The Cyber AB made it official during its March 2025 Town Hall: CMMC Level 2 is finalized, and certifications can now be issued. Here’s a quick recap of that announcement plus other key takeaways you need to know.
Level 2 Certification Is Here
Organizations Seeking Certification (OSCs) can now receive official Cybersecurity Maturity Model Certification (CMMC) Level 2 certificates from Certified Third-Party Assessment Organizations (C3PAOs).
While this is a major step forward for the program, it highlights a growing concern: 58% of defense contractors say they aren’t prepared for CMMC, and 13% haven’t started at all, according to NDIA.
If you’re unsure where your organization stands, learn how a gap analysis is a practical first step to identify what’s needed for compliance.
1. The Assessment Pipeline Is Growing
There are now:
- 64 Authorized C3PAOs ready to assess
- 336 Certified CMMC Assessors (CCAs)
- 665 Certified CMMC Professionals (CCPs)
- 200 Registered Practitioner Advancers (RPAs)
- 1,600 Registered Practitioners (RPs)
More certified professionals are available to help you prepare, but only a limited number of authorized C3PAOs can issue certifications. C3PAO calendars are commonly booking 3–6 months out or more. Plan ahead and schedule early.
2. ESPs Must Meet All Requirements
There’s a common myth that non-cloud External Service Providers (ESPs) like Managed Service Providers (MSPs) and Managed Security Service Providers (MSSPs) can get CMMC Level 2 certified just for their portions of a Shared Responsibility Matrix (SRM) or Customer Responsibility Matrix (CRM).
That’s false. Even if an ESP only provides inherited services, their information system must comply with all NIST SP 800-171 Rev 2 security requirements. What they can do is voluntarily undergo a CMMC certification to make their clients’ assessments easier.
3. CEIC West: The CMMC Community Heads to Vegas
If you’re looking to stay plugged into the CMMC community, check out CEIC West from May 21–23. Expect deep dives on assessments, best practices, and lessons from the field.
4. Canada Gets On Board
Canada has launched its own CMMC-aligned framework, CPCSC. For contractors with cross-border operations or partners, this is a trend worth watching.
What’s Next
If you handle Controlled Unclassified Information (CUI), CMMC Level 2 is no longer a future concern, it is active now. Delaying could mean losing out on contract opportunities.
Preparing for certification takes time. While many estimate CMMC prep takes 9 to 12 months, a recent Small DIB Contractor Survey found that 73 percent of contractors spent over a year preparing and still weren’t finished.
Whether you are just getting started or need help closing final gaps, Alluvionic can support you at any stage.
Why Contractors Choose Alluvionic
- We Make CMMC Crystal Clear.
-
- No jargon, no tech-speak—just a straightforward path to certification with guidance you can actually understand.
- Trusted by 125+ Government Contractors.
-
- We turn DFARS, NIST, and CMMC requirements into clear, actionable plans, saving you time, cost, and confusion.
- An Established CMMC Partner.
-
- As one of the first Cyber AB RPOs in 2021, our proven process is built on years of real experience, not hasty fixes or shortcuts.
- Women-Owned. Small Business Focused.
-
- We understand the unique challenges of small and mid-sized contractors, because we are one. Our solutions are timely, sustainable, and designed to support you every step of the way.
