Apart from the documentation surrounding CMMC, Organizations Seeking [CMMC] Certification (OSCs) have the opportunity to work with members of the CMMC ecosystem by either hiring a certified individual, getting an employee certified, or hiring a consultant who is certified. CMMC-certified personnel can be found within the CMMC Marketplace controlled by the Cyber AB. The CMMC Marketplace allows users to filter the ecosystem by the role they are looking for, the business’s age, their scope of services, counties supported, primary time zone, regions supported, and whether they offer remote services. These options allow OSCs to filter through the CMMC ecosystems to find an individual or organization that is specifically tailored to your organization’s needs. If desired, feel free to reach out to us at Business Transformation Institute, Inc. (BTI) for more information. Here at BTI, we also offer pre-assessment consultation services with a focus on scoping and practice implementation.
The main source for CMMC documentation is the Department of War/Defense’s Chief Information Officer website. This website gives a basic overview of the certification, frequently asked questions, and official resources and documents. The webpage Resources-Documentation compiles official documents and resources covering CMMC from both internal and external organizations. This page is especially important for OSCs with documentation covering scoping and assessment guidance along with the legal documents that pertain to the CUI Program and CMMC. Below is a list of all the documents found within the Resources-Documentation webpage along with short descriptions of the content each link leads to.
Internal Resources:
|
Reference Document |
Description |
|
32 CFR Part 170: Cybersecurity Maturity Model Certification (CMMC) Program |
32 CFR Part 170 sets forth the Final Rule that establishes the CMMC Program. This section of the Code of Federal Regulations not only establishes the CMMC Program but also covers its purpose, the 3-tiered model, and the verification methods used to confirm compliance. |
|
This webpage shows the Final Rule for DFARS Case 2019-D041 and acts as the contractual mechanism that sets forth the DoW/DoD’s usage of CMMC requirements in solicitations and contract rewards. |
|
|
The CMMC 101 Brief is a slide deck that gives defense contractors the prevalent information regarding CMMC. The purpose of this slide deck is to give a broad overview of CMMC, covering only the essential information through brief descriptions such as the history, reasoning behind its creation, framework requirements, the phased implementation plan, and the ecosystem. |
|
|
CMMC Overview Briefing (Audio): CMMC Overview Briefing (Audio) |
This webpage has a 12-minute video with speakers in the field covering the content of the CMMC 101 Brief (mentioned above). While this video simply covers what is found in the slide deck, the speakers do offer a bit more context and explanations of the content. |
|
This document is also an overview of CMMC but from a technical perspective. This document covers the different CMMC Levels along with the exact security requirements that each level requires. |
|
|
Shows the guidance for scoping surrounding Level 1 self-assessments. This document discusses what is considered in-scope, out-of-scope, and specialized assets, as well as additional guidance concerning scoping in relation to CMMC Level 1 self-assessments and compliance. |
|
|
The CMMC Level 1 Self-Assessment Guide details what a Level 1 self-assessment entails. This also shows the 15 practices including descriptions, examples, and each practices potential assessment methods. |
|
|
Shows the guidance for scoping surrounding Level 2 assessments with a specific focus on CUI. This document discusses what is considered in-scope, out-of-scope, and specialized assets, as well as additional guidance concerning scoping in relation to CMMC Level 2 assessments and compliance. It also covers how to identify your scope and the different asset categories. |
|
|
The CMMC Level 2 Assessment Guide details what a Level 2 assessment entails. This also shows the 110 practices including descriptions, examples, and each practices potential assessment methods. |
|
|
Shows the guidance for scoping surrounding Level 3 assessments with a specific focus on CUI. This document discusses what is considered in-scope, out-of-scope, and specialized assets, as well as additional guidance concerning scoping in relation to CMMC Level 3 assessments and compliance. It also covers how to identify your scope and the different asset categories. |
|
|
The CMMC Level 3 Assessment Guide details what a Level 3 assessment entails. This also shows the 24 practices (those not found in NIST SP 800-171) including descriptions, examples, and each practices potential assessment methods. |
|
|
The CMMC Hashing Guide gives a description and instructions on how to use the DoW/DoD’s Microsoft PowerShell script used for artifact hashing required for Level 3 and some Level 2 compliance. |
|
|
A slide deck developed by the DoW/DoD describing CMMCs alignment to NIST SP 800-171 for Level 2 and NIST SP 800-172 for Level 3. |
|
|
This slide deck explains how to use the Supplier Performance Risk System or SPRS to record self-assessment results for compliance verification and to be considered for a certification. |
|
|
Describes the CMMC Enterprise Mission Assurance Support Service (eMASS) and how it will be used by C3PAOs and government assessors to record assessment results for an OSC to be considered for certification. |
|
|
CMMC Briefing: FedRAMP Authorization and Equivalency (Feb 2025) |
Details FedRAMPs relation to CMMC and in turn its relation to OSCs who utilize cloud service providers. |
|
A very short slide deck that shows how the DoW/DoD makes a determination on the CMMC level for contract solicitation. |
|
|
CMMC Briefing: Technical implementation of CMMC Requirements (Feb 2025) |
Covers how external service providers are treated and their requirements when used by an OSC. |
|
DoD Memo: Organization-Defined Parameters for NIST SP 800-171 Rev3 (Feb 2025) |
A memo that covers the relationship between NIST SP 800-171 Revision 2 and NIST SP 800-171 Revision 3. It also discusses the changes that will be implemented once revision 3 has been adopted into CMMC. |
External Resources:
|
Reference Document |
Description |
|
The CMMC Assessment Process (CAP) document serves as the official playbook that outlines the steps, protocols, and scoring methodologies C3PAOs must follow when assessing an organization. It details the entire assessment life cycle across four distinct phases, ensuring consistency from pre-assessment planning through final certification. |
|
|
The DoW/DoD Procurement Toolbox “Cybersecurity Other Resources” page acts as a centralized repository managed by the Department of War/Defense to help defense contractors navigate acquisition regulations. It is a collection of links to core policy documents, training webinars, NIST SP 800-171 assessment methodologies, and official rules regarding the CMMC program and CUI handling. |
|
|
DFARS Clause 252.204-7012: Safeguarding Covered Defense Information and Cyber Incident Reporting |
DFARS 252.204-7012 legally mandates that defense contractors protect CU) by implementing all 110 security controls of NIST SP 800-171. It also enforces operational requirements, forcing contractors to report cyber incidents directly to the DoW/DoD within 72 hours and ensure that any cloud providers they use meet at least FedRAMP Moderate equivalency. |
|
DFARS Provision 252.204-7019: Notice of NIST SP 800-171 DoD Assessment Requirements |
DFARS 252.204-7019 prevents the DoW/DoD from awarding or continuing a contract unless the contractor has a current NIST SP 800-171 assessment score uploaded into the Supplier Performance Risk System (SPRS). It requires contractors to verify that their score is properly posted before they can be considered for a contract, task order, or delivery order involving defense data. |
|
DFARS Clause 252.204-7020: NIST SP 800-171 DoD Assessment Requirements |
DFARS 252.204-7020 legally requires defense contractors to grant the Department of War/Defense physical and logical access to their systems, facilities, and personnel to conduct cybersecurity audits. Additionally, it forces prime contractors to police their own supply chains by mandating the flow-down of this clause and forbidding subcontract awards unless the subcontractor has a valid score uploaded to the Supplier Performance Risk System (SPRS). |
|
DFARS Clause 252.204-7021: Contractor Compliance With the CMMC Level Requirements |
DFARS Clause 252.204-7021 is the clause that codifies CMMC into law and makes it a requirement for all DoW/DoD contracts/sub-contracts. It requires defense contractors to achieve and maintain the specific CMMC level outlined in their contract prior to award, and to formally verify that their subcontractors have met the same appropriate security baselines. Note: While this is listed on the website as TBD and links back to the same page, this clause is fully realized and in effect. An alternative way to reach this resource is to follow DFARS Clause 252.204-7021. |
|
NIST SP 800-171 Rev. 2: Protecting CUI in Nonfederal Systems |
NIST Special Publication 800-171 Revision 2 establishes the cybersecurity requirements designed to protect the confidentiality of CUI residing in non-federal systems and organizations. The document organizes a total of 110 specific technical and administrative security controls across 14 domains, serving as the core technical standard that defense contractors must meet to achieve CMMC Level 2 certification. |
|
NIST SP 800-171A: Assessing Security Requirements for Controlled Unclassified Information |
NIST Special Publication 800-171A serves as the official testing companion to NIST SP 800-171, defining the exact assessment procedures, lettered objectives, and grading criteria used to evaluate whether an organization has properly implemented the 110 security requirements. It also outlines the specific “Examine, Interview, and Test” methodologies that both internal teams conducting self-assessments and C3PAO assessors (Assessment Team) must use to verify compliance. |
|
NIST SP 800-172: Enhanced Security Requirements for Protecting Controlled Unclassified Information |
NIST Special Publication 800-172 establishes enhanced security requirements designed to protect CUI assets from sophisticated Advanced Persistent Threats (APTs). It acts as a supplement to NIST SP 800-171, forming the foundation for organizations seeking to achieve the highest tier of defense compliance under CMMC Level 3. |
|
NIST SP 800-172A: Assessing Enhanced Security Requirements for Controlled Unclassified Information |
NIST Special Publication 800-172A is the official evaluation guide used to test and verify the advanced controls found in NIST SP 800-172. Similar to NIST SP 800-171A it provides checklists, lettered objectives, and flexible testing steps that assessors use to ensure a network can defend high-value data against sophisticated cyber threats. This document provides the framework for conducting the high-level assessments required for contractors aiming for CMMC Level 3. |
|
The official website for the DoW/DoD’s CUI Program serves as the central repository for the DoW/DoD CUI Registry, detailing every approved data category and its associated marking requirements. It provides mandatory annual training resources, policy updates, and desktop aids to help defense personnel and industrial contractors properly safeguard unclassified sensitive data. |
|
|
The Supplier Performance Risk System (SPRS) is the Department of War/Defense’s official database used to gather, track, and score contractor performance and supply chain risk. It acts as the mandatory repository where organizations must upload and maintain their NIST SP 800-171 self-assessment scores and CMMC certification status. Contracting officers review this system before awarding defense contracts to verify that a supplier meets the necessary data protection requirements. |
|
|
The Cyber AB website serves as the official portal for the CMMC ecosystem’s exclusive accreditation body partner authorized by the Department of War/Defense. It features a comprehensive marketplace directory where defense contractors can search for authorized C3PAOs, certified practitioners, and credentialed assessment professionals. Additionally, the platform provides official updates, professional codes of conduct, and specialized readiness tools to help guide organizations through their certification journey. |
|
|
DoD Instruction (DoDI) 5200.48 serves as the Department of War/Defense’s internal playbook for implementing the federal CUI program across the military branches and the defense industrial base. It officially created the DoW/DoD CUI Registry and establishes official rules for how personnel and contractors must mark, handle, share, and destroy sensitive unclassified data at an operational level. |
|
|
DODI 5000.90 – Cybersecurity for Acquisition Decision Authorities and Program Managers |
DoD Instruction (DoDI) 5000.90 establishes the official policy and procedures for managing cybersecurity risks within the Defense Acquisition System. It directs acquisition decision authorities and program managers to integrate cybersecurity planning, threat assessments, and supply chain protections across all stages of a program’s lifecycle. This directive ensures that defense platforms, weaponry, and the surrounding industrial base are continuously defended against evolving cyber threats. |
|
Executive Order on Improving the Nation’s Cybersecurity (May 12, 2021) |
Executive Order 14028 or “Improving the Nation’s Cybersecurity” outlines a comprehensive strategy to modernize federal digital infrastructure and protect supply chains. It mandates that federal agencies adopt Zero Trust Architecture, accelerate secure cloud migration, and enforce strict multi-factor authentication and encryption standards. |
Additional Resources:
|
Reference Document |
Description |
|
NIST SP 800-53: Security and Privacy Controls for Information Systems and Organizations |
NIST SP 800-53 Revision 5 is a collection of over 1,000 security and privacy controls organized across 20 domains to protect federal and corporate IT networks from cyber threats. |
|
This document contains the official, full publication of the NIST Cybersecurity Framework (CSF). It expands the framework’s scope beyond critical infrastructure to help any organization, regardless of size or sector, manage and reduce cybersecurity risks. |
|
|
Cybersecurity & Infrastructure Security Agency (CISA) Resources |
The CISA Resources and Tools page acts as a centralized repository providing free security assessments, technical assistance, and training to protect organizations. It features a curated database of no-cost tools, cyber resilience templates, and regional advisory contacts to help network defenders reduce vulnerability risks. |
|
The Federal Risk and Authorization Management Program (FedRAMP) is the mandatory government-wide program that standardizes security assessments for cloud products used by federal agencies. It features the official FedRAMP Marketplace, a searchable database where agencies can find authorized cloud service providers that meet strict security benchmarks. |
|
|
The National Defense Industrial Association (NDIA) Cybersecurity Division webpage serves as a collaborative hub that connects defense contractors with government policymakers to discuss emerging security requirements and regulatory updates. |
|
|
This portal provides cybersecurity training, consulting, and resources specifically tailored for the defense acquisition workforce and university partners. The program’s mission is to deliver proactive, adaptive training to help personnel and defense contractors effectively manage supply chain risk and safeguard critical assets. |
|
|
This is the official Cyber AB Marketplace catalog. It serves as a direct, filtered search directory within the ecosystem where defense contractors can browse certified CMMC partners like Registered Provider Organizations (RPOs) and Certified Third-Party Assessment Organizations (C3PAOs). Contractors can use this to verify the valid credentials of any consultant or assessor before hiring them. |
|
|
The NIST Cybersecurity and Privacy Reference Tool (CPRT) provides a simplified way to access reference data from various NIST standards, guidelines, and frameworks. |
The most important resources and documents to pay attention to for OSCs are the scoping and assessment guidance at the desired level, along with the CMMC Assessment Process (CAP). While every assessment will vary, the CAP outlines the general steps and procedures that will be carried out regarding a Level 2 assessment. While primarily written for C3PAOs and Assessment Teams, it may also prove useful for OSCs trying to map out what to expect from an assessment. The document covers the entire lifecycle of the process through four phases: Pre-Assessment (Phase 1), the actual Assessment (Phase 2), Reporting (Phase 3), and Closeout (Phase 4). From an OSC’s perspective, the first two phases are the most important. These phases require teamwork and collaboration between the OSC and the Assessment Team. Once the assessment proceeds to phase 3, the heavy lifting is essentially over for the OSC, unless deficiencies are found that trigger a remediation process or closeout protocols found in Phase 4.
Other extremely important documents are the ones that hold the required practices and assessment objectives to achieve certification. These documents are of the upmost importance because they hold the practices that are required to be implemented and assessed to achieve compliance. A full list of security controls is found in Security and Privacy Controls for Information Systems and Organizations (NIST SP 800-53 Revision 5). While this gives a basis for every possible security control, when targeting a specific CMMC level, it is best to use documents listing only the practices required for that level. These sets of practices are found by looking at FAR 52.204-21, NIST SP 800-171 Rev 2, and NIST SP 800-171A Rev 2. Basic Safeguarding of Covered Contractor Information Systems (FAR 52.204-21) lists all practices needed for Level 1 compliance and derives them from NIST SP 800-171 Rev 2. NIST SP 800-171 or Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, lists 110 practices needed Level 2 compliance. For NIST SP 800-171, ensure you use Revision 2 and not Revision 3. While Revision 3 is the latest, CMMC still follows Revision 2 until the certification requirements can be updated. Assessing Security Requirements for Controlled Unclassified Information (NIST SP 800-171A) is a separate document from NIST SP 800-171, notice the A at the end of NIST SP 800-171A not found in NIST SP 800-171. It includes the required practices, as well as the assessment objectives those practices must fulfill. So, although FAR 52.204-21 lists all Level 1 practices, you still need to consult NIST SP 800-171A for the assessment objectives (remember Level 1 practices are from NIST SP 800-171 Rev 2). The same version note for NIST SP 800-171 applies to NIST SP 800-171A: while Revision 3 is out, CMMC follows Revision 2.
To gain a full understanding of CMMC, you should understand the legal, regulatory, and policy drivers of the certification. Start by reviewing the Code of Federal Regulations (CFR). The CFR has several titles under it, with the most relevant being Title 32 and Title 48. Title 32 of the CFR covers the CMMC Program under Part 170 (32 CFR Part 170) and the CUI Program under Part 2002 (32 CFR Part 2002). Both Part 170 and Part 2002 can be defined as the policy pillars of CMMC. Part 170 establishes the structural framework of the CMMC program, defines the three levels, and details how the assessment boundaries and scoping are calculated. Part 2002 defines the CUI program by setting up its authorities and oversight of the program. The main purpose is to help define and manage CUI by including how it should be marked, designated, handled, and safeguarded.
Within Title 48 of the CFR, there are two main places to look: Chapter 1, the Federal Acquisition Regulation (FAR), and Chapter 2, the Defense Federal Acquisition Regulation Supplement (DFARS). Under the FAR, specifically 52.204-21 (FAR 52.204-21), you can find the framework that establishes the requirements and practices for a Level 1 certification, along with detailing all 15 basic cyber hygiene practices. By satisfying every requirement of FAR 52 an organization could be essentially ready for a Level 1 Self-Assessment as all the technical foundation needed to pass is held within this clause.
Under Title 48, within Chapter 2, you can find four DFARS clauses that directly relate to the certification, by setting up specific DoW/DoD requirements in addition to the FAR. The important DFARS clauses to pay attention to are DFARS 252.204-7012, DFARS 252.204-7019, DFARS 252.204-7020, and DFARS 252.204-7021. Clause 7012 is named Safeguarding Covered Defense Information and Cyber Incident Reporting and requires all government contractors that are handling CUI to implement the 110 security controls found in NIST SP 800-171. Included in this is the fact that if an organization is planning to handle CUI in the future, then they must have all 110 practices implemented and verified before any CUI can be handed over.
Clauses 7019 and 7020 are very closely related with 7019 being named Notice of NIST SP 800-171 DoD Assessment Requirements and 7020 being named NIST SP 800-171 DoD Assessment Requirements. While 7019 may seem like just a notice of 7020, 7019 does establish that a self-assessment score of NIST SP 800-171 must be submitted to the DoW/DoD’s Supplier Performance Risk System (SPRS) before a contract can be accepted, initiated, or continued. 7020 on the other hand has two important effects on contractors. The first is that per 7020 the Department of War/Defense has the right to verify your NIST SP 800-171 Self-Assessment Score through a government-led assessment of the environment. The second is that sub-contractors are subject to flow-down requirements and that it is up to the prime contractors to verify that the sub-contractor is authorized to handle defense information, has a current assessment score uploaded to SPRS, and is aware of those requirements.
DFARS 252.204-7021 is titled Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements and is arguably the most essential clause in relation to CMMC as this clause formally implements CMMC and mandates the use of CMMC requirements into defense contracts. It requires contractors to achieve and maintain a specific CMMC level in accordance with the solicitation before a contract can be awarded. It also requires contractors to ensure that their subcontractors have also achieved and are maintaining their required CMMC level before sensitive information is passed down.
Below is a simplified structure map of the CFR, with the relevant CMMC documentation:
Code of Federal Regulations (CFR)
