CMMC Exposure Index · Edition of October 19, 2026

Which states have the most defense contractors facing a CMMC deadline.

Every DoD contractor with contract activity (a new award or a modification) in the newest 90 days of published data, counted by state, with an estimate of how many are likely to need a third-party Level 2 certification. DoD publishes awards about 90 days after signing. CMMC Phase 2 begins November 10, 2026 — 16 days away.

12,028

contractors with activity on DoD contracts of $250K+ in the window

10,266

likely need CMMC Level 2 (an estimate, see method)

51,025

contracts · 51 of 51 (50 states and DC) in this edition

Window April 22, 2026 to July 21, 2026.

Top 15 states

Contractors likely to need Level 2, by state

Hover a bar for the full row. Every state is in the table below.

Virginia1,608

California1,089

Maryland645

Florida631

Texas608

New York331

Pennsylvania319

Ohio306

Alabama302

Colorado284

Alaska280

Massachusetts271

Georgia257

North Carolina227

New Jersey217

All states

The full table

State	Contractors	Likely Level 2	Contracts
Virginia	1,755	1,608	10,000
California	1,253	1,089	4,413
Maryland	743	645	3,448
Florida	748	631	2,623
Texas	729	608	3,279
New York	384	331	1,847
Pennsylvania	381	319	2,547
Ohio	342	306	1,300
Alabama	327	302	1,324
Colorado	314	284	1,085
Alaska	320	280	1,110
Massachusetts	311	271	1,377
Georgia	330	257	1,316
North Carolina	293	227	761
New Jersey	259	217	1,105
Washington	217	179	735
Illinois	217	175	1,336
Arizona	206	171	951
Michigan	198	167	686
Oklahoma	173	148	714
Missouri	181	143	968
District of Columbia	166	139	619
Hawaii	171	134	482
Louisiana	144	121	407
South Carolina	140	113	387
Connecticut	126	113	769
Wisconsin	128	109	447
Indiana	120	103	437
Tennessee	138	100	423
Utah	123	99	401
Minnesota	101	77	332
New Mexico	84	72	336
Kansas	86	70	253
Kentucky	81	69	405
Nevada	72	63	210
Oregon	70	59	175
Iowa	65	55	389
Mississippi	70	54	249
New Hampshire	62	54	302
Idaho	59	40	149
Nebraska	49	37	105
Rhode Island	43	37	169
Arkansas	45	32	80
Montana	33	27	102
West Virginia	30	27	59
Maine	31	23	63
North Dakota	29	20	46
Delaware	24	20	75
South Dakota	27	18	134
Vermont	16	14	75
Wyoming	14	9	20

Method

How this is counted

Source: USAspending.gov, DoD contracts (award types A–D) by recipient state with any contract action in the window — new awards and modifications — whose total value is at or above the amount floor.
Contractors are de-duplicated by UEI (else name) within a state.
"Likely Level 2" is an inference from NAICS and award size. USAspending does not show whether an award carries the CMMC clause or involves CUI.
DoD publishes contract awards about 90 days after signing, so this edition covers the newest 90 days of published awards, ending 90 days before the edition date.
A contractor with awards recorded in more than one state is counted in each, so the national total can count a company more than once.

See the contractors in your service area.

For CMMC providers: we book meetings with them, and you pay only when a meeting is held.

Put Triagent on your territory →