The Most Expensive Mistake in CMMC: Waiting for the Solicitation
We had a contractor call us last fall in a panic. They’d been tracking a NAVAIR follow-on contract for months — a program they’d supported for years, work they fully expected to win. The solicitation dropped with a CMMC Level 2 requirement. Award expected in eight months.
They hadn’t started.
Eight months to go from zero to a successful CMMC assessment: scoping, remediation, policy development, technical implementation, documentation, and a C3PAO assessment with a scheduling backlog. They didn’t make it.
This isn’t an edge case. It’s the most common pattern we see in defense contracting right now. And NAVAIR’s own public procurement data shows exactly why “I’ll start when I see it” is a strategy designed to fail.
Why Contractors Wait (and Why the Logic Falls Apart)
The reasoning sounds rational on the surface. CMMC is rolling out in phases. The rule just went into effect. “I haven’t seen it in a solicitation yet, so I have time.”
Here’s what that logic misses: CMMC status is a condition of contract award, not something you demonstrate after you win. By the time you see the requirement, the clock is already running — and it’s shorter than you think.
The phased rollout doesn’t help either. Phase 1 is already active. Phase 2 starts later in 2026, but the solicitations for contracts that will require Level 2 are being written now. The rollout schedule tells you when DoD can require CMMC. It doesn’t tell you when the specific contract you need will drop.
What NAVAIR’s Own Data Says
Every year, NAVAIR publishes a long-range acquisition forecast (LRAF) projecting upcoming prime contract opportunities. It’s mandated for small business planning and includes anticipated solicitation dates and contract award dates — the two data points you need to calculate how much time you’ll actually have.
The December 2025 forecast lists 1,676 opportunities. Of those, 1,070 include both dates. Here’s what the procurement timelines look like by contract size:
| Contract Value | Opportunities | Avg. Solicitation-to-Award | Approximate Timeline |
|---|---|---|---|
| Under $2M | 294 | 2.7 quarters | ~8 months |
| $2M – $7.5M | 86 | 3.3 quarters | ~9 months |
| $7.5M – $50M | 92 | 3.3 quarters | ~9 months |
| $50M – $100M | 23 | 3.4 quarters | ~9.5 months |
| $100M – $250M | 15 | 5.1 quarters | ~15 months |
| $250M – $1B | 11 | 3.8 quarters | ~11.5 months |
| Over $1B | 7 | 5.1 quarters | ~15 months |
For every contract under $100 million — which covers the vast majority of the defense industrial base — the average window from solicitation to award is under 10 months. Smaller contracts move even faster: the under-$2M tier averages just 8 months.
That’s the total window. Your actual implementation time is much less.
The Timeline You Actually Have
Nine months sounds workable until you map out what actually happens inside that window. Here’s the reality we see with clients:
| Phase | Time | Running Total |
|---|---|---|
| Leadership alignment and budget approval | 4–8 weeks | 2 months |
| Vendor selection and procurement | 2–4 weeks | 2.5 months |
| Scoping, gap assessment, and SSP development | 4–6 weeks | 4 months |
| Technical remediation and policy implementation | 10–14 weeks | 7 months |
| C3PAO scheduling and assessment | 6–10 weeks | 9 months |
That’s nine months with no slack, no surprises, and no delays at any stage. In practice, leadership alignment alone can burn a full quarter if CMMC isn’t already a board-level priority. Procurement can stall if you’re going through a formal RFP process for consulting support. And C3PAO scheduling isn’t something you control — assessors have backlogs, and you don’t get to pick your date off a shelf.
The real math: a nine-month procurement window turns into roughly four to five months of actual implementation time once you subtract the organizational overhead on the front end and the assessment scheduling on the back end. That’s not enough for any organization starting from scratch.
And that assumes you’re actually as ready as you think. The DoD’s own data consistently shows that defense contractors overestimate their NIST 800-171 implementation by a wide margin. If your self-assessment says 80%, the real number is probably closer to 40%.
The Subcontractor Squeeze
Everything above covers prime contracts — solicitations from the government to industry. If you’re a subcontractor to a Lockheed, Northrop, or RTX, the timeline is even worse.
Primes aren’t waiting for the DoD to mandate CMMC in every solicitation. They’re protecting their own ability to win and execute. We’re seeing supplier letters go out now — formal notifications requiring subcontractors to demonstrate CMMC status as a condition of staying on the supply chain.
There’s no PALT window to calculate when a prime sends you a letter. The timeline is whatever they say it is. And primes that are already certified have no incentive to wait for suppliers who aren’t.
If your revenue depends on a prime contract relationship, your CMMC timeline is whatever your prime decides — not whatever NAVAIR publishes.
What to Do About It
Look up your contracts. The NAVAIR LRAF is public. Find the programs you support or plan to bid on. Calculate the solicitation-to-award window for those specific opportunities. That’s your actual deadline — not an industry average.
Work backward from the award date. Subtract two to three months for C3PAO scheduling and the assessment itself. Subtract another two months for organizational decision-making and procurement. Whatever’s left is your implementation window. If that number is under six months and you haven’t started, you have a problem.
Treat CMMC as a business decision, not a compliance exercise. The organizations that will win these contracts are the ones that treated certification as a strategic investment before it appeared in a solicitation. The ones that waited are now competing for assessor slots, scrambling to remediate, and hoping the timelines work out. Hope isn’t a strategy.
Talk to your primes. If you’re a subcontractor, don’t wait for a supplier letter to tell you the deadline. Ask now. Primes that are planning ahead will tell you what they expect and when. That conversation gives you months of lead time that a reactive approach doesn’t.
The solicitations are coming. The timelines are public. The math is straightforward.
If you’re not sure where you stand or whether your timeline is realistic, let’s talk. We help defense contractors build CMMC implementation plans that fit inside real procurement windows — not theoretical ones.