Resources
CMMC Resources
The official documents behind CMMC and the NIST publications it draws from. Each links to the authoritative source used by assessors; this site summarizes and cross-references them but never replaces them.
Official program documents
Rule and contract clauses
- 32 CFR Part 170 (CMMC Program rule)
Levels, assessment types, POA&M rules, affirmations and scoping requirements.
- DFARS 252.204-7012
Safeguarding covered defense information and 72-hour cyber incident reporting.
- Supplier Performance Risk System (SPRS)
Where self-assessment scores and annual affirmations are recorded.
Assessment guides (v2.13)
- Level 1 Assessment Guide
The 15 Level 1 practices with their assessment objectives.
- Level 2 Assessment Guide
The 110 Level 2 practices with objectives, discussion and examples.
- Level 3 Assessment Guide
The 24 Level 3 practices drawn from NIST SP 800-172.
Scoping guides (v2.13)
- Level 1 Scoping Guide
Which assets are in scope for a Level 1 self-assessment.
- Level 2 Scoping Guide
Asset categories (CUI, security protection, contractor risk managed, specialized, out of scope).
- Level 3 Scoping Guide
Level 3 scoping on top of a Level 2 certification.
Assessment procedures and CUI
- NIST SP 800-171A
Assessment procedures (examine, interview, test) for the 800-171 requirements.
- NIST SP 800-172A
Assessment procedures for the enhanced 800-172 requirements.
- National Archives CUI Program
CUI categories, markings and the CUI Registry.
- The Cyber AB
The CMMC accreditation body: marketplace of C3PAOs and assessors.
Frameworks in the catalog
Enhanced Security Requirements for Protecting CUI
Source · NIST
Enhanced Security Requirements for Protecting CUI (Revision 3)
Source · NIST