There Are Enough CMMC Assessors, Contractors Just Aren't Ready

Summary

Sum IT Up: CMMC News Roundup

Episode: There Are Enough CMMC Assessors, Contractors Just Aren't Ready

Host: Summit 7
Date: July 2, 2026

---

Episode Overview

In this episode, the hosts critically examine the narrative that there is a shortage of CMMC assessors holding back contractor certifications. Instead, they argue that the true bottleneck is contractor (OSC) readiness, not assessment capacity. By walking through conservative estimates and real-world data, the hosts highlight key trends in CMMC Level 2 certification progress, dispelling common misconceptions and underlining the impact of contractor compliance with DFARS 252-204-7012 and NIST SP 800-171 implementation.

---

Key Discussion Points & Insights

Latest CMMC Level 2 Certification Stats

• Certification Milestone:

  • 279 new companies achieved CMMC Level 2 certification in June 2026, the largest increase since the rollout began in November 2025.
  • Total Level 2 certified companies: 1,717.
    Quote:

    “That is the single largest increase since the start of the phased rollout ... we should have more than 2,900 Level 2 certifications right now, not 1,700.”
    — A (00:09)

• Achievement vs. Potential:

  • The hosts emphasize how these numbers—though impressive—fall short of what's possible given current assessment capacity.

Shattering the "Assessor Shortage" Myth

• Capacity Calculations:

  • The hosts explain their methodology for estimating real assessment capacity:
    • Teams need one Certified Assessor and one Lead Certified Assessor.
    • Each team assumed to perform two assessments/month (very conservative).
    • Quality Assurance process handled by dedicated assessors (QAs).
    • Considering 1,013 certified assessors (June 2026), with 596 as leads.
    • After all conservative cuts, only 202 assessment teams considered "available."

• Result:

  • Assessment teams could have delivered approximately 405 Level 2 assessments in June—only 279 were completed.
  • Even with only half the possible teams counted, there’s still excess capacity each month. Quote:

    “So, to cut to the chase here, that means in June, we conservatively had enough assessment teams to run 405 Level 2 assessments, and we only ended up with 279 new Level 2 certifications. So the problem was not that we didn’t have enough assessors.”
    — A (04:53)

• Addressing Skeptics:

  • Hosts stress they deliberately underestimate capacity to avoid inflating results. Quote:

    “Our assumptions here...are actually detrimental to the overall outcome...We're saying that we're blowing production out of the water with the most absolutely crippled numbers to be attached to it.”
    — B (05:31)

Analysis of Underutilized Capacity

• Historical View:
  • Since phased rollout began in November 2025, only half of available capacity was used each month on average.
  • 2,487 certifications were possible, but only 1,265 added between Nov 2025 and June 2026.
  • Shortfall: about 1,222 certifications—due to contractors, not assessor shortage. Quote:

    “Since November ... we’ve only added 1,265. That’s 1,222 Level 2 certs short of where we would be, where we should be if assessment capacity was being fully utilized.”
    — A (06:55)

True Source of the Bottleneck: Contractor Readiness

• Main Problem:

  • Most companies aren’t ready for assessments, primarily due to incomplete compliance with DFARS 252-204-7012 and NIST SP 800-171—not because of CMMC structure or a lack of assessors. Quote:

    “The problem with achieving CMMC Level 2 certs has nothing to do with CMMC. It has everything to do with whether or not companies are complying with DFARS clause 252-204-7012, which was the entire purpose of the CMMC program.”
    — A (07:58)

• Why Aren’t Contractors Engaging?

  • Two main possibilities:
    • Contractors don't know how/where to find assessors.
    • Contractors are avoiding engagement due to lack of readiness for what the assessment would uncover. Quote:

    “The OSCs that need it either don’t know where to look to find it ... or they don’t want to find it because they’re not ready to find what that brings.”
    — B (07:36)

Rapid Growth Across the CMMC Ecosystem

• Implementer and Assessor Pipeline:

  • Numbers of certified professionals are reaching new monthly highs, showing a healthy pipeline of capacity. Quote:

    “They are growing...at record numbers as well ... reaching output numbers that are shattering records every single month.”
    — B (08:42)

• Mismatch Between Capacity and Demand:

  • Despite unprecedented assessment and implementer capacity, demand (companies ready and willing for assessment) lags far behind.

Call to the Community

• Transparency and Ongoing Updates:

  • Hosts promise to repeatedly provide updated numbers and challenge misconceptions until the “assessor shortage” narrative fades.

    Quote:

    “We’re going to do these numbers literally every month until people stop saying that assessment capacity is the problem.”
    — A (09:25)

---

Notable Quotes & Memorable Moments

• “Contrary to popular belief, there is no shortage of assessors. The problem is contractor readiness, not assessment capacity.” — A (00:28)
• “If people had implemented 800-171 in accordance with their DoD contractual requirements, then they could have signed up for an assessment as soon as they were available at any time since November.” — A (09:05)
• “It hasn’t been [an assessor shortage] since November. It hasn’t been last month. And it doesn’t look like it’s going to be anytime soon.” — A (07:19)

---

Important Segment Timestamps

• 00:09: Certification stats and missed potential
• 02:42: Fuzzy math behind assessment capacity (methodology deep dive)
• 04:53: Evidence of surplus assessment capacity versus actual certifications attained
• 07:36: Real reasons for certification bottleneck: contractor confusion or unreadiness
• 08:42: Rapid, record-setting growth in assessor and implementer certifications
• 09:25: Ongoing commitment to data transparency and resetting the community narrative

---

Summary Takeaways

• The recurring claim of insufficient CMMC assessors is factually unsupported; assessment capacity has greatly outpaced the readiness and willingness of contractors to undergo certification.
• Conservative calculations and real-world figures prove that the CMMC rollout is not hindered by infrastructure but by contractors’ lack of DFARS/NIST compliance.
• The hosts call for industry stakeholders to confront contractor readiness as the decisive challenge—and to stop repeating the outdated “assessor bottleneck” myth.
• Listeners are encouraged to scrutinize data, engage with transparent reporting, and address the underlying issues of security practice adoption within their organizations.

Transcript

[A]

All right, folks, it is July of 2026, and another 279 companies achieved CMMC Level 2 certification last month. That is the single largest increase since the start of the phased rollout in November of 2025, and brings us to 1,717 total Level 2 certifications out there. But that number could have been much larger. Conservatively, we should have more than 2,900 Level 2 certifications right now, not 1700. Contrary to popular belief, there is no shortage of assessors. The problem is contractor readiness, not assessment capacity. And that's what we're going to talk about today. Jason, after eight months of the phased rollout, 1,717 companies have achieved CMMC Level 2. That's amazing. That's 1200 more certifications than DoD anticipated getting in the first 12 months of the CMMC rollout. This is a massive achievement. It's a huge achievement. But I just can't help thinking about how high that number would be if we had actually used all of the assessors that have been available.

[B]

Yeah, dude, let's think about it, right? We did a little bit of fuzzy math about, I don't know, what, a month and a half ago, right? We were like, you know, if you took all the assessors that are available right now and then you cut that in half, then half went on vacation and half forgot how to do assessments, and we cut it down and it generated a lot of buzz. But then we realized that the math wasn't as fuzzy as we thought it was. And then in consecutive months, record producing certification numbers coming out, percentages growth, percentage growth of output, 15% or greater last last month, 20% growth and output this month. So whatever had to happen for the engine to start chucking along, I think we can safely say it's chugging along, right?

[A]

Yeah. I mean, there's basically two stories here. One is way, way more companies are getting CMMC level 2 certified than the DoD thought we're going to get level 2 certified. The other story is that way, way more companies could be getting Level two certified, but we're not leveraging the total amount of assessment capacity. Meanwhile, a ton of people are running around saying there aren't enough assessors.

[B]

And.

[A]

And it's just not true.

[B]

Market forces are a crazy thing, right?

[A]

It's pretty crazy. Let's talk about how this fuzzy math works here. We got a lot of feedback on our video last month, so we're going to talk about how we got these numbers. Let us know if you agree. So for the eighth month in a row, overall level 2 assessment capacity is greater than the number of companies that are ready for an assessment. How do we reach a conclusion like that? To estimate the total monthly assessment capacity in the ecosystem, we need to estimate the total number of available assessment teams to run those assessments. Each team, by regulation, needs one certified assessor and one lead certified assessor. There's plenty of CCPs out there, so we're not going to talk about that. We assume that each assessment team can conduct two assessments per month on, on average. Not three, not four, just two, just two per month. When you average out vacations and availability and this and that, blah, blah, blah. One assessment team, two assessments per month on average. But by regulation, we also need a certified assessor separate from the team to conduct QA on those assessments. After talking to a bunch of C3 PAOs, we assume that each QA can evaluate four assessments per month. Not running the assessment, they're just checking the assessment. So you take the total number of available assessors and you divide it by two and a half of the 1,013 CMMC certified assessors in June of 2026, 596 of them are lead CCAs. So we divide 1013 by 2.5 and we end up with 405 possible teams. But wait, wait, there's more. Then we're going to cut that number in half and round down to just 202 possible assessment teams, because as we all know, not all assessors are actually working and we don't want to be accused of artificially inflating the possible numbers. So we're working with less than half of the total number of assessment teams that we could theoretically have out there. Is that conservative enough for everybody? Let us know in the comments. Do you want us to cut the numbers even lower? I think it's pretty conservative to say half of the teams are available. Anyways, to cut to the chase here, that means in June, we conservatively had enough assessment teams to run 405 Level 2 assessments, and we only ended up with 279 new Level 2 certifications. So the problem was not that we didn't have enough assessors.

[B]

And now it's vocally being said that that is not the case. The assessment capacity is enough. When people typically assume and they're talking about numbers and they're trying to prove a point, they typically shade those numbers in favor of the argument and which would make everything sound inflated, right? Like, hey, we have more than enough if we did, in a perfect world scenario this or that, our assumptions here I just want to remind all the haters in the audience, right? Our assumptions here are actually detrimental to the overall outcome, right? We're saying that in case we lose half, in case we lose half again, we're still at more than enough capacity. So we're not inflating the numbers to say that we can blow this out of the water. We're saying that we're blowing production out of the water with the most absolutely crippled numbers to be attached to it.

[A]

And 279 level 2 certs is about 25% of total assessment teams being maxed out and working. It's actually more than the 25% number, but we know that's not true because all the C3PAOs still have tons of availability. So we know that the C3POs aren't being leveraged. So we know the capacity is larger than the number of level two Certs that we saw last month. We know that based off of the math, if half of all the people who bother to spend the money and time to go through ccp, cca, lead, CCA just don't do anything with it, we're still way above the total number. But let's, let's look at this like even further here. So using this conservative 50% model, if you will, since November of 2025, the entire ecosystem has only used half of the available assessment capacity out there each month. Between November of 2025 and June of 2026, we theoretically had enough capacity to add 2,487 Level 2 certs. Since November, we've only added 1,265. That's 1222 Level 2 certs short of where we would be, where we should be if assessment capacity was being fully utilized. So the problem again, is not assessment capacity. It's not even close. It hasn't been since November. It hasn't been last month. And it doesn't look like it's going to be anytime soon.

[B]

Jacob, I want. I think this boils down to two things. The available assessment capacity that's out there. The OSCs that need it either are don't know where to look to find it. They don't know where they are. The marketing's not good enough. I didn't know that you were a C3PAO. Right. Or they don't want to find it because they're not ready to find what that brings.

[A]

Yep. I mean, it basically comes down to that. The problem with achieving CMMC Level 2 certs has nothing to do with CMMC. It has everything to do with whether or not companies are complying with DFARS clause 252-204-7012, which was the entire purpose of the CMMC program. So the program is working as intended. Tons more companies are achieving CMMC level 2 each month. More companies are achieving CMMC level 2 each month than in previous months. The phased rollout is working perfectly fine. We have way more assessment capacity than we have actually needed every month through the phased rollout. And assessment capacity is growing faster than the apparent demand in the ecosystem is able to take advantage of.

[B]

So that's the other thing that's not even being talked about in this entire conversation is that those people in those roles, the implementer roles and the assessor roles, those pieces in which they are growing, are at record numbers as well. Right? Like so it's since the in the institution of the program and going live, the growth now is reaching output numbers that are shattering records every single month again.

[A]

Yep. If people had implemented 800171 in accordance with their DoD contractual requirements, then they could have signed up for an assessment as soon as they were available at any time since November. And that hasn't happened because people aren't complying with DFARS 7012. So like, subscribe Share this episode with your friends, your neighbors, your pets. Especially share with people who tell you that there aren't enough assessment capacity because the Cyber AB puts out the numbers every month. We'll link to that below. We'll link to last month's episode. We're going to do these numbers literally every month until people stop saying that assessment capacity is the problem. So there's going to be a blog. We'll share that out there. We're going to clip this. We're going to put this content out. Do you agree with the methodology? Is 50% conservative enough for everybody? Let us know. Do you want us to refine the numbers again? I think it's pretty conservative. One thing's very clear. We're not leveraging the number of assessors that are out there right now and we haven't been. And it's not even close.

[B]

I agree.

[A]

There you go. Thanks everybody.

[B]

See you next week. Sam.