Ask five consultants how long CMMC Level 2 certification takes and you’ll get five versions of “it depends.” That’s not wrong, but it’s not useful either. The truth is that timelines follow predictable patterns based on where an organization starts. This article lays out realistic timeframes for mid-size defense contractors (50-250 employees) pursuing Level 2 certification.

One caveat up front: the timelines below assume a focused effort with executive buy-in. When leadership is engaged and resources are committed, these ranges hold. When CMMC competes with every other priority, add months.

Three Starting Points, Three Timelines

Not every organization starts from the same place. Some have been working toward NIST 800-171 for years. Others are just learning what CUI means. The gap between them can be a year or more of work.

Starting from Scratch: 12-18 Months

This is the organization with no formal security program, minimal documentation, and likely some significant technical gaps. Maybe they’ve been operating on a handshake and good intentions. Maybe security was always “something we’ll get to.” Now a contract opportunity is forcing the issue.

These organizations need to build everything: policies, procedures, technical controls, and the evidence to prove it all works. The remediation phase alone can take 6+ months because it involves real infrastructure changes, not just paperwork.

Partially Compliant: 8-12 Months

This is where most mid-size contractors land. They have some policies in place, maybe did a self-assessment against NIST 800-171 at some point, and have addressed the obvious gaps. But “some” isn’t “all,” and a self-assessment isn’t the same as being assessment-ready.

The work here is filling gaps, tightening documentation, and getting evidence organized. There’s usually at least one significant technical project (like implementing a SIEM or fixing access controls) that extends the timeline.

Nearly There: 4-6 Months

These organizations have been operating under NIST 800-171 for a while. Documentation exists and is current. Controls are implemented and working. What’s left is validation: making sure everything holds up under scrutiny, collecting evidence, and preparing the team for interviews.

This is the fastest path, but it’s also the rarest. Most organizations think they’re here until a gap assessment reveals otherwise.

What Actually Takes the Time

The path to certification breaks into distinct phases. Understanding where the time goes helps with planning and setting expectations.

Scoping (2-4 weeks): Defining what’s in and out of your assessment boundary. This includes inventorying assets, mapping where CUI flows, and making decisions about how to structure your environment. Get this wrong and everything downstream takes longer.

Gap Assessment (2-4 weeks): A clear-eyed look at where you stand against all 110 NIST 800-171 security requirements. This tells you exactly what work remains and lets you build a realistic remediation plan.

Remediation (3-6+ months): The long pole. This is where you fix what’s broken: implementing technical controls, writing policies, building procedures, and creating the evidence trail. The range here is wide because it depends entirely on how many gaps exist and how complex they are to close.

Pre-Assessment Prep (2-4 weeks): Collecting evidence, organizing artifacts, conducting mock interviews, and doing dry runs. This is about being ready to demonstrate what you’ve built.

C3PAO Assessment (2-4 weeks): The assessment itself plus the reporting period. For a deeper look at what happens during this phase, see our previous article on engaging a C3PAO.

Add it up and you get roughly 5-9 months for an organization that’s already in decent shape. The difference between that and 18 months is almost entirely in the remediation phase.

Four Things That Blow Up Timelines

Even with a solid plan, certain patterns derail projects. These are the ones we see most often.

Underestimating Documentation

“We have a policy for that” is not the same as having a policy, procedures that implement it, evidence that people follow those procedures, and proof of consistent enforcement over time. Most organizations double their documentation estimate once they understand what assessors actually require.

Scope Creep Mid-Project

Halfway through remediation, someone discovers a system that touches CUI. Or an acquisition adds new assets. Or a project spins up a new cloud environment. Suddenly the boundary moves and work that was “done” isn’t anymore. This is why scoping deserves serious attention up front.

Technical Debt

Legacy systems that can’t meet requirements are a special kind of problem. That server from 2012 isn’t getting MFA. That on-prem application doesn’t support modern encryption. The fix isn’t a configuration change; it’s a replacement project with its own timeline. Budget for this early, both dollars and time.

Staff Bandwidth

Your IT team still has day jobs. Help desk tickets don’t stop because you’re pursuing CMMC. When certification work competes with everything else, it loses. Projects stall for weeks waiting on people who are busy keeping the lights on. This is the most common reason timelines slip.

What Speeds Things Up

The fastest projects we see share a few things in common.

Executive sponsorship that clears roadblocks. When leadership treats CMMC as a business priority, resources follow. Decisions get made faster. Competing projects get deprioritized when they need to be.

A dedicated internal owner. Not “IT will handle it” but a named person accountable for driving the project. Someone who wakes up thinking about CMMC and goes to bed checking tasks off the list.

Early engagement with a consultant. Not to do the work for you, but to set realistic scope, identify the big rocks early, and keep the project from going sideways. The cost of rework is always higher than the cost of getting it right the first time.

Starting documentation before technical work is complete. These can run in parallel. Waiting until all controls are implemented to start writing policies adds months.

Count Backward from the Deadline

If you’re bidding on DoD work that requires Level 2 certification, the contract deadline is fixed. Work backward from there. If that deadline is 8 months out and you’re starting from scratch, you have a problem. Better to know that now than to discover it when there’s no time left to fix it.

Most organizations need to start earlier than they think. The ones who give themselves enough runway have options. The ones who wait don’t.