The final rule should be coming out around November or December, and 6 months after that point, certification will be required to bid on new work that meets the Level 2 requirements. So that is likely less than 1 year from today.

We also have several partners and primes who are asking if we're already certified, or scheduled to be certified, etc.

So I just went through the process of searching for a C3PAO through the marketplace in order to try to get on the schedule for certification, and talked to some vendors. Apparently, certifications are not taking place until the rule is finalized. They're just selling Joint Surveillance Voluntary Assessments, which I'd never heard of before, and saying they will (maybe, probably, hopefully) be transferable to a CMMC Level 2 certification. The JSVs are in conjunction with DIBCAC for getting assessed per DFARS 252.204-7019/20. I have no idea why someone would voluntarily do that and pay for it instead of waiting to be selected.

Is there anything official and definitive from the government or other sources that aren't selling CMMC services that JSVs will be transferable?

If not, how is this going to work if they're only giving 6 months for 30,000+ organizations to get certified to participate in bidding for new work? The C3PAOs are either going to be completely booked, or will charge exorbitant prices. In either case, every solicitation will be contested, probably successfully, by organizations that were not able to obtain certification due to the backlog and prices. Am I missing something?