Official CMMC References

These are the primary sources for the CMMC program and the standards behind it: the program page, the accreditation body, the standard, and the rule.

  • DoD CIO: CMMC program
    The Department of Defense's program page, with the model overview, scoping guides, and assessment guides.
  • The Cyber AB
    The CMMC accreditation body. Its Marketplace lists authorized C3PAOs and registered practitioner organizations.
  • NIST SP 800-171 Rev. 2
    The 110 security requirements for protecting Controlled Unclassified Information that CMMC Level 2 is built on.
  • 32 CFR Part 170
    The federal rule that establishes the CMMC program.