CMMC Isn't a One-Time Event: The Three-Year Level 2 Cycle

A CMMC Level 2 status lasts three years, and then you do it again. That part is easy to remember. The details are where organizations get caught: which date starts the clock, what an open POA&M does to it, and what happens to a contract that runs longer than the status it was awarded on.

None of this changes with how you were assessed. A Level 2 self-assessment and a C3PAO certification run on the same three-year clock, with the same annual affirmations in between (32 CFR § 170.16 and § 170.17).

One date starts the clock, and it isn't the last day on site

The rule's term is the CMMC Status Date: the date your results are submitted to SPRS or to eMASS, the system C3PAOs report to (§ 170.4). For a C3PAO assessment, the C3PAO submits the results to eMASS, which passes them to SPRS. For a self-assessment, you enter the score in SPRS yourself. Either way, it’s the submission that sets the date, not the closing meeting.

If your assessment ends with open items, there’s a second rule that matters more. The reassessment “must be completed within three years of the CMMC Status Date associated with the Conditional Level 2” (§ 170.17(a)(1)), and the definition is blunt about what happens afterward: “A new date is not set for a Final that follows a Conditional.”

The preamble to the rule says the same in plain terms: the deadlines are “not based on the date of a POA&M closeout assessment” (89 FR 83096). The time you spend Conditional comes out of your three years, not on top of them. After closeout you hold a Final status “for the remainder of the 3-year validity period” (89 FR 83129).

The 180 days that can end it all

A Conditional status has its own, much shorter clock. Open items have to be closed out “within 180-days of the Conditional CMMC Status Date,” and if they aren’t, the Conditional status “will expire” (§ 170.21(b)). For a C3PAO assessment, the closeout has to be done by an authorized or accredited C3PAO, and it looks only at the requirements that were NOT MET. For a self-assessment, you do it yourself, the same way you did the original.

Miss that window and the rule doesn’t offer a second try at the same items. On contracts you already hold, “standard contractual remedies will apply,” and you’re ineligible for new awards that need the level “until such time as a new CMMC Status is achieved” (§ 170.17(a)(1)(ii)(B)). The preamble is explicit that this means “a new full certification assessment.” Our post on CMMC POA&Ms and the 180-day closeout covers what can and can’t go on one.

The years in between

Between assessments, the cycle asks for an affirmation every year after the Final status date, plus one at each status change (§ 170.22(a)(3)). No evidence goes in with an annual affirmation, but the signature says the requirements are still met, so somebody has to have checked. We cover what your Affirming Official is actually signing and how to keep the evidence current between assessments in their own posts.

Two things in the middle years can bring the next assessment forward. The DoD’s view, in the preamble, is that “a new assessment is required if there are significant architectural or boundary changes to the previous CMMC Assessment Scope,” with network expansions and mergers as its examples (89 FR 83135). The rule never defines “significant.” And a government DIBCAC assessment can “take precedence over any pre-existing CMMC Status” (§ 170.17(a)(1)(iv)). Routine changes inside the boundary that follow your SSP don’t need a new assessment. An acquisition does.

Your contract can outlive your status

This is the part of the cycle that costs money. The contract clause requires you to “have and maintain for the duration of the contract a current CMMC status” (DFARS 252.204-7021(d)(1)(i)). And the contracting officer checks it twice, not once. Before award, and again before exercising an option or extending the period of performance: the contracting officer “shall check SPRS and not exercise an option or extend the period of performance” without a current status (DFARS 204.7503(c)).

A contract with a base year and four option years runs five years. Your status runs three.

Neither Part 170 nor the DFARS has a grace period, an extension, or an early-renewal window. Nothing in them stops you from assessing before the deadline, either. A new assessment gets its own Status Date when its results are submitted, so finishing early costs you a few months of the old cycle, not a gap in coverage. Finishing late can cost you the option. If you’re a prime, your subcontractors’ cycles are your problem too: CMMC requirements apply at every tier that handles FCI or CUI (§ 170.23) (more on that in flowing CMMC down to subcontractors).

Plan the next assessment backward from the date

Because the deadline is fixed and the rule offers no slack, the reliable way to run the cycle is backward from the date on your status. What follows is how we’d sequence it, not something the rule prescribes:

1. Status dateWrite down the deadlineThree years from the Conditional date if you had one, otherwise from the Final. Put it next to every contract’s option dates.
2. Every affirmationCheck what changedEach annual affirmation is a natural point to ask whether anything moved the boundary. Changes you catch then are cheap; changes an assessor finds aren’t.
3. About a year outRe-scope and rehearseThree years of new systems, people and vendors add up. Review the scope against today’s environment, then run a mock assessment while there’s time to act on it.
4. Well before the dateBook the assessment with room to spareLeave time for the full assessment and, if it ends Conditional, the closeout. A new Conditional status counts for award, but only for up to 180 days (DFARS 204.7502(b)(2)).

Part 170 doesn’t describe a lighter renewal version of the assessment, so plan for the whole thing: the full scope, every requirement, and current evidence for each.

The records outlast the cycle

One more detail stretches past the three years. After a C3PAO assessment, you keep the hashed artifacts behind your results “for six (6) years from the CMMC Status Date” (§ 170.17(c)(4)); a Level 2 self-assessment carries the same six years (§ 170.16(c)(4)). Assessors and C3PAOs don’t keep your evidence for you, the preamble notes, so if the government asks to see what stood behind a status, the copy it gets is yours.

That means that by your second assessment, you’re still holding the first one’s artifacts, unchanged, alongside the new set. Keep them where a well-meaning cleanup won’t touch them, and keep the hash list with them.

Running it as a cycle

Organizations that treat the assessment as the finish line end up running the same project twice, three years apart, from a colder start. The ones that treat it as a cycle keep the scope, the evidence and the affirmations moving, so the next assessment confirms what they already know. That’s the work behind our CMMC Continuous Compliance (APS) plans: control reviews behind each affirmation, POA&M closeout inside the 180 days, change reviews when the environment moves, and preparation for the reassessment year.

Sources: 32 CFR Part 170, § 170.4 (CMMC Status Date), § 170.16(a)(1) and (c)(4), § 170.17(a)(1) and (c)(4), § 170.21(b), § 170.22(a)(3); 89 FR 83092 (October 15, 2024), preamble at 83096, 83129, 83132 and 83135; DFARS 204.7502(b)(2), 204.7503(b) and (c), and 252.204-7021(d)(1)(i); Cyber AB, statement on the suspension of CMMC Phase II requirements (July 15, 2026).