writes up that information so you can successfully pass a C3PAO assessment. With consistent weekly participation, most organizations complete the process within about four months.

Sustaining Compliance: Building Habits to Continue the Marathon

After achieving CMMC certification, it’s time to transition into the ongoing work of sustaining compliance day after day. Maintaining compliance means sticking to the habits you built during preparation: documenting changes, monitoring controls, training your team, and keeping evidence up to date. The greatest risk to long-term compliance is drift, where your daily actions start to depart from documented policies. Internal checkpoints, such as policy reviews and audits, can help you spot gaps early.

Sustaining continuous compliance is not a solo pursuit. It requires collaboration across leadership, staff, and external partners, with each group playing a critical role and sharing responsibility. Proactive, team-driven compliance efforts bring collective confidence at every affirmation and assessment, while lowering your overall risk throughout the year. If your organization builds these routines and adapts as requirements shift, you’ll be ready for every checkpoint and prepared to go the distance as standards evolve.

If you missed the live discussion, you can watch the full webinar on demand.