CMMC Controls List: Full List of Requirements by Level and Domain

The CMMC controls list has 15 security requirements at Level 1, 110 at Level 2, and 24 more at Level 3, each with an identifier and official wording. The solicitation names the level your contract requires, and a contracting officer may not award to an offeror without it.

Older lists carry other numbers, such as the "17 practices" the 2021 CMMC 2.0 overview counted at Level 1. At Level 1, which allows no plan of action and milestones (POA&M), a requirement missing from your list stays unmet. If you run IT or compliance for a machine shop, engineering firm, software vendor, or other defense supplier that handles FCI or CUI, these are your lists.

On 13 July 2026 the Department of War, a name open to the Department of Defense (DoD) since a September 2025 executive order, suspended CMMC Phase II and kept Phase I self-assessment requirements. The lists remain those of 32 CFR 170.14. For the program, see the CMMC compliance guide.

CMMC 2.0 Controls Explained

CMMC security controls are the requirements a defense contractor must meet, at the level its contract names, on each information system that handles the contract's data. Two kinds of data set the level:

• Federal contract information (FCI) is information "not intended for public release" that is provided by or generated for the Government under a contract, other than information the Government provides to the public or simple transactional information, such as what is needed to process payments.
• Controlled unclassified information (CUI), as 32 CFR 2002.4 defines it, is information that a law, regulation, or Government-wide policy "requires or permits an agency to handle using safeguarding or dissemination controls".

The CMMC requirements come from FAR 52.204-21 for Level 1, NIST SP 800-171 Rev 2 for Level 2, and selected requirements of NIST SP 800-172 for Level 3, all made part of the CMMC rule, 32 CFR part 170.

The rule calls them "security requirements". FAR 52.204-21 calls its items "security controls", and the 2021 guides called them "practices", so this CMMC 2.0 controls list uses the three words for the same thing.

Every requirement carries an identifier in the format DD.L#-REQ that the rule defines. Figure 1 takes one Level 1 ID apart and shows what REQ stands for at each level.

CMMC Control Areas at a Glance

Every requirement on the list sits in one of 14 domains, the CMMC control families, which map to the requirement families of NIST SP 800-171 Rev 2. Table 1 shows what each domain covers and how many requirements it holds at each level; each domain's Level 2 requirements follow in its own table below.

Table 1. The 14 CMMC domains and their requirement counts

Sources: NIST SP 800-171 Rev 2 (3); Level 1 guide (2); Table 1 to 32 CFR 170.14(c)(4) (1); read October 2026.

Note. Each Level 1 requirement corresponds to one or more Level 2 requirements in the Level 1 guide, so the columns are not added together.

Figure 2 draws the same 14 domains as two rings, with the six that hold Level 1 requirements in the middle and a dot where Level 3 adds requirements.

CMMC Control Count by Level

Table 2 sets the CMMC controls by level beside the data each level protects and how it is assessed. How many controls are in CMMC Level 1? 32 CFR 170.14(c)(2) points to FAR 52.204-21(b)(1)(i) through (xv), which puts the CMMC Level 1 number of controls at 15.

How many controls are in CMMC Level 2? Level 2 has 110, the number of security requirements in NIST SP 800-171 Rev 2, because the rule makes its requirements "identical" to those. The CMMC Level 2 number of controls was already 110 in the 2021 overview, and nothing since has changed how many controls are in CMMC 2.0 Level 2.

Table 2. CMMC levels and what each one requires

Sources: 32 CFR 170.14 (1), 170.15 (4), 170.16 (5), 170.17 (6), 170.18 (7), 170.21 (8), 170.22 (9); names from the 2021 overview (10); read October 2026.

Note. C3PAO is a CMMC Third-Party Assessment Organization, SPRS the Supplier Performance Risk System, and DCMA DIBCAC the Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center.

Figure 3 shows how the five levels of CMMC 1.0 became these three.

To find your row, read the level the contract names; it follows the type of data, so FCI alone means Level 1 and CUI means Level 2 or 3. Table 2 describes the rule; the suspension that began on 13 July 2026 limits what new contracts may name, as the FAQ below explains. A subcontractor needs a CMMC status of its own under 32 CFR 170.23 when it will process, store, or transmit FCI or CUI on its information systems under the subcontract. The prime contractor must flow the requirements down to it.

Some lists still count 17 at Level 1 because of one FAR paragraph. Paragraph (b)(1)(ix) holds three duties: "Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices". The December 2021 Level 1 guide split it into PE.L1-3.10.3, PE.L1-3.10.4 and PE.L1-3.10.5, each marked "Partial b.1.ix"; the current guide numbers by FAR paragraph, which gives 15. CMMC 1.0 vs 2.0 covers the earlier model.

Figure 4 follows the three duties of paragraph (b)(1)(ix) through both editions of the guide.

CMMC Level 1 Controls List

FAR 52.204-21 supplies the CMMC 2.0 Level 1 controls in 15 safeguarding requirements across six domains. In the 2021 guide the same requirements formed a CMMC 2.0 Level 1 practices list of 17 entries. Summarized from the FAR text, the six domains ask for the following:

• AC (Access Control): limit who gets access and what users may do, control connections to external systems, and control what is posted on publicly accessible systems.
• IA (Identification and Authentication): identify users, processes, and devices, and verify those identities before access.
• MP (Media Protection): sanitize or destroy media holding FCI before disposal or reuse.
• PE (Physical Protection): limit physical access to authorized individuals, escort visitors, keep audit logs of entry, and manage access devices.
• SC (System and Communications Protection): monitor and protect the system boundaries, and put publicly accessible components in separate subnetworks.
• SI (System and Information Integrity): correct flaws in time, protect against malicious code, update that protection, and scan systems and incoming files.

At Level 1 every requirement must be fully implemented to be MET, and no POA&M is permitted.

Table 3. The 15 CMMC Level 1 requirements

Sources: FAR 52.204-21(b)(1) (12); identifiers from the Level 1 guide (2); read October 2026.

Note. The December 2021 guide numbered these by NIST SP 800-171, for example AC.L1-3.1.1.

CMMC Level 2 Controls List

32 CFR 170.14(c)(3) makes Level 2 identical to the 110 security requirements of NIST SP 800-171 Rev 2, so that publication is the CMMC 2.0 Level 2 controls list. In the 2021 overview, the CMMC 2.0 Level 2 practices list was "110 practices aligned with NIST SP 800-171". NIST SP 800-171 Rev 2 itself comes with two details:

• The revision: the rule incorporates Rev 2 by reference, although NIST withdrew Rev 2 on 14 May 2024 in favor of Rev 3.
• NFO controls: controls that NIST marks NFO in the tailoring appendix of Rev 2 are not among the 110.

The count per domain is in Table 1; the 14 tables below give every requirement with its points, whether it can go on a POA&M, and any Level 1 match. The domain tables follow in the order of the NIST families, from Access Control to System and Information Integrity.

CMMC vs NIST 800-171 compares the two programs, and CyberCrest's NIST 800-171 compliance services support work on the same 110 requirements.

The 14 CMMC Domains, Requirement by Requirement

Here is the full list of CMMC controls at Level 2, domain by domain. Each table gives every requirement in the wording of NIST SP 800-171 Rev 2, its points under 32 CFR 170.24, and whether 32 CFR 170.21 lets it sit on a POA&M. The records and people named above each table come from the examine and interview lists of the Level 2 assessment guide.

The last column names the Level 1 requirement that the Level 1 guide maps to each of 17 Level 2 requirements. Three of them, PE.L2-3.10.3 to PE.L2-3.10.5, each match one of the three duties in FAR paragraph (b)(1)(ix), so they are marked (part).

Access Control (AC)

Access Control holds 22 requirements. For most of them the guide has the assessor examine the access control policy, the system security plan, configuration settings, and audit logs.

Table 4. Access Control (AC) requirements

Sources: NIST SP 800-171 Rev 2 (3); points, 32 CFR 170.24 (14); POA&M, 32 CFR 170.21 (8); Level 1 column, Level 1 guide (2); read October 2026.

Awareness and Training (AT)

Awareness and Training holds three requirements. Expect the assessor to ask for the training policy, the curriculum, and the training records, and to interview the people responsible for security awareness training. AT.L2-3.2.1 and AT.L2-3.2.2 are worth 5 points each.

Table 5. Awareness and Training (AT) requirements

Sources: NIST SP 800-171 Rev 2 (3); points, 32 CFR 170.24 (14); POA&M, 32 CFR 170.21 (8); Level 1 column, Level 1 guide (2); read October 2026.

Audit and Accountability (AU)

Audit and Accountability has nine requirements. AU.L2-3.3.1 and AU.L2-3.3.5, which create the logs and correlate their review, carry 5 points. Besides the logs themselves, the guide lists system incident reports among the records to examine.

Table 6. Audit and Accountability (AU) requirements

Sources: NIST SP 800-171 Rev 2 (3); points, 32 CFR 170.24 (14); POA&M, 32 CFR 170.21 (8); Level 1 column, Level 1 guide (2); read October 2026.

Configuration Management (CM)

Configuration Management holds nine requirements. The assessor looks for the configuration management plan, change control records, and the security configuration checklists your team works from. CM.L2-3.4.1, CM.L2-3.4.2 and CM.L2-3.4.5 through CM.L2-3.4.8 carry 5 points each.

Table 7. Configuration Management (CM) requirements

Sources: NIST SP 800-171 Rev 2 (3); points, 32 CFR 170.24 (14); POA&M, 32 CFR 170.21 (8); Level 1 column, Level 1 guide (2); read October 2026.

Identification and Authentication (IA)

Identification and Authentication holds 11 requirements. If multifactor authentication, IA.L2-3.5.3, covers only remote and privileged users, the score loses 3 points, and it loses 5 if it covers no users. Evidence starts with the identification and authentication policy and the list of system accounts.

Table 8. Identification and Authentication (IA) requirements

Sources: NIST SP 800-171 Rev 2 (3); points, 32 CFR 170.24 (14); POA&M, 32 CFR 170.21 (8); Level 1 column, Level 1 guide (2); read October 2026.

Incident Response (IR)

Incident Response has three requirements. The examine lists center on the incident response policy and plan. Handling and reporting, IR.L2-3.6.1 and IR.L2-3.6.2, are worth 5 points each, and testing, IR.L2-3.6.3, is worth 1.

Table 9. Incident Response (IR) requirements

Sources: NIST SP 800-171 Rev 2 (3); points, 32 CFR 170.24 (14); POA&M, 32 CFR 170.21 (8); Level 1 column, Level 1 guide (2); read October 2026.

Maintenance (MA)

Maintenance holds six requirements. All six name maintenance records among the records an assessor will examine. MA.L2-3.7.2 on controlling maintenance and MA.L2-3.7.5 on multifactor authentication for nonlocal sessions carry 5 points.

Table 10. Maintenance (MA) requirements

Sources: NIST SP 800-171 Rev 2 (3); points, 32 CFR 170.24 (14); POA&M, 32 CFR 170.21 (8); Level 1 column, Level 1 guide (2); read October 2026.

Media Protection (MP)

Media Protection has nine requirements. The guide's examine lists start with the media protection policy and add records such as those of media sanitization. MP.L2-3.8.3 on sanitizing media and MP.L2-3.8.7 on removable media carry 5 points.

Table 11. Media Protection (MP) requirements

Sources: NIST SP 800-171 Rev 2 (3); points, 32 CFR 170.24 (14); POA&M, 32 CFR 170.21 (8); Level 1 column, Level 1 guide (2); read October 2026.

Personnel Security (PS)

Personnel Security holds two requirements. Screening, PS.L2-3.9.1, is worth 3 points and personnel actions, PS.L2-3.9.2, 5 points. An assessor examines records of screened personnel and of terminated credentials.

Table 12. Personnel Security (PS) requirements

Sources: NIST SP 800-171 Rev 2 (3); points, 32 CFR 170.24 (14); POA&M, 32 CFR 170.21 (8); Level 1 column, Level 1 guide (2); read October 2026.

Physical Protection (PE)

Physical Protection holds six requirements. The three requirements on visitors and physical access (PE.L2-3.10.3 through PE.L2-3.10.5) map to FAR paragraph (b)(1)(ix). Assessors examine physical access logs, the inventory of access devices, and the entry and exit points.

Table 13. Physical Protection (PE) requirements

Sources: NIST SP 800-171 Rev 2 (3); points, 32 CFR 170.24 (14); POA&M, 32 CFR 170.21 (8); Level 1 column, Level 1 guide (2); read October 2026.

Risk Assessment (RA)

Risk Assessment has three requirements. The assessor examines the risk assessment itself, the vulnerability scanning results, and the patch and vulnerability management records. Vulnerability scanning, RA.L2-3.11.2, carries 5 points, and the periodic risk assessment, RA.L2-3.11.1, carries 3.

Table 14. Risk Assessment (RA) requirements

Sources: NIST SP 800-171 Rev 2 (3); points, 32 CFR 170.24 (14); POA&M, 32 CFR 170.21 (8); Level 1 column, Level 1 guide (2); read October 2026.

Security Assessment (CA)

Security Assessment counts the system security plan, CA.L2-3.12.4, among its four requirements. The rule lists no point value for it; without an up-to-date plan an assessment "could not be completed".

Table 15. Security Assessment (CA) requirements

Sources: NIST SP 800-171 Rev 2 (3); points, 32 CFR 170.24 (14); POA&M, 32 CFR 170.21 (8); Level 1 column, Level 1 guide (2); read October 2026.

System and Communications Protection (SC)

System and Communications Protection holds 16 requirements. If CUI encryption (SC.L2-3.13.11) is used but not FIPS-validated, the score loses 3 points; it loses 5 if encryption is not used, and only the 3-point case can go on a POA&M. Assessors examine boundary protection procedures and the list of key internal boundaries.

Table 16. System and Communications Protection (SC) requirements

Sources: NIST SP 800-171 Rev 2 (3); points, 32 CFR 170.24 (14); POA&M, 32 CFR 170.21 (8); Level 1 column, Level 1 guide (2); read October 2026.

System and Information Integrity (SI)

Seven requirements make up System and Information Integrity. Each of them is worth 3 or 5 points. On the examine lists are malicious code protection mechanisms and the records of their updates.

Table 17. System and Information Integrity (SI) requirements

Sources: NIST SP 800-171 Rev 2 (3); points, 32 CFR 170.24 (14); POA&M, 32 CFR 170.21 (8); Level 1 column, Level 1 guide (2); read October 2026.

CMMC Level 3 Controls List

CMMC Level 3 adds 24 requirements selected from NIST SP 800-172, a set of enhanced requirements for protecting CUI, with parameters the Department of Defense assigned. Under 32 CFR 170.18, only DCMA DIBCAC assesses Level 3, and only after the contractor holds a Final Level 2 (C3PAO) status for the systems in the Level 3 assessment scope.

The wording in Table 18 is that of Table 1 to 32 CFR 170.14(c)(4), where italics mark the DoD-assigned parameters, such as an incident response team deployable "within 24 hours". The Department of War CIO's FAQ calls them requirements "in addition to the 110" of Level 2. Each of the 24 is worth 1 point under 32 CFR 170.24, and seven of them may not go on a POA&M. Table 1 above shows how they spread across the domains.

Table 18. The 24 CMMC Level 3 requirements

Sources: Table 1 to 32 CFR 170.14(c)(4) (1); POA&M, 32 CFR 170.21(a)(3) (8); read October 2026.

How Assessors Check Each CMMC Control

Assessors check each requirement with its CMMC control procedures, the assessment procedures of NIST SP 800-171A, which the rule names for Level 2 self-assessments and C3PAO assessments alike. Each procedure pairs "an assessment objective and a set of potential assessment methods and assessment objects", and NIST SP 800-171A defines the three methods:

• Examine: "reviewing, inspecting, observing, studying, or analyzing" objects such as policies, plans, mechanisms, and activities.
• Interview: "holding discussions with individuals or groups" who run the requirement.
• Test: "exercising assessment objects (i.e., activities, mechanisms) under specified conditions to compare actual with expected behavior".

One requirement shows the method end to end. AC.L2-3.1.1 asks you to "Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)". The Level 2 guide breaks it into objectives [a] through [f]. The first three ask whether authorized users, processes, and devices are identified; the last three ask whether system access is limited to each.

For evidence, the guide's examine list includes the access control policy and the list of active system accounts. Its interview list names people with account management responsibilities, and its test list names the processes for managing system accounts.

Figure 5 traces that requirement from its wording to the evidence an assessor asks for.

A requirement is MET only when every applicable objective is satisfied by evidence, and "All evidence must be in final form and not draft". Working papers, drafts, and unapproved policies do not count. NIST requirement 3.12.4 asks the system security plan to describe "how security requirements are implemented", and the Level 2 guide puts the plan on the examine list of almost every requirement. If you keep this CMMC controls list in your own tracker, one row per requirement with these fields keeps the evidence current:

• the requirement ID and the systems in scope;
• an owner and a backup owner;
• the procedure and where its evidence is stored;
• how often evidence is collected and reviewed;
• any open gap and what closes it.

At Level 2 the maximum score equals the number of requirements, and each requirement NOT MET subtracts its 1, 3, or 5 points. A Conditional status also needs a score of at least 0.8 of the maximum, and it expires unless its POA&M is closed out within 180 days. The Points and POA&M columns of the domain tables are those values; scoring as a whole is covered in the CMMC compliance guide.

Figure 6 follows a Level 2 score to the status it earns, Final only when every requirement is MET.

Exceptions have a rule of their own. An enduring exception, where full compliance is not feasible, is MET when the system security plan describes it with its mitigations. So is a temporary deficiency that arose after implementation and is addressed in an operational plan of action that shows deficiency reviews and progress toward the correction.

An adjudication by the DoD CIO, that a requirement is not applicable or that an alternative measure is equally effective, must be in the plan to be considered. A requirement adjudicated as equally effective is MET "if there have been no changes in the environment".

For what happens when the assessor arrives, read the CMMC assessment guide.

Common Challenges of CMMC Certification

• Fixing where CUI lives: scope, data flows, and providers come before the list. Under 32 CFR 170.4, a provider is an external service provider when CUI or security protection data "must be processed, stored, or transmitted on the ESP assets", and 32 CFR 170.19(c)(2)(ii) has its services and responsibilities documented in your SSP and its customer responsibility matrix. Figure 7, below this list, maps the asset categories of the scope. The CMMC compliance guide covers scoping.
• Documentation that matches the environment: write the plan and procedures from what is configured, not from what was intended. An assessor reads them against configuration settings, logs, and records, so the documents and the systems have to agree.
• Evidence over time: some requirements describe an activity rather than a setting. AU.L2-3.3.5 asks for correlated "audit record review, analysis, and reporting", IR.L2-3.6.3 asks you to "Test the organizational incident response capability", and CA.L2-3.12.3 asks for monitoring "on an ongoing basis". Audit logs kept but not reviewed give an assessor no evidence of the review that AU.L2-3.3.5 asks for.
• What cannot wait for a POA&M: at Level 2 a POA&M may hold only 1-point requirements and SC.L2-3.13.11 at 3 points. The rule bars six by name: AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, and PE.L2-3.10.3 through PE.L2-3.10.5. Level 1 allows none. Check the POA&M column before planning to defer anything.
• Small-team resources: the count is not the workload. All Level 2 requirements are assessed on every asset that handles CUI in the assessment scope, and security protection assets against those relevant to what they provide. A wide scope therefore multiplies the accounts, settings, and records each one touches, and a small IT team carries that beside its daily work. To budget a Level 2 program, read what CMMC certification costs.
• A cloud service used to handle CUI: DFARS 252.204-7012 requires you to ensure that a cloud provider holding covered defense information meets requirements "equivalent to" the FedRAMP Moderate baseline, and 32 CFR 170.19 applies that to a provider in your scope. Ask for that evidence before the data moves.

Common Mistakes When Using a CMMC Controls List

• Counting 17 at Level 1: the number of controls in CMMC Level 1 is 15 under 32 CFR 170.14(c)(2). A tracker built on the December 2021 guide carries 17 rows and IDs the current guide no longer uses; the count chapter above shows where the extra two came from.
• Using domains that are not in the model: the rule maps the CMMC domains to the 14 requirement families of NIST SP 800-171 Rev 2. A list with domains such as Asset Management (AM), Recovery (RE), or Situational Awareness (SA) is not built on those families; compare its headings with Table 1.
• Working from NIST SP 800-171 Rev 3: Rev 3, published in May 2024, organizes its requirements into 17 families. The rule names Rev 2 for Level 2, and the Department of War CIO's FAQ says assessments "will be conducted against Revision 2" until a separate class deviation to DFARS 252.204-7012, which keeps Revision 2, is withdrawn or superseded.
• Treating assessment objectives as controls: a requirement can have several objectives, [a] through [f] for AC.L2-3.1.1 alone. A tracker that gives each objective its own row no longer matches the 110 the rule scores, since a requirement is MET only when all its applicable objectives are satisfied.

Implement Your CMMC Controls with CyberCrest

CyberCrest is a CMMC Registered Practitioner Organization: we advise and prepare, and a formal Level 2 assessment is carried out by an accredited C3PAO. We work through the scope with you, run a gap assessment against the requirements of your level, and support your system security plan and POA&M. Talk to us about CMMC consulting for the list your contract names.

Sources

1. Department of Defense, 32 CFR 170.14, CMMC Model. https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/subpart-D/section-170.14
2. Department of Defense Chief Information Officer, CMMC Assessment Guide, Level 1, Version 2.13, September 2024. https://dowcio.war.gov/Portals/0/Documents/CMMC/AssessmentGuideL1v2.pdf
3. National Institute of Standards and Technology, SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, February 2020 (updated January 2021). https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final
4. Department of Defense, 32 CFR 170.15, CMMC Level 1 self-assessment and affirmation requirements. https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/subpart-D/section-170.15
5. Department of Defense, 32 CFR 170.16, CMMC Level 2 self-assessment and affirmation requirements. https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/subpart-D/section-170.16
6. Department of Defense, 32 CFR 170.17, CMMC Level 2 certification assessment and affirmation requirements. https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/subpart-D/section-170.17
7. Department of Defense, 32 CFR 170.18, CMMC Level 3 certification assessment and affirmation requirements. https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/subpart-D/section-170.18
8. Department of Defense, 32 CFR 170.21, Plan of Action and Milestones requirements. https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/subpart-D/section-170.21
9. Department of Defense, 32 CFR 170.22, Affirmation. https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/subpart-D/section-170.22
10. Department of Defense Chief Information Officer, CMMC Model Overview, Version 2.0, December 2021. https://dowcio.war.gov/Portals/0/Documents/CMMC/ModelOverview_V2.0_FINAL2_20211202_508.pdf
11. Department of Defense, Cybersecurity Maturity Model Certification (CMMC) 2.0 Updates and Way Forward, 86 FR 64100, 17 November 2021. https://www.federalregister.gov/documents/2021/11/17/2021-24880/cybersecurity-maturity-model-certification-cmmc-20-updates-and-way-forward
12. Federal Acquisition Regulation, FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems. https://www.ecfr.gov/current/title-48/chapter-1/subchapter-H/part-52/subpart-52.2/section-52.204-21
13. Department of Defense Chief Information Officer, CMMC Self-Assessment Guide, Level 1, Version 2.0, December 2021. https://dowcio.war.gov/Portals/0/Documents/CMMC/AG_Level1_V2.0_FinalDraft_20211210_508.pdf
14. Department of Defense, 32 CFR 170.24, CMMC Scoring Methodology. https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/subpart-D/section-170.24
15. National Institute of Standards and Technology, SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information, June 2018. https://csrc.nist.gov/pubs/sp/800/171/a/final
16. Department of Defense Chief Information Officer, CMMC Assessment Guide, Level 2, Version 2.13, September 2024. https://dowcio.war.gov/Portals/0/Documents/CMMC/AssessmentGuideL2v2.pdf
17. Department of Defense, 32 CFR 170.19, CMMC scoping. https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/subpart-D/section-170.19
18. Defense Federal Acquisition Regulation Supplement, DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. https://www.ecfr.gov/current/title-48/chapter-2/subchapter-H/part-252/subpart-252.2/section-252.204-7012
19. The White House, Executive Order, Restoring the United States Department of War, 5 September 2025. https://www.whitehouse.gov/presidential-actions/2025/09/restoring-the-united-states-department-of-war/
20. Information Security Oversight Office, National Archives and Records Administration, 32 CFR 2002.4, Definitions. https://www.ecfr.gov/current/title-32/subtitle-B/chapter-XX/part-2002/subpart-A/section-2002.4
21. Department of Defense, 32 CFR 170.23, Application to subcontractors. https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/subpart-D/section-170.23
22. National Institute of Standards and Technology, SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171, February 2021. https://csrc.nist.gov/pubs/sp/800/172/final
23. Department of War Chief Information Officer, Cybersecurity Maturity Model Certification Program (CMMC) Frequently Asked Questions, Revision 2.3 (Excerpt), July 2026. https://dowcio.war.gov/Portals/0/Documents/CMMC/FAQsv6.pdf
24. Department of Defense, 32 CFR 170.4, Acronyms and definitions. https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/subpart-A/section-170.4
25. National Institute of Standards and Technology, SP 800-171 Rev. 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, May 2024. https://csrc.nist.gov/pubs/sp/800/171/r3/final
26. Department of War Chief Information Officer, Cybersecurity Maturity Model Certification Procedures, Attachment 1 to the memorandum Implementing Suspension of CMMC Phase II, 13 July 2026. https://dowcio.war.gov/Portals/0/Documents/Library/ImplementingSuspensionCMMC-PhaseII.pdf
27. Department of War Chief Information Officer, Cybersecurity Maturity Model Certification (CMMC), read 21 October 2026. https://dowcio.war.gov/CMMC/
28. Department of War, Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements, 13 July 2026. https://www.war.gov/News/Releases/Release/Article/4542329/forging-the-arsenal-of-freedom-department-of-war-suspends-cmmc-phase-ii-require/
29. Defense Federal Acquisition Regulation Supplement, DFARS 252.204-7021, Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements. https://www.ecfr.gov/current/title-48/chapter-2/subchapter-H/part-252/subpart-252.2/section-252.204-7021
30. Department of War, Office of the Assistant Secretary of War for Acquisition and Sustainment, Class Deviation 2026-O0025, Revolutionary FAR Overhaul Part 40, DFARS Part 240, signed 18 December 2025, effective 1 February 2026 (DFARS 240.371-3, Award eligibility). https://www.acquisition.gov/sites/default/files/page_file_uploads/DoD_RFO_Deviation_Part-40.pdf