CMMC April 2026 Town Hall Update: Key Insights for PJR Clients and Industry Stakeholders

Executive Summary

The April 2026 Cybersecurity Maturity Model Certification (CMMC) Town Hall provided important updates on program implementation, ecosystem development, and upcoming initiatives that will impact organizations across the Defense Industrial Base (DIB).

The overarching message remains clear: CMMC requirements are actively being incorporated into contracts today, and organizations should be progressing toward compliance now. While the Department of Defense continues its phased rollout, external pressures, particularly from prime contractors, are accelerating timelines for many organizations.

Program Implementation: Clarifying Phases and Expectations

A key focus of the Town Hall was addressing ongoing confusion between CMMC implementation phases and perceived compliance deadlines.

The Department of Defense is executing a three-phase rollout through November 2028:

• Phase 1 (Current – November 2026):
  Emphasis on Level 1 and Level 2 self-assessments, with select contracts already requiring Level 2 third-party certification.
• Phase 2 (November 2026 – November 2027):
  Level 2 C3PAO certifications will be required in all new contracts.
• Phase 3 (November 2027 – November 2028):
  Level 3 requirements, assessed by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), will apply to higher-priority contractors.

Important Distinction

There is no universal compliance deadline applicable to all organizations. However, prime contractors are increasingly establishing their own requirements, often mandating Level 2 certification ahead of the official timeline.

Implication: Organizations should align their readiness efforts not only with DoD phases, but also with expectations set by their customers and supply chain partners.

Ecosystem Growth and Certification Activity

The CMMC ecosystem continues to mature, with steady growth in certifications and qualified personnel:

• Approximately 1,100 Level 2 certifications were issued.
• 103 authorized C3PAOs
• Continued expansion of Certified CMMC Assessors (CCAs) and Certified Professionals (CCPs)

This growth reflects increased adoption across the DIB but also signals rising demand for assessment services.

Implication: Organizations should plan proactively to secure assessment timelines as capacity becomes more constrained.

Launch of the Cyber Engagement Forum (Cyber EF)

A significant announcement from the Town Hall was the introduction of the Cyber Engagement Forum (Cyber EF), a new entity designed to enhance industry engagement and support.

Purpose and Structure

Due to ISO accreditation requirements, the Cyber AB must maintain independence and cannot engage in activities such as consulting, implementation support, or program promotion. The Cyber EF has been established to address these gaps.

Core Focus Areas

The Cyber EF will:

• Modernize and expand the Practitioner Program
• Develop a next-generation CMMC Marketplace
• Establish a centralized CMMC Body of Knowledge
• Provide enhanced support for External Service Providers (ESPs), including MSPs and MSSPs
• Increase industry outreach, education, and engagement.

Implication: This initiative is expected to improve access to reliable resources and strengthen the overall support structure for organizations pursuing CMMC compliance.

CMMC Marketplace 2.0: Enhancing Industry Connectivity

The upcoming CMMC Marketplace, developed in partnership with RampXchange, represents a substantial evolution from the current directory model.

Anticipated Capabilities

• Advanced search and filtering by region, language, and capabilities
• Segmentation of services (consulting, managed services, tools, etc.)
• Support for transactions and RFPs
• Integration of broader cybersecurity services beyond CMMC

Implication: Organizations will benefit from improved transparency and more efficient identification of qualified providers.

Tier 3 Clearance Process: Guidance and Expectations

The Town Hall provided detailed clarification on the Tier 3 (background investigation) process required for certain certifications.

Key Guidance

• All inquiries should be directed to: tier3_submission@cyberab.org
• Organizations should not contact DCSA, WHS, or the PMO directly unless more than six months have passed without a status update.
• The process involves multiple agencies, contributing to longer timelines and limited visibility.

Implication: Patience and adherence to the established communication process are essential when navigating Tier 3 requirements.

ISACA Transition Updates

Following the transition of certification management to ISACA, several operational updates were shared:

• Some users may experience duplicate accounts; support is available to resolve these issues.
• LCCA applications are currently processed manually, with automation planned.
• Certification structure requires maintaining lower-level certifications to retain higher-level credentials.
• All certification fees are now managed through ISACA.

Implication: Organizations and individuals should familiarize themselves with ISACA processes to ensure continuity in certification management.

Ongoing Challenges and Areas of Focus

External Service Provider (ESP) Requirements

There remains uncertainty regarding requirements for MSPs and other service providers, particularly in cases where direct handling of CUI is limited.

A policy alignment session scheduled for early May is expected to provide additional clarity.

Technology and Tool Proliferation

The ecosystem is experiencing rapid growth in compliance tools, including automated documentation platforms and AI-driven solutions. However, validation of these tools remains critical.

Assessment Rigor

Government-led assessments continue to be highly detailed and documentation-intensive, reinforcing the need for thorough preparation.

What This Means for PJR Clients

With C3PAO accreditation expected by August 2026, PJR remains committed to delivering independent and objective CMMC assessments while maintaining strict separation from consulting activities.

Based on the April Town Hall, organizations should consider the following actions:

• Advance readiness efforts immediately, regardless of official phase timelines.
• Align with prime contractor expectations, which may exceed DoD requirements.
• Ensure documentation is comprehensive and audit ready.
• Stay informed on upcoming guidance, particularly regarding MSP and ESP requirements.
• Plan for assessment scheduling to mitigate potential delays.

Conclusion

April 2026 CMMC Town Hall underscores that the program is actively progressing, with increasing enforcement and ecosystem maturity.

Organizations that take a proactive, structured approach to compliances supported by qualified partners and a clear understanding of evolving requirements—will be best positioned for successful certification.