The Numbers Behind CMMC Assessment Capacity

Everyone keeps saying there aren’t enough CMMC assessors. The data tells a very different story. In this episode we break down actual assessment capacity using the current number of certified assessors, DoD’s rollout estimates, and capacity growth rates across the ecosystem. How quickly is the ecosystem scaling toward future demand targets of 16,000 and even 25,000 assessments per year? Turns out the real bottleneck isn’t assessor capacity at all.

---

Transcript

CMMC Assessment Capacity Myth

---

Jacob: All right, folks. It is May of 2026, and we are halfway through CMMC Phase 1. People are still saying there aren’t enough assessors, and we’re here to tell you that’s not what the data shows.

To believe there’s an assessor shortage, you’d have to assume every defense contractor is assessment-ready, every C3PAO is fully booked, and most assessment teams aren’t working. None of those things are true.

What the data actually shows is that the ecosystem has substantial excess assessment capacity. That’s what we’re talking about today.

---

The Assessor Shortage Narrative

Jacob: Back in our January prediction episode, we said the Department of Defense was ahead of schedule on assessment capacity. Looking at the first five months of CMMC Phase 1, that’s exactly what we’re seeing.

Jason: When you actually look at the numbers, the narrative doesn’t hold up. The data doesn’t support the idea that assessment capacity is the bottleneck.

---

What Actually Determines Capacity?

Jacob: The real constraint isn’t the number of C3PAOs—it’s the number of Certified CMMC Assessors (CCAs).

Each assessment team requires:

• One Lead CCA
• One CCA
• One separate CCA performing quality assurance

As of April 2026:

• 766 CCAs exist
• 489 Lead CCAs exist

Using those numbers, the ecosystem could support approximately 255 assessment teams.

At one assessment per week, that’s:

• 1,020 assessments per month
• 12,240 assessments per year

For perspective, there were only about 1,240 total Level 2 certifications completed by the end of April.

Jason: When you look at it that way, the math starts making sense. The available capacity is far larger than current demand.

---

Comparing Reality to DoD Estimates

Jacob: In the CMMC Final Rule, DoD estimated only 517 Level 2 certifications would occur during Phase 1.

We already have enough assessment capacity to exceed that number many times over.

DoD also estimated:

• 2,599 certifications during Phase 2
• 8,666 certifications during Phase 3
• 16,610 assessments annually once the program is fully mature

Halfway through Phase 1, we’re already approximately 75% of the way toward the assessment capacity DoD estimated would eventually be needed for steady-state operations.

---

What If Only Half the Assessors Are Active?

Jacob: Let’s make a generous assumption and say only 50% of certified assessors are actually participating.

That still leaves:

• 128 assessment teams
• 512 assessments per month
• 6,144 assessments per year

That’s still more than enough capacity for current demand.

Let’s cut it again and assume only 25% of assessors are active.

That leaves:

• 64 assessment teams
• 256 assessments per month
• 3,072 assessments per year

Even under that unrealistic scenario, the ecosystem still has significant capacity.

Jason: That’s essentially a break-glass scenario, and even then the numbers still work.

---

The Real Problem: Readiness

Jason: If capacity isn’t the issue, what is?

Jacob: Readiness.

Many organizations are signing up for assessments before they’re actually prepared.

We’ve heard from multiple C3PAOs that roughly 25–40% of companies that attempt to begin the assessment process fail readiness reviews before the assessment even starts.

These companies don’t fail assessments.

The assessments never happen.

That’s what we’ve called a “false start.”

---

False Starts and CMMC Reality

Jacob: Years ago, we predicted that assessment failures wouldn’t be the biggest issue.

The bigger issue would be organizations discovering they weren’t actually prepared to demonstrate compliance.

Many contractors spent years assuming CMMC would never require them to prove what they claimed they were already doing under DFARS 252.204-7012 and NIST SP 800-171.

Now they’re finding out they can’t qualify for an assessment because the required controls aren’t implemented.

That’s exactly what the program was designed to reveal.

Jason: The challenge isn’t finding an assessor. The challenge is being assessment-ready when you reach one.

---

Demand vs. Capacity

Jacob: Since January, certification throughput has averaged roughly 125–180 certifications per month.

Even under our extremely conservative assumptions, capacity remains well above current demand.

Many C3PAOs still have open assessment windows and are actively seeking clients.

Some are publicly posting available assessment dates because they aren’t fully booked.

The issue is not a lack of assessors.

The issue is a lack of assessment-ready organizations.

---

Looking Ahead

Jacob: Another common claim is that capacity will become a problem later.

The numbers don’t support that either.

DoD estimates that approximately 16,610 assessments per year will eventually be required once the program reaches steady-state operations.

At the current rate of assessor growth, the ecosystem is on track to meet or exceed that requirement before it’s needed.

Even if DoD underestimated demand by 20% or even 50%, current assessor growth trends still suggest the ecosystem can reach the required capacity.

Jason: And that’s without factoring in the large number of people currently working through the assessor certification pipeline.

---

Final Thoughts

Jacob: Halfway through the first year of CMMC implementation, the ecosystem has achieved more than 1,200 Level 2 certifications and continues to add capacity every month.

The data simply does not support the claim that there aren’t enough assessors.

There are enough assessors today.

There are likely to be enough assessors tomorrow.

The bigger challenge is helping organizations become assessment-ready.

Stop worrying about assessor shortages and start focusing on readiness.

Jason: See you next week, folks.

Jacob: Like and subscribe. We’ll see you next week.

---