Trace the basis
Official sources, with their limits.
Source research checked 25 October 2026. Use each document for the question it addresses, then verify applicability to the actual work.
DoD CIO — current CMMC program overview
Current program policy context, including the July 2026 Phase II suspension. Recheck before relying on timing and review the applicable acquisition documents.
32 CFR 170.15 — Level 1 self-assessment and affirmation
Annual self-assessment, all 15 requirements MET; no Level 1 POA&M. Current eCFR text read 2026-10-25, title current through 2026-10-22.
32 CFR 170.16 — Level 2 self-assessment and affirmation
Level 2 self-assessment framework; distinguish current procurement applicability from rule architecture.
FAR 52.204-21 — Basic safeguarding
FCI definition,15 safeguards and flowdown; standard text not assumed operative where a deviation applies.
32 CFR 170.19 — CMMC scoping
Scope specified before assessment; asset rules differ by level. No automatic classification from tool inputs.
National Archives — About CUI
CUI framework and authority, not a designation of a reader-provided file.
National Archives — CUI category registry
Category authorities do not by themselves classify a specific file.
NIST SP 800-171 Revision 2 publication record
Publication is superseded at NIST; distinguish publication currency from revision incorporated into applicable requirements.
DFARS 252.204-7012 — Safeguarding and cyber incident reporting
Standard clause source; actual applicable acquisition text and deviations need review.
32 CFR 170.22 — Affirmation
Authorized affirmation and continuing compliance, not an editorial checkbox.
DFARS 252.204-7021 — CMMC contract clause
Standard November 2025 clause; never treat as universal operative text during deviation changes.
DARS — official RFO class deviation index
The official index identifies 2026-O0025 Revision 3, dated 3 September 2026. Read the applicable memorandum and attachments before interpreting operative changes; this publication does not analyze their complete terms.
Acquisition.gov — FAR Overhaul resources
Locate current parts and agency deviations; applicability must be checked.
NIST SP 800-171A, June 2018 publication record
Historical assessment publication; record says withdrawn May 2024. Do not substitute revisions automatically.
SAM.gov — laboratory-services notice, source-currency example
Official notice excerpt read 2026-10-25. Used only to illustrate amendment/version warnings, not complete terms or bidding advice.
Recheck before a material decision
Use current official pages and the exact revision, date, amendment and applicability. Older slides and archived publications can explain history without controlling today’s procurement. Refer a material conflict to authorized contracts, security or legal reviewers. This publication cannot settle it for an individual acquisition.
Read our editorial approach and common ownership disclosure.