CMMC Risk Assessment Requirements: What's Required, How Often, and How to Prove It

By The Defense Compliance Report Editorial Team — an independent trade publication on CMMC 2.0 and DIB compliance · Last verified September 2026

CMMC (Cybersecurity Maturity Model Certification) Level 2 has three risk assessment requirements: assess risk from the systems that handle controlled unclassified information (CUI) at least once a year (3.11.1), scan for vulnerabilities on a schedule no longer than one year and when new ones affecting you are identified (3.11.2), and remediate findings according to risk (3.11.3). Level 1 has no risk assessment requirement. Level 3 adds seven (32 CFR 170.14; NIST SP 800-171 Rev. 2, §3.11).

Here's the catch with CMMC risk assessment requirements: the first two can't wait. A missing risk assessment costs 3 points and missing scanning costs 5, and neither can be deferred on a plan of action and milestones (POA&M) to obtain Conditional status, so either one alone blocks Level 2 status until it's fixed (32 CFR 170.24, 170.21). Below: the nine things an assessor checks, an evidence check, and a fill-in template with a worked example.

Status, checked September 23, 2026: On July 13, 2026, the Department of Defense (DoD, which now also uses the name Department of War on its official sites) suspended the move to CMMC Phase II. New procurement requirements may designate only Level 1 (Self) or Level 2 (Self), and Phase I self-assessment requirements remain in place. The Department's September 3, 2026 class deviation, Revision 3, memorandum paragraph (b) carries that direction forward and expressly retains the National Institute of Standards and Technology (NIST) SP 800-171 Rev. 2 baseline under the Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012. We found no replacement Phase II date or published Reform Task Force outcome in the official sources checked. The three requirements on this page did not pause. What the suspension changed →

This applies to you if a solicitation, contract, or prime's flow-down requires CMMC Level 2 or Level 3. The same three NIST requirements also apply to covered contractor information systems subject to DFARS 252.204-7012(b)(2) — the Defense Federal Acquisition Regulation Supplement clause covering systems that process, store, or transmit covered defense information — even without a CMMC assessment requirement. Systems operated on the Government's behalf follow the separate provisions in paragraph (b)(1); the clause's presence alone does not put every company system under (b)(2) (252.204-7012).

It doesn't apply if you handle only federal contract information (FCI) and your requirement is Level 1. Level 1's 15 safeguards include fixing flaws and running malware scans, but no risk assessment (32 CFR 170.14(c)(2), FAR 52.204-21). Start with our Level 1 self-assessment checklist instead.

One honest limit: no web page, this one included, can tell you your CMMC level. Your contract does. Open the PDF and search for "252.204-7012," "Safeguarding Covered Defense Information," and "CMMC," then check the incorporated deviations, amendments, and required level. A 7012 clause is a reason to check what information and systems it covers, not a Level 2 determination by itself. The one-year ceiling on this page is CMMC's definition of "periodically"; NIST Rev. 2 alone does not set that number (32 CFR 170.4; NIST §3.11). Not sure whether what you handle is CUI? Read FCI vs. CUI.

The CMMC risk assessment requirements at a glance

Level 2 has three risk assessment requirements, taken word for word from NIST SP 800-171 Revision 2 — the National Institute of Standards and Technology's standard for protecting CUI, whose 110 security requirements CMMC Level 2 adopts (32 CFR 170.14(c)(3)). If all three are NOT MET, their deductions total 9 points from the maximum Level 2 score of 110. Missing either of the first two blocks any Level 2 status until it's fixed.

Sources: NIST SP 800-171 Rev. 2, §3.11; NIST SP 800-171A; 32 CFR 170.4 and 170.14(d) (one-year ceiling on "periodically"); 170.21; 170.24. See everything we checked.

The right help for your risk assessment work isn't the same for every contractor. Whether you need an RPO (Registered Practitioner Organization) to check your records, an MSSP (Managed Security Service Provider) to run scanning and fixes, a GRC (governance, risk, and compliance) platform to keep your risk register current, or a properly separated CUI enclave to narrow the assessment scope depends on your required CMMC level, whether you handle FCI or CUI, your assessment type, your cloud and IT environment, and your contract timeline. The contract clause sets your level, not a checklist. Because a general answer can't resolve those for you, use The Defense Compliance Report's Find My CMMC Path tool to map your situation to the right kind of help before you request quotes — and do not submit CUI, drawings, or sensitive contract details.

Is a vulnerability scan the same as a risk assessment?

No. A scan finds known technical weaknesses in the systems it can reach. A risk assessment decides what those weaknesses — and other relevant threats to your CUI systems — mean for your business, and what to deal with first. DoD's own assessment guide says a vulnerability assessment "provides input to a risk assessment" (CMMC Assessment Guide, Level 2, RA.L2-3.11.1).

Think of the scan as a blood test and the risk assessment as the doctor's read of it. The blood test is useful. It just can't tell you that your engineer might email a drawing to the wrong customer, or that your IT provider holds the keys to everything.

The rule's own definition says the same thing: a risk assessment "incorporates threat and vulnerability analyses, and considers mitigations provided by security controls planned or in place" (32 CFR 170.4). NIST adds what it weighs: threats, vulnerabilities, likelihood, and impact — including risk from outside parties like your service providers — and it starts with a clearly defined system boundary (NIST SP 800-171 Rev. 2, 3.11.1 discussion).

DoD's guidance lists where risk comes from: poorly run business processes, people's honest mistakes, deliberate acts by insiders or outsiders, systems or technology that fail, and outside events like natural disasters, infrastructure outages, and supply chain failures (CMMC Assessment Guide, Level 2). A scanner sees only a slice of that list.

People use "risk assessment" for several different jobs. Only the first row below is requirement 3.11.1.

Want the neighbors? See gap assessment vs. C3PAO assessment, self-assessment vs. C3PAO, and your SPRS score. And penetration testing is a different thing again: no Level 2 requirement names it. Level 3 does (see below). Sources for the comparison: NIST §§3.11–3.12; 32 CFR 170.16; 170.24.

What does an assessor check for each requirement?

An assessor tests nine specific statements: two for the risk assessment, five for scanning, two for remediation. Each applicable objective needs supporting evidence, and if any applicable objective is not satisfied, that whole requirement is scored NOT MET (32 CFR 170.24(b)). The table shows what each statement means, evidence that can support it, and the evidence that looks fine but isn't.

These nine statements are called assessment objectives. They come from NIST SP 800-171A (June 2018), the assessment companion that CMMC uses (32 CFR 170.14(d), 170.16(c)(1)). The available assessment methods are examining your documents and records, interviewing the people who do the work, and testing whether the process actually runs. The assessment procedures select suitable methods and evidence for the objective.

One rule is easy to overlook. Evidence must be final, not draft. The rule names "working papers, drafts, and unofficial or unapproved policies" as unacceptable (32 CFR 170.24(b)(1)).

Sources: NIST SP 800-171A (June 2018), §3.11, printed pp. 49–50; NIST's 3.11.2 discussion on printers, scanners, and copiers (NIST SP 800-171 Rev. 2); DoD's 3.11.3 guidance to track the vulnerabilities you decide not to remediate (CMMC Assessment Guide, Level 2). The evidence examples are our synthesis, not an official required list.

For how assessment objectives work across all 110 requirements, see NIST 800-171A assessment objectives and CMMC assessment evidence.

Where do you stand? An evidence check

Mark each of the nine statements Have it, Missing, or Not sure. "Not sure" means the evidence needs review; it does not establish MET or NOT MET. The check organizes what to gather and shows each requirement's published deduction and POA&M rule—not a predicted assessment result. If your level, scope, or an objective's applicability is unresolved, use Not sure and resolve that first.

How to read it: Say your IT lead marks everything "Have it" except line 2, because the last risk assessment is dated 14 months ago. That is a reported gap worth checking—14 months is past the one-year ceiling (32 CFR 170.4). The check shows the rule: a NOT MET finding on 3.11.1 deducts 3 points and cannot be deferred to obtain Conditional Level 2 status. The fix isn't necessarily a new tool. It's doing and documenting the missing risk review, resolving the lapse, and keeping the next review on schedule—not changing the date on an old report.

Can a missing risk assessment wait on a POA&M?

No—not to obtain Conditional Level 2 status. The risk assessment is worth 3 points and scanning is worth 5, and CMMC limits conditional POA&Ms to eligible 1-point requirements plus one specific encryption exception. Remediation, worth 1 point, can be eligible if your overall score is at least 88 of 110 and all other conditions are met, with successful closeout within 180 days of the Conditional CMMC Status Date. That is a status-closeout window, not permission to leave every vulnerability open for 180 days.

Sources: 32 CFR 170.24(c)(2) (points); 32 CFR 170.21(a)(2) and (b) (POA&M conditions and 180-day closeout).

Here's the math that surprises people. Say everything else is in place and only the risk assessment is missing. Your score is 107 of 110 — far above 88. You still can't reach Conditional or Final Level 2 (Self) status. Conditional status needs a POA&M that meets the rule's conditions, and this 3-point risk assessment requirement cannot be deferred; Final status needs every requirement met (32 CFR 170.16(a)(1)).

You still write a POA&M entry for every requirement that isn't met. It just doesn't earn you Conditional status for the 3-point risk assessment or 5-point scanning requirement (32 CFR 170.24(c)(2)(i)(B)(6)).

Open vulnerabilities don't automatically sink 3.11.3. The rule separates a POA&M from an "operational plan of action" — your running list of temporary vulnerabilities and deficiencies, like patches still being rolled out, and how you'll handle them (32 CFR 170.4). A deficiency that meets the rule's definition of a temporary deficiency and is properly addressed there, with reviews and progress, is scored MET (32 CFR 170.24(b)(1)(ii)). DoD's guidance also expects you to track the vulnerabilities you decide not to fix (CMMC Assessment Guide, Level 2, RA.L2-3.11.3).

But risk acceptance isn't a waiver. Your risk assessment can explain why one finding waits and another gets fixed tonight. It can't make a required safeguard optional. And a plan to start doing something doesn't automatically count. A temporary deficiency ordinarily arises after the requirement was already working; the definition also allows a limited case where initial implementation has been rolled out and a subset of equipment temporarily remains in process (32 CFR 170.4).

At Level 1, POA&Ms aren't allowed at all (32 CFR 170.21(a)(1)). For the full mechanics, see CMMC POA&M template and Conditional Level 2 and the 180-day closeout.

If the evidence check turned up Missing or Not sure on 3.11.1 or 3.11.2, review the evidence and close any confirmed implementation gap before expecting Conditional or Final Level 2 status. Whether your own team, a managed security provider, or a readiness provider should close it depends on your level, where your CUI lives, and your timeline.

Risk assessment template: the minimum defensible record

A risk assessment that holds up connects a header showing your scope and schedule, a register tying each risk to your CUI systems, a log of your scans, and an index pointing to the evidence. The fields below turn the requirements and guidance into a usable record; some are editorial tracking aids, not separately mandated fields. The right-hand column distinguishes the two. This is our worksheet, not an official NIST or DoD form — if you already use a documented method, keep it.

Where to keep it: in your own protected environment, not a shared drive anyone can open. A record describing the vulnerability status of in-scope systems can count as Security Protection Data under 32 CFR 170.4. If an outside service handles that data but no CUI, the relevant services are assessed as Security Protection Assets. If it also handles CUI, use the separate cloud or non-cloud provider rules below (32 CFR 170.19(c)(2)).

Sources for Parts 1–4: NIST SP 800-171 Rev. 2, §3.11; NIST SP 800-171A, printed pp. 49–50; DoD Level 2 Assessment Guide, printed pp. 192–199; the rule sections identified in the tables. IDs, owners, due-date fields, and the layout are our tracking aids, not a mandated form.

Part 1: Scope and schedule

Part 2: Risk register (one row per risk)

Keep the reasoning with the ratings. Record assumptions, uncertainty, and where the supporting facts came from; do not label an unknown likelihood or impact "Low." Planned safeguards belong under the decision, and an expected residual rating is not a verified result (NIST SP 800-30 Rev. 1, task 1-5).

Part 3: Scan and new-vulnerability log

Part 4: Evidence index

Use three labels for your own tracking — Located, Not located, Needs review. They're work notes, not assessment findings.

Worked example: a hypothetical 40-person machine shop

Say you run a 40-person machine shop. Everything about it is made up. You receive CUI drawings from a prime, keep them in a cloud service offering that meets the applicable FedRAMP requirements, and send programs to CNC (computer numerical control) machines on the shop floor. FedRAMP is the Federal Risk and Authorization Management Program; its cloud requirements are explained below. An outside MSP runs your IT. Your policy says you assess risk every 12 months and scan monthly, plus whenever a relevant new vulnerability is identified. Monthly scanning is this shop's choice; the one-year CMMC ceiling and relevant new-vulnerability trigger are requirements.

Here's a small, honest register. All ratings are illustrative; yours come from your own facts. This is an abbreviated example: the reasons behind the ratings, evidence references, and action owners still belong in the full worksheet. The 60-day and 7-day targets below are fictional company choices, not CMMC deadlines.

Notice R-05. A scan listing software vulnerabilities would not assess that whole risk. That's why a scan report can't stand in for the risk assessment. In R-06, the Low impact assumes the protected data remains unreadable and operations can resume from a checked copy; a powered-on device or exposed keys would change the judgment. FIPS means Federal Information Processing Standards.

Now follow one finding from start to finish. This trail is what 3.11.2[d] and 3.11.3[b] look like on paper.

The gap this example leaves open on purpose: a networked printer expected in the separate scheduled scan SC-30 didn't show up in its successful coverage. That printer's status is unknown, not clean. It gets an owner and a date on the Part 3 log until someone confirms coverage or documents why it's out of scope.

What this proves, and what it doesn't: one clean trail shows an assessor how your process works. It doesn't prove all nine objectives, and it doesn't show that every risk was assessed. The dated register, the scan log, and the evidence index help show those things together; their contents still have to satisfy the applicable objectives.

How often do you have to assess risk and scan?

At least once every 12 months for the risk assessment and for scheduled scans. You pick the interval and write it down, but CMMC caps "periodically" at one year (32 CFR 170.4, 170.14(d)). Scanning also has a second trigger — a relevant new vulnerability — and neither clock is the same as the three-year CMMC self-assessment.

Sources: 32 CFR 170.4 and 170.14(d) (periodic intervals); 170.22 (affirmations); 32 CFR 170.16(a)(1), (a)(2), (c)(4); 170.21(b).

Our recommendation, not a rule: also rerun the risk assessment when you add a system that handles CUI, change IT or cloud providers, or have a cyber incident. Big changes are exactly when last year's answers go stale. For patch timing, see CMMC patch management requirements; for scan cadence and tooling, see vulnerability scanning for CMMC.

What has to be in scope?

Assess the systems CMMC puts in scope, not your whole company by default. CMMC sorts assets into categories, and each category gets different treatment. That category decides what your risk assessment and scans must cover (32 CFR 170.19(c)(1)).

For the full boundary exercise, see our CMMC scoping guide and SSP template.

Does a CUI enclave shrink the risk assessment?

It can. A CUI enclave works like a locked room inside the building where all the CUI work happens; if it's truly separated, your risk assessment and scans center on what's inside the room and whatever protects it.

Two cautions. The assessment still has to consider how CUI could walk out of the room — printing, email, a USB stick. And the enclave provider becomes an outside party in your register. More on the trade-offs: CMMC secure enclave.

What about shop-floor machines you can't scan or patch?

Put them in the risk assessment; don't pretend they aren't there. At Level 2, CNC controllers, test gear, and other operational technology that meet the Specialized Asset definition receive that category's treatment: you document them and manage them with risk-based policies, and the assessor reviews your SSP rather than testing them against the other requirements (32 CFR 170.19(c)(1)).

That label has to fit the facts. It isn't a blanket pass for anything hard to secure. And check with the equipment maker before running active scans against production machines. Row R-02 in the worked example shows one way to record it.

Does your MSP's or cloud provider's work count?

It can, if it's really an assessment of your environment and you can provide final evidence that meets the objectives. Your company remains responsible for that evidence. NIST specifically lists service providers among the outside parties whose risk you have to weigh (NIST SP 800-171 Rev. 2, 3.11.1 discussion).

The rule also pulls relevant provider services into scope. A non-cloud provider that handles CUI has the services used to meet your requirements assessed within your scope. A cloud service offering handling CUI instead must be FedRAMP Authorized at Moderate or higher, or meet the applicable DoD requirements for equivalency; DFARS 252.204-7012(b)(2)(ii)(D) also requires compliance with paragraphs (c)–(g) for incident reporting, malicious software, preservation, and forensic access. An outside service handling only Security Protection Data is assessed as a Security Protection Asset. Document the relationship and services in your SSP, the provider's service description, and its customer responsibility matrix (32 CFR 170.16(c)(2)–(3); 170.19(c)(2); DFARS 252.204-7012). See CMMC requirements for MSPs.

What if you don't know what's in scope yet?

Unknown doesn't mean out of scope. Write it down, give it an owner, and keep it visible until it's resolved.

Start with three checks. Read the contract or the prime's flow-down for the required level. Trace whether the asset handles CUI or protects something that does. Ask the information owner or the prime whether the data is CUI. Then update Part 1 of the worksheet.

What you'll read elsewhere vs. what the rule says

Advice and requirements aren't the same thing. Here's each claim next to what the rule actually says.

More on the revision question: NIST 800-171 Rev. 2 vs. Rev. 3. More on pen testing: CMMC penetration testing requirements.

What changes at Level 3?

Level 3 keeps all three Level 2 requirements and adds seven, taken from NIST SP 800-172 with DoD-set parameters. You can only start a Level 3 assessment after a maximum Level 2 (C3PAO) score for the Level 3 assessment scope. The current suspension concerns Level 3 procurement designations, not repeal of these codified safeguards (32 CFR 170.24(c)(3); implementing procedures).

Sources: 32 CFR 170.14(c)(4) (requirements and DoD parameters); 170.21(a)(3) (Level 3 POA&M exclusions). Each Level 3 requirement is worth 1 point, and Conditional Level 3 needs a score of at least 80% with none of the excluded items on the POA&M, followed by successful closeout within 180 days of its Conditional CMMC Status Date. The full picture: CMMC Level 3 requirements.

Who can do your risk assessment for you?

Your IT lead, an MSP, an RPO, or a consultant can help — but it has to describe your operations, and your company owns it. No rule requires a third party to write it. The question is whether you have the time and know-how to keep it current.

The table is our editorial guide to dividing the work, not a rule prescribing who you must hire. Verify the actual scope of service and evidence access before signing; the requirement is satisfied by the work, not the provider's label (NIST §3.11; DoD Level 2 Guide).

A C3PAO (CMMC Third-Party Assessment Organization) performs formal Level 2 certification assessments. That role is separate from writing your risk assessment, and new Level 2 (C3PAO) procurement designations are suspended under the current direction. A firm's other services do not remove its conflict-of-interest obligations: 32 CFR 170.8(b)(17)(ii)(G) requires the policy to prohibit CMMC ecosystem members from participating in an organization's Level 2 certification assessment when they served as a consultant to prepare it for any CMMC assessment within the preceding three years. The Cyber AB's CMMC Assessment Process v2.0, P.12–P.15 also makes the C3PAO responsible for impartiality and conflict management. Keep the firm that prepared you separate from the firm that assesses you, and check the applicable conflict rules before you sign. More: CMMC provider categories and RPO vs. C3PAO.

If you're still weighing in-house work against outside help, map it before you call anyone.

What we verified

Checked September 23, 2026: We read the relevant provisions of 32 CFR 170.4, 170.8, 170.9, 170.14, 170.16, 170.19, 170.21, 170.22, and 170.24 on eCFR (shown as current through September 21, 2026), and the published final rule, for the definitions, requirements, deductions, POA&M conditions, assessment and affirmation cycles, evidence retention, scoping, conflicts, and Level 3 parameters. We read DFARS 252.204-7012 and FAR 52.204-21 on Acquisition.gov. We checked the Department's CMMC page, its July 13 implementing procedures, the current deviation index, and the signed four-page Revision 3 memorandum dated September 3. We read the original NIST SP 800-171 Rev. 2 requirement text and discussion, all nine Risk Assessment objectives in NIST SP 800-171A (June 2018), and DoD's Level 2 Assessment Guide v2.13—not just reproductions. We also checked the relevant NIST SP 800-30 Rev. 1, SP 800-171 Rev. 3, and SP 800-172 passages, the Cyber AB's assessment-process conflict section, and the separate SPRS CMMC and NIST assessment pages.

What we couldn't verify: a published outcome of the Department's CMMC review or a replacement Phase II date in the official sources checked. We therefore do not claim either has occurred or treat a review deadline as a restart date. This page gives no market cost figures; it does not establish what a standalone risk assessment will cost your company. The template and evidence examples are our synthesis — useful, but not an official form or an assessment result. See our methodology and corrections policy.

Frequently asked questions

Does our risk assessment have to follow a specific method or template?

No. NIST points to SP 800-30 as guidance, and DoD asks for established criteria and procedures, but these requirements do not mandate one particular method or form. Use a consistent approach, document the results, and repeat it at the interval you set. A purchased template is a starting structure, not proof that the assessment happened. Sources: NIST §3.11.1; DoD Level 2 Guide.

Is the risk assessment the same as our SPRS score?

No. A CMMC Level 2 assessment score comes from assessing all 110 requirements. The risk assessment is one of them, worth 3 points under 32 CFR 170.24. Because it cannot be deferred to obtain Conditional status, a missing one also blocks Conditional and Final Level 2 status until it's fixed. SPRS also stores NIST SP 800-171 Basic Assessment results in a separate module; posting that record alone does not establish CMMC Level 2 status or its affirmation (SPRS NIST assessments; SPRS CMMC; 32 CFR 170.16).

Does it have to cover fire, floods, or power outages?

Consider them where they could affect the systems that handle CUI. DoD's guidance lists outside events — natural disasters, public infrastructure failures, and supply chain failures — alongside people and technology failures as sources of risk. Document the relevant scenario, likelihood, consequences, safeguards, and decision; the detail depends on the actual risk (DoD Level 2 Guide, RA.L2-3.11.1).

Does the risk assessment need a signature?

The rule doesn't say "signature," but it does say evidence must be final and that unofficial or unapproved policies are unacceptable (32 CFR 170.24(b)(1)). A dated approval or controlled final-version record is a practical way to show the assessment's status; use your organization's document-control procedure.

How long should we keep old risk assessments?

For a Level 2 self-assessment, the artifacts used as evidence must be kept for six years from your CMMC Status Date (32 CFR 170.16(c)(4)). Keep the dated versions and supporting records used as evidence, not just the latest, so you can show you met your own interval.

Still not sure which CMMC path fits your company? Use The Defense Compliance Report's Find My CMMC Path tool to see which path and kind of help fit your contract, CUI, environment, and timeline — before you hire anyone.

Sources

All checked September 23, 2026.

• 32 CFR Part 170, CMMC Program (eCFR, current through September 21, 2026): §170.4 Definitions · §170.14 CMMC Model · §170.16 Level 2 self-assessment · §170.19 Scoping · §170.21 POA&M · §170.24 Scoring · §170.8 Accreditation Body and conflicts · §170.9 C3PAOs · §170.22 Affirmation
• Published CMMC Program final rule, October 15, 2024
• NIST SP 800-171 Rev. 2, §3.11 requirements and discussion
• NIST SP 800-171A (June 2018), §3.11 assessment objectives
• NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments
• NIST SP 800-171 Rev. 3 (not the CMMC basis)
• DoD CMMC Assessment Guide – Level 2, Version 2.13, RA.L2-3.11.1 to 3.11.3
• DFARS 252.204-7012, paragraph (b)(2)
• FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems
• Department of War CIO, CMMC program page
• Implementing Suspension of CMMC Phase II (26-P-1023, Attachment 1)
• DARS current overhaul-deviation index; Class Deviation 2026-O0025, Revision 3, September 3, 2026—signed memorandum, especially paragraph (b)
• NIST SP 800-172 (February 2021), §3.11, read with the DoD parameters in §170.14(c)(4)
• Cyber AB CMMC Assessment Process v2.0 (December 2024), P.12–P.15; Cyber AB Consulting and Implementation
• SPRS CMMC and NIST SP 800-171 assessments
• DoW CIO resources and documentation, including the linked Level 2 Assessment Guide

---

About The Defense Compliance Report. The Defense Compliance Report is the independent trade publication and decision resource for CMMC and Defense Industrial Base compliance — explaining the CMMC Final Rule with primary-source citation on every claim and mapping a contractor's level, CUI scope, assessment type, and timeline to the right provider category, so DIB contractors choose the right CMMC path before they spend six figures. We're not affiliated with the Cyber AB, the Department of Defense, DCMA DIBCAC (the Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center), NIST, or any U.S. government agency. This page is educational research, not legal, contractual, or compliance advice — confirm scope and applicability with a CMMC Registered Practitioner (RP) or a qualified federal-contracts attorney. See our Editorial & Advertising Policy.