Why Is It So Hard to Book a CMMC Assessment Right Now?
There are more C3PAOs and Lead CCAs than ever, yet getting the week you want can still be hard. Why the national numbers don't decide your date, what narrows the pool for one assessment, and what you control.
On paper, there’s plenty of capacity. As of the Cyber AB’s September 29, 2026 Town Hall, there were 117 authorized or accredited C3PAOs and 681 Lead CCAs, both up by about a quarter or more since December. An outside analysis of the Cyber AB Marketplace concluded that the assessor pool had been used at “below half its realistic capacity.” We went through those figures in how many C3PAOs there are.
And yet organizations still hear “not until next quarter.” Both things are true, because no organization books the national pool. It books one team, for one scope, in one window. That’s where the difficulty sits.
Demand didn’t wait for the schedule
DoD planned a slow start. Its analysis estimated 135 C3PAO-led assessments in the first year and 673 in the second, rising to 4,452 a year by year four (89 FR 83171). The rule also made clear that the phase-in “does not preclude entities from immediately seeking a CMMC certification assessment” (89 FR 83170).
Organizations took that up. By September 2026, less than a year into Phase 1, the program had issued 2,362 final Level 2 certificates, well past DoD’s estimate of 808 assessments for the first two years combined. The two counts don’t start on exactly the same date, but the direction is clear: demand arrived early.
There’s also no queue. DoD said “it is beyond the scope of this rule for DoD to determine the order in which organizations are assessed,” and that the program “depends on the supply and demand dynamics of the free market” (89 FR 83127–83128). Nobody holds your place in line. A date goes to whoever is ready to book it.
One assessment needs specific people
A Level 2 certification assessment isn’t staffed from the national total. It needs a particular combination of people, and every condition takes some of the pool away:
- Cyber AB, September 2026
- Assessors work only under a C3PAO
- § 170.8(b)(17)(ii)(G)
- § 170.9(b)(12)–(13)
- For your scope and sites
Your assessment
A Lead CCA, and a full team. “An Assessment Team must include at least two people: a Lead CCA… and at least one other CCA” (§ 170.9(b)(12)). Quality assurance has to be done by a CCA who “cannot be a member of an Assessment Team” they’re reviewing (§ 170.9(b)(13)). Everyone involved needs a favorable Tier 3 background determination (§ 170.9(b)(3)). The Lead CCA is the scarce piece, because every team needs one.
Nobody who helped you prepare. The rule bars anyone who “previously served as a consultant to prepare the organization for any CMMC assessment within 3 years” (§ 170.8(b)(17)(ii)(G)). If you’ve worked with several advisors, the people who know your environment best are the ones who can’t be on the team. We explain the rule in why the team that prepares you can’t certify you.
People who can reach you. Some assessment objectives are best validated on site; the CMMC Assessment Process lists 18 where on-site validation should be considered, mostly physical protection (CAP v2.0, P.11). Commenters on the rule warned that “often-extensive travel times” could slow assessments for rural companies (89 FR 83127). Multiple sites, a large scope or several CAGE codes all add assessor days.
Everyone wants the same weeks
Timing does the rest. A contract that requires a CMMC status needs it “at time of award” (DFARS 204.7502(a)(3)), so the week that matters is the one before a proposal is due or an option is exercised, not any week this year. When a prime sets a deadline for its whole supply chain, its subcontractors all start looking at once.
With Phase 2 suspended, no program-wide date paces demand, so the deadlines that matter are the ones in your own contracts and your primes’ requests. Our post on the Phase 2 suspension covers what’s paused and what isn’t.
The weeks before the week
A booked assessment week isn’t the start of the work. Before it, the C3PAO has to plan the assessment with you, and the Lead CCA has to validate your scope (CAP v2.0, 1.3–1.4). Phase 1 then ends in a readiness call only the Lead CCA can make: “The Lead CCA shall make the determination as to the readiness of the OSC to proceed” (CAP 1.10).
If the answer is no, the week is cancelled, and finding another one starts the search again. That’s the costliest way to lose a date: not failing to get one, but losing the one you had because the SSP, the evidence or the scope wasn’t ready. We describe that step, and the checkpoints that prevent surprises, in the CMMC assessment process, step by step.
What you control
You can’t add Lead CCAs to the market. You can make yourself the organization a C3PAO can schedule with confidence:
- Work backward from your real deadline. Find the proposal date, option date or prime deadline that actually requires the status, and plan the assessment, the readiness work and the time to fix findings before it.
- Be ready before you book. A documented scope, a current SSP and evidence you can produce on request are what get you through the readiness review. A mock assessment is the most direct way to find out.
- Keep your advisors and assessors separate. Choose a C3PAO whose people haven’t prepared you, so the conflict check doesn’t remove your team late.
- Ask who your Lead CCA will be. The C3PAO proposes the Lead CCA by name and screens them for conflicts (CAP P.14). A C3PAO that can name yours has a team, not just a date. Our checklist for choosing a C3PAO has the other questions.
- Be flexible where you can. A range of acceptable weeks is easier to fill than one fixed date.
If you’re the C3PAO
The same picture looks different from the other side: work you have to turn down because your Lead CCAs are booked, in a market DoD expects to keep growing toward 4,452 assessments a year. That’s what our services for C3PAOs are for: vetted Lead CCAs and CCAs added under your authority and methodology for the weeks you need them.
Sources: Cyber AB, Town Hall presentation (September 29, 2026); Secureframe, CMMC ecosystem analysis (March 2026 Marketplace data); 89 FR 83092 (October 15, 2024), preamble and regulatory impact analysis at 83127–83128 and 83170–83171; 32 CFR Part 170, § 170.8(b)(17)(ii)(G) and § 170.9(b)(3), (12) and (13); DFARS 204.7502(a)(3); Cyber AB, CMMC Assessment Process v2.0 (December 2024), P.11, P.14, 1.3–1.4 and 1.10.