A Realistic CMMC Level 2 Readiness Timeline for a 30-Person Supplier

How long does CMMC Level 2 readiness take a 30-person supplier?

Six to nine months for a 30-person supplier with CUI that can be contained to a small group, assuming someone owns the project and purchases are approved when the gap assessment calls for them. The 110 requirements of NIST SP 800-171 Rev 2 do not take long to read. They take long to evidence, and the evidence has to show the control running, not switched on the week before.

The assumptions

• 30 staff, of whom six handle CUI (drawings, specifications, technical data from a prime).
• Microsoft 365 or Google Workspace, one office, a small shop floor.
• An MSP that handles endpoints and patching but has never been asked for CMMC evidence.
• A starting SPRS score well below 110, as most first assessments are. A negative first score is normal and not a verdict on the business.

Month by month

Month	Work	What exists at the end
1	Scope CUI. Decide enclave or whole company. Inventory assets and data flows. Gap-assess all 110 requirements at the objective level.	A boundary diagram, an asset list, a scored gap report, a purchase list
2	Write the SSP and POA&M against the real environment. Approve purchases. Start the quick settings fixes: MFA for all users, password policy, session lockout, admin account separation.	A first SSP, a dated POA&M, a score that already moved
3	Deploy logging and alerting. Turn on FIPS-validated encryption on devices in scope. Stand up the enclave if that is the decision. Write the incident response plan and run a tabletop against the 72-hour report.	Logs you can search, encrypted endpoints, an IR plan someone has rehearsed
4	Policies and training. Access reviews. Physical controls: visitor log, escort rule, locked storage. Vendor letters from the MSP and the cloud provider.	Signed policies, training records, a visitor log with entries in it
5	Close the engineering POA&M items. Vulnerability scanning on a schedule. Configuration baselines documented and enforced.	Evidence per requirement, filed where an assessor can find it
6	Mock assessment run the way an assessor runs one. Fix what it finds. Recalculate and post the SPRS score. Senior official affirms.	A defensible score in SPRS and an SSP that matches reality
7 to 9	Buffer for purchases that slipped, a second mock pass, and the habit of monthly evidence collection.	A program, not a project

The buffer is not optional. Something in month 3 will wait on a vendor or a budget meeting.

What the first month decides

Scoping. A 30-person supplier that moves its six CUI users into an enclave is assessing six desktops, one identity provider and one file store, and the other 24 people stay at Level 1 for FCI. The same supplier with CUI in general email and the shared drive is assessing 30 laptops, the office network and every mailbox. MSP vs GRC tool vs enclave provider weighs the options, and Level 1 vs Level 2 covers how the two levels coexist inside one company.

The gap assessment at the objective level is the other month-one output. A questionnaire that asks "do you have MFA?" produces a yes. An objective-level assessment asks whether MFA covers local, network and privileged access separately, which is how 32 CFR 170.24 scores it.

What cannot be rushed

Three things set the floor of the schedule whatever the budget.

Operating evidence. An access review done once proves a review happened. A review done monthly for three months proves a control operates.

Procurement. FIPS-validated encryption, a log platform and a government cloud tenant each have lead times. Order them in month 2, not month 5.

People. Training has to be delivered and recorded, and the incident response plan rehearsed by the people who would run it.

What the POA&M can carry at the finish

Under 32 CFR 170.21, a Level 2 supplier can hold Conditional status with open POA&M items only if the score is at least 88 out of 110 per the rule's formula, no open item is worth more than 1 point (with one encryption exception), none of six named requirements is on the list, and everything closes within 180 days. The CMMC POA&M: what can stay open sets out the full list.

Where the program stands

Phase 1 self-assessments have appeared in solicitations since 10 November 2025. Phase 2 third-party assessments were suspended on 13 July 2026, and the class deviation of 3 September 2026 removes the C3PAO requirement from contracts for now, with no end date and no repeal. DFARS 252.204-7012, NIST SP 800-171 Rev 2, SPRS scores and the 72-hour incident report still apply. AccuSights is not a C3PAO.

The pause does not add time to this plan. How to calculate your SPRS score honestly covers the number you post at month 6.

Where AccuSights fits

We run months 1 through 6 with you: scoping, the objective-level gap assessment, the SSP and POA&M, fixes alongside your MSP and a mock assessment, from $6,000 for a small supplier with contained CUI according to our pricing page, with a named engineer and a fixed fee in writing within 24 hours of the intake form. We are not a C3PAO. Start with the CMMC framework page, the NIST SP 800-171 page, or book a free Risk Diagnosis and we will tell you which month you are actually in.