Final CMMC Acquisition Rule Published
CMMC Phase 1 implementation of self-assessments to begin Nov 10th
**Reminder to submit AFFIRMATIONS with your CMMC assessments in SPRS**

CMMC Resources & Documentation

Internal Resources

32 CFR Part 170: Cybersecurity Maturity Model Certification (CMMC) Program
48 CFR Parts 204, 212, 217, and 252: Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041)
CMMC 101 Brief: CMMC 101 Brief
CMMC Overview Briefing (Audio): CMMC Overview Briefing (Audio)
CMMC Model Overview: CMMC Program Model Overview
CMMC Level 1 Scoping Guidance: CMMC Level 1 Scoping Guidance
CMMC Level 1 Self-Assessment Guide: CMMC Level 1 Self-Assessment Guide
CMMC Level 2 Scoping Guidance: CMMC Level 2 Scoping Guidance
CMMC Level 2 Assessment Guide: CMMC Level 2 Assessment Guide
CMMC Level 3 Scoping Guidance: CMMC Level 3 Scoping Guidance
CMMC Level 3 Assessment Guide: CMMC Level 3 Assessment Guide
CMMC Hashing Guide: CMMC Hashing Guide
CMMC Briefing: CMMC Alignment to NIST Standards (Feb 2025)
CMMC Briefing: DoD SPRS (Feb 2025)
CMMC Briefing: CMMC eMASS (Feb 2025)
CMMC Briefing: FedRAMP Authorization and Equivalency (Feb 2025)
CMMC Briefing: Levels Determination (Feb 2025)
CMMC Briefing: Technical Implementation of CMMC Requirements (Feb 2025)
DoD Memo: Organization-Defined Parameters for NIST SP 800-171 Rev3 (Feb 2025)

External Resources

The Cyber AB: CMMC Assessment Process (CAP)
Department of Defense Procurement Toolbox: Implementing the Cybersecurity Maturity Model Certification (CMMC) Program
CMMC Defense Federal Acquisition Regulation Supplement (DFARS) Proposed Rule: CMMC DFARS Proposed Rule
DFARS Clause 252.204-7012: Safeguarding Covered Defense Information and Cyber Incident Reporting
DFARS Provision 252.204-7019: Notice of NIST SP 800-171 DoD Assessment Requirements
DFARS Clause 252.204-7020: NIST SP 800-171 DoD Assessment Requirements
DFARS Clause 252.204-7021: TBD
NIST SP 800-171 Rev. 2: Protecting CUI in Nonfederal Systems
NIST SP 800-171A: Assessing Security Requirements for Controlled Unclassified Information
NIST SP 800-172: Enhanced Security Requirements for Protecting Controlled Unclassified Information
NIST SP 800-172A: Assessing Enhanced Security Requirements for Controlled Unclassified Information
DoD CUI Program Website: DoD CUI Program
Supplier Performance Risk System (SPRS): SPRS
CMMC Accreditation Body Website: CMMC Accreditation Body
DODI 5200.48 – Controlled Unclassified Information: DODI 5200.48
DODI 5000.90 – Cybersecurity for Acquisition Decision Authorities and Program Managers: DODI 5000.90
Executive Order on Improving the Nation’s Cybersecurity (May 12, 2021): Executive Order

Additional Resources

NIST SP 800-53: Security and Privacy Controls for Information Systems and Organizations
NIST Cybersecurity Framework (CSF): NIST Cybersecurity Framework
Cybersecurity & Infrastructure Security Agency (CISA) Resources: CISA Resources
Federal Risk and Authorization Management Program (FedRAMP): FedRAMP
National Defense Industrial Association (NDIA): NDIA Cybersecurity
Defense Acquisition University (DAU): DAU Cybersecurity Courses
CMMC Marketplace: CMMC Marketplace
Cybersecurity and Privacy Reference Tool (CPRT): CPRT