The DoD’s own Regulatory Impact Analysis identifies 337,968 entities across the Defense Industrial Base that will eventually fall under CMMC requirements, including roughly 76,000 companies that need third-party Level 2 certification. As of late 2025, approximately 200 contractors had completed C3PAO assessments.
That is not a slow ramp. That is a structural failure on a market-wide scale — and the consequences are about to compress into a very short window.
This blog is not another readiness countdown. It is a clear-eyed look at what happens to the 75,000+ contractors who will not be certified by November 10, 2026, what the DoD and DOJ have already signaled about enforcement, and where the market goes from there.
The Number That Should Be Driving Every Boardroom Conversation
The Cyber AB’s most recent Town Hall reported approximately 93 authorized C3PAOs and 635 Certified CMMC Assessors in the ecosystem. DoD’s own projections place Year 1 throughput at around 135 C3PAO assessments — a fraction of one percent of the population that needs Level 2 certification. The assessor pool cannot certify 76,000 contractors in seven months. It cannot certify them in seven years at current capacity.
The DoD knows this. The Cyber AB knows this. The contractors who started 18 months ago know this — which is why they started 18 months ago.
The contractors who have not started are operating on one of three assumptions:
All three assumptions are wrong, and the next section explains why.
Why the Deadline Will Not Slip
The CMMC Programmatic Rule (32 CFR Part 170) became effective December 16, 2024. The DFARS acquisition rule (48 CFR) became effective November 10, 2025, marking the start of Phase 1. Phase 2 — which makes Level 2 third-party certification the default for CUI contracts — begins November 10, 2026. Phase 3 begins November 10, 2027 (Level 3 requirements), and full applicability across all FCI/CUI contracts arrives November 10, 2028.
This is codified federal regulation tied to DFARS and FAR contract clauses. Slipping it would require either rulemaking action by the DoD or congressional intervention. Neither has been signaled. NAVFAC Southwest, NAVSEA, Army Corps of Engineers, and Air Force Global Strike Command are already including CMMC language in active solicitations.
The February 1, 2026 Revolutionary FAR Overhaul went the opposite direction. It eliminated DFARS 252.204-7019, renumbered 252.204-7020 to 252.240-7997, and consolidated all assessment obligations under a single CMMC clause. The DoD is streamlining enforcement, not delaying it.
If you are building a contingency plan around a deadline extension, you do not have a contingency plan.
Why Your Prime Will Not Carry You
Under DFARS 252.204-7021, prime contractors are contractually obligated to flow CMMC requirements down to subcontractors and verify subcontractor certification status before award. A prime that carries a non-compliant subcontractor is creating its own False Claims Act exposure.
In FY2025, the DOJ recovered more than $52 million across nine cybersecurity-related FCA settlements — part of a record $6.8 billion total FCA recovery, with 1,297 qui tam lawsuits filed (the highest count on record). Since the Civil Cyber-Fraud Initiative launched in October 2021, the DOJ has settled fifteen civil cyber-fraud cases, with more than half occurring during FY2025 alone.
In December 2025, the DOJ announced its first settlement specifically targeting the defense supply chain subcontractor tier — an Illinois precision machining subcontractor that agreed to pay approximately $421,000 to resolve allegations that it failed to provide adequate cybersecurity for technical drawings supplied to prime contractors under DFARS 252.204-7012. The case was initiated by a qui tam action filed by a former quality control manager. The subcontractor’s size did not protect it. The prime’s relationship did not protect it. And the settlement signals exactly where the DOJ is now hunting: the subcontractor tier where 74% of the DIB lives.
Primes are not sentimental. Lockheed Martin, Boeing, Raytheon, Northrop, and General Dynamics are all actively rationalizing their supplier bases right now. Boeing has explicitly told suppliers that CMMC certification is a condition of contract award and that neither contracting officers nor primes may waive the requirement. Lockheed Martin requires all suppliers to document CMMC status in SPRS.
A prime choosing between a certified subcontractor and a non-certified one is not making a difficult decision. They are making the decision that protects their own contract pipeline and their own FCA exposure.
If you are a subcontractor who has not started, your prime is already evaluating your replacement.
Why You Cannot Compress the Timeline
A typical CMMC Level 2 path runs 12 to 18 months from initial gap assessment to certification. That timeline is not arbitrary — it is driven by four hard constraints:
The contractors getting certified in late 2026 started in 2024 or early 2025. Compression is a fantasy.
What Actually Happens to the 75,000
The defense market is not going to absorb mass non-compliance. Three things will happen in sequence between November 2026 and the end of 2027:
Phase 1 — Contract exclusion (November 2026 through Q2 2027). Solicitations issued after November 10, 2026 will require CMMC Level 2 certification or higher for CUI contracts. Non-certified contractors lose eligibility for new awards. Existing contracts continue under their original terms, but option years and recompetes become inaccessible. Revenue decline is gradual but compounding.
Phase 2 — Supply chain rationalization (Q1 through Q4 2027). Primes accelerate consolidation of their certified supplier base. Non-certified subcontractors lose work to certified competitors. Subcontracts that were “in progress” stall as primes redirect work to certified vendors to protect their own compliance posture and FCA exposure. Subcontractor revenue drops sharply for the non-certified tier.
Phase 3 — Market exit (mid-2027 onward). Industry analysis estimates tens of thousands of contractors will exit the defense market between 2025 and 2027 as compliance costs exceed the economic value of their defense work. For organizations where DoD revenue is under 30% of total revenue, the math often does not justify certification. They pivot to commercial work or shut down their defense divisions entirely.
The contractors who remain — and who certified — face a smaller, more concentrated market with less competition for the same contract dollars. That is the inverse outcome that does not get discussed enough. CMMC is not just a compliance burden. It is a market consolidation event.
