Good guidance keeps the source within reach.
Use government rules and current procurement documents to verify the requirement behind a summary.
- 32 CFR Part 170 — CMMC program rule
Program model, assessment pathways, scope, POA&Ms, and affirmations.
- FAR 52.204-21 — Basic safeguarding
FCI definition and the 15 basic safeguarding requirements.
- DFARS 252.204-7021 — CMMC requirements
Contractor status, affirmation, and subcontract requirements.
- DoD CIO — CMMC program
Government program information and documentation.
- NIST SP 800-171 Revision 2
The 110-requirement baseline incorporated into CMMC Level 2.
- NIST SP 800-172
Enhanced requirements; CMMC Level 3 selects 24 through the program rule.
- National Archives — CUI Registry
Official CUI categories and authorities.
- Supplier Performance Risk System
Official system information and user guidance.
- DCMA DIBCAC
Government assessment organization information.
- The Cyber AB marketplace
Verify current ecosystem listings and assessment-provider status.
Current implementation policy
July 13, 2026 official suspension announcement · Current CIO overview
The CMMC rule incorporates NIST SP 800-171 Revision 2. NIST has published newer revisions; a publication being superseded in the NIST catalog does not by itself change the baseline incorporated into the CMMC rule. Understand Revision 2 and Revision 3 in context.
Commercial references
Product and service descriptions come from CMMC Pulsar and Federal Bid Partners. Review entries are indexed from FBP’s published collection; the separate Trustpilot score is from the public Trustpilot profile.