Official sources

Use primary sources when requirements conflict or change. This methodology explains the process; it does not replace the contract, regulation, or assessment guidance.

• 32 CFR part 170 — CMMC Program
• CMMC program overview
• NIST SP 800-171 Revision 2
• CMMC contract policy and resources

Note

Program timing, assessment requirements, and contract language can change. Check the current official sources and the specific solicitation or contract before relying on a schedule or assessment path.

Publication boundary

This public site excludes client information, completed SSPs, evidence, system configurations, contract details, internal instructions, pricing, and legal documents.