How Long Does CMMC Certification Take?

Earning the CMMC certification is the most important step between many businesses and the wealth of lucrative DoD contracts available across a wide range of industries. If you want your business to take that next step, it can be an excellent idea, but it's not a switch you can flip and have operational right away.

These things take time, and time is money. The contracts you want could be gone by the time you're done. Your budget for implementation could run out before the work is finished. With the wrong balance of investment and resources necessary, it might not make sense to pursue.

Understanding the timeline, then, is a fundamental part of the decision whether or not to pursue CMMC, and if so, when and how. So, how long does it take to become CMMC certified? Let's break it down by phase and by certification level.

Phase 1: Gap Analysis

The first phase is the gap analysis. This is what you do to kick off the CMMC process, and it's the foundational work you do to figure out just how extensive the task you have ahead of you will be.

A gap analysis requires two things. The first is the ideal state your business will need to achieve. This is all of the security controls, all of the personnel training, and all of the technological, social, and organizational details you'll need to have in place to pass an assessment and achieve certification.

The second is your current state. What does your current security posture look like? How defined are your network boundaries? How many of the security controls do you already have implemented from things like SOC 2, HIPAA, or another framework, or just industry best practices?

Performing a gap analysis is as easy (and as complex) as it sounds. You have these two states; now you identify the gap between them. What work needs to be done to go from point A, your current state, to point B, your ideal state?

Ideally, this takes the rather nebulous concept of "being secure" and breaks it down into a list of individual tasks you will need to complete to achieve that stance.

It's highly encouraged that you then use tools to track and monitor progress on these tasks. The Ignyte Assurance Platform is one great tool; we designed it to track tasks and compliance progress down to the individual security control or KSI, so your stakeholders can monitor progress, your implementation leads can guide compliance, and your individual employees can contribute each step of the way.

How Long Does Gap Analysis Take?

Gap analysis is the first serious task in the CMMC process, and as such, it's the first time some companies encounter how serious the work will be. It's also not a process that gets harder with each certification level, but it does simply have a greater volume of things to check at each tier.

Level 1: This often takes 1-2 months for most Level 1 companies. Large companies with complex systems, companies that are very unprepared, and companies that refuse to touch automation can take longer; we've seen some take as long as 5 months.

Level 2: Level 2 certification has a much larger list of security controls and individual details to check, which means the timeline is longer just through the volume of work that needs to get done. The bar is also higher, so teams tend to be more thorough. The timeline is often two months at the shortest, and up to six months for the largest and most complex businesses.

Level 3: Once more, this adds on more controls and sets the standard much higher. On the other hand, companies aiming for level 3 are more likely to be experienced in other security frameworks like FedRAMP or ISO 27001, and as such may be more familiar with the processes in general. Still, the timeline tends to be in the 3–7-month range, due to the complexity and the need to be precise and thorough.

Phase 2: Control Implementation

It's something of a misnomer to simply call this "implementation" when much of what is being implemented is stuff you should already be doing as a business. It's more like identifying the specific minimum configurations necessary and bringing your configuration up to that level if necessary. Others call it remediation, as the gap between your state and the ideal can be considered a flaw to fix.

This is the most hands-on part of CMMC implementation, the most practical, and also surprisingly fast. Further, the more thorough and well-planned your gap analysis, the faster your remediation can be. It's a lot easier to start with a list of tasks than it is a list of systems, right?

Implementing the appropriate level of security can also vary in time depending on many factors. How large is your business? How complex are your systems? How broad is your scope? How defined is your boundary? How strong is your current security posture? All of this has a significant impact.

How Long Does Implementation/Remediation Take?

The range here can be surprisingly wide.

Level 1: Since the number of controls is low and the complexity of the systems involved tends to be low as well, remediation for Level 1 certification can go fairly quickly. Many companies should expect in the 1-3-month range for this tier.

Level 2: Remediation at Level 2 tends to be quite complex and time-consuming simply due to the volume of changes necessary. Bringing a company up to Level 2 security means implementing a lot of security either from scratch or to a level many employees aren't used to. It also involves training and education, which takes time. Expect three months at the fastest, up to six months for companies where there are a lot of complexities or a significant gap to fill.

Level 3: Timelines vary wildly here. The shortest tend to be 3-4 months, because a lot of work needs to be done up to a very high standard. But, Level 3 also tends to be most sought by large or complex companies, which means the list of work to do is much longer, and can take as much as a year in extreme cases. Level 3 also has additional controls and assessments directly from the DoD, which adds to the timeline.

Phase 3: Documentation and Artifact Gathering

CMMC requires passing an assessment, and passing an assessment means presenting documentation. Without documentation for the appropriate implementation of each security control, there's no way to pass the assessment. Therefore, you need to document, organize, collate, and generally make your documentation packet presentable.

Ideally, at least some of this work is done as you're implementing your controls. Do the work, document the work, store the documentation. Then, when it's time to put together your packet, you have that documentation ready to go, so you only need to generate or create a small handful of remaining artifacts and forms.

If you haven't been doing that, well, you'll have a lot more work ahead of you.

This is another area where the Ignyte Assurance Platform can play a key role. As you finish up tasks, you can store the documentation directly within the platform. Whenever any of it needs updating, the updates go to the same place. When it's time to compile your packet, it's all there and ready to go.

How Long Does Documentation Take?

Fortunately, even in the messiest implementations with the least proactive documentation, it doesn't take too long to gather it all up.

Level 1: It generally won't take more than 2-4 weeks to gather up everything. It goes faster if you've been collecting it along the way or if you're used to generating many of these kinds of documents for other reasons.

Level 2: Documentation at this level is much more extensive and needs to pass an external audit, so the standards are higher. There's just more of it, so it takes longer to compile and verify. Expect to take at least four weeks, if not two months, to get it all pinned down.

Level 3: While the type of documentation necessary isn't much different from Level 2, Level 3 has more of it, and the standards are even higher. Minor mistakes can be very costly, so a detailed review is required. Expect to spend between six weeks and three months putting it all together.

Again, a lot of this can overlap with implementation, so don't simply add up the totals and expect that to be your timeline.

Phase 4: Personnel Training

CMMC isn't just about technological security controls. You also need to make sure your employees and other personnel are trained and aware of their responsibilities, the rules and policies you're implementing, and how to handle any signs of breach.

This can involve policy dissemination, employee training, and everything in between.

How Long Does Personnel Training Take?

The timeline here depends a lot on your company expectations and on your certification level.

Level 1: The training requirements are quite low at this level, and can often be satisfied with limited training, policy awareness, and some simple courses. This can easily be done while implementation is occurring and might only take a week or two.

Level 2: Training is a must to be able to pass an external audit, since auditors will be performing personnel interviews to check as part of their audit process. Making sure your employees are adequately prepared still doesn't take too long, but can run you up to a month.

Level 3: At this level, extensive training is required because the potential consequences of a breach are much more severe. Expect large-scale training with a lot of detail, likely taking 1-2 months to complete to an adequate level.

Phase 5: Pre-Assessment Readiness Checks

This can be considered a self-assessment before the full compliance assessment. As such, it's an important part of the process, but it's actually more important for lower levels, in a way.

This is because Level 1 requires a self-assessment as the sum of the assessments necessary. Since the impact of a breach at Level 1 is much lower, the government adopts a more reactive stance, and simply levies penalties for breaches. Level 2 also has a self-assessment component, but requires the external assessment as well, while Level 3 is more serious with full assessments.

Either way, performing this self-assessment is at minimum a good way to make sure your implementation is as valid as possible before undergoing the full assessment.

How Long Does a Self-Assessment Take?

Since it's basically an audit, it takes the time an audit would take and can be more or less time-consuming depending on how thorough you are with checking.

Level 1: You're looking at 1-2 weeks for your self-assessment. When you're done, you submit the assessment results to the SPRS, and you're ready to go.

Level 2: The self-assessment can take 2-4 weeks, all told. You want to be thorough, but less because of the requirement of the assessment itself, and more because you want to make sure you aren't going to fail a full assessment and waste time and money. Expect to be deeply involved in this process for the best results.

Level 3: Since the self-assessment isn't as required, the full assessment needs full preparation. Expect to spend 4-6 weeks on this process, checking everything you can.

Phase 6: Assessment

The full C3PAO assessment is the final test before being able to get certified to operate within the defense industrial base. It's lengthy, complex, thorough, and more than willing to fail the unprepared.

The timeline for the audit can depend more on your C3PAO than on you, but the better prepared you are for it, the faster and smoother it will go.

How Long Does the CMMC Audit Take?

There are a couple of details that make this tricky.

Level 1: You don't have one.

Level 2: 1-2 weeks. Assessments can go pretty quickly, with larger organizations or more extensive scopes taking longer because there's more to check.

Level 3: 2+ weeks. Much like Level 2, the Level 3 assessment doesn't take too long compared to implementation, but will take longer the more extensive your systems are. Additionally, Level 3 has added assessments from DIBCAC that add to the timeline.

Getting CMMC Done Right the First Time

With these kinds of timelines, it's important to get things right the first time through. You don't want to get to the audit and fail, and have to spend additional weeks or months redoing work and remediating further gaps.

The Ignyte Assurance Platform is our solution. We designed the platform to help massively streamline and speed up the process of CMMC certification, and can cut months down to weeks for different stages of the process. To see how it can work for you, book a demo and let us show you first-hand.