Many defense contractors are waiting to get serious about CMMC compliance until they see the requirement in a solicitation. While everyone knows successful CMMC status is a condition of contract award (no status, no contract), some fail to account for the timeline.
If you have tons of time between solicitation and award in a major contract, great, but when there are only a few months between solicitation and award, waiting until solicitation is a great way to lose business.
So, how long do defense contractors have to achieve CMMC? And when are these solicitations and awards happening? We looked at all 1,676 contract opportunities anticipated by Naval Air Systems Command (NAVAIR) over the next 12 – 24 months to answer.
We’ll break down the details, but the short answer is usually “not enough.”
It typically takes 6-18 months to pursue CMMC compliance from start to finish depending on a company’s security baseline and scope.
Defense contractors supporting Naval Air Systems Programs will have, on average, 9 months of prep time for CMMC Level 2 if they wait until they see the requirement in a new solicitation.
By the numbers:
The smaller the contract, the less time you have to prepare. If you haven’t started by the time a solicitation is published, you likely won’t qualify by the time of award.
Procurement Administrative Lead Time, or PALT, is the amount of time between contract solicitation and contract award. PALT is the single most useful metric in strategically planning for CMMC.
If you have X dollars and Y time, and it doesn’t fit into Z PALT you will need to:
Let’s talk about NAVAIR and, by extension, why their PALT matters.
NAVAIR, the Naval Air Systems Command, is the U.S. Navy's primary organization responsible for the full lifecycle support of naval aviation, from research, design, and acquisition to testing, training, and sustainment of aircraft, weapons, and systems for Sailors and Marines.
Their work revolves around missiles, jets, helicopters, drones, and everything it takes to design, develop, operate, and sustain them.
That’s a lot of money, a lot of contractors, and a lot of contracts. How the heck do we track all those opportunities?
Long-Range Acquisition Forecasts.
Long-Range Acquisition Forecasts (LRAF) AKA Long-Range Acquisition Estimates (LRAE) are projections of upcoming prime contract opportunities (12 – 24 months). They are mandated for small-business planning and are published before solicitations are posted on SAM.gov.
NAVAIR most recently forecasted 1,676 opportunities, which range from $700k to multi-billion-dollar opportunities. These opportunities include repairs, redesigns, prototypes, etc., for everything in the NAVAIR portfolio from C-130s to unmanned systems.
Though not all opportunities had enough information for us to evaluate, we’re talking about 1,070 opportunities with estimated solicitation and contract award dates (PALT) for us to evaluate.
There are two things to know about how we used NAVAIR’s LRAF to count these numbers:
2. We counted quarters inclusively.
Across all 1,070 NAVAIR opportunities, with all contract values, classified and unclassified in mind, the average PALT is 3.3 quarters from solicitation to contract award.
This would give contractors 10 months of PALT to build from their company’s security baseline to full compliance with DFARS 7012, schedule a CMMC assessment, resolve any POAM items, and be awarded the certification.
All unclassified opportunities less than $2M:
All unclassified opportunities $2M - $7.5M
All unclassified opportunities $7.5M - $50M
All unclassified opportunities $50M - $100M
All unclassified opportunities $100M - $250M
All unclassified opportunities $250M - $1B
All unclassified opportunities greater than $1B
Can you wait until a solicitation drops to begin pursuing CMMC and be finished by the time of award? It isn’t impossible, but it’s never a good strategy.
CMMC requirements are complex, scheduling an assessment with a C3PAO takes time, and you may uncover new problems or hit other unexpected delays as you prepare. If you’re preparing before a solicitation is out, you’ve most likely lost that contract.
Reach out to Summit 7 experts to learn how long it will take your organization to get certified and become eligible for awards like these.