NIST 800-171 vs NIST 800-53: Which Applies to Your System?

By The Defense Compliance Report Editorial Team — an independent trade publication on CMMC 2.0 and DIB compliance · Last verified September 2026

NIST 800-171 vs NIST 800-53 comes down to the system's role and governing requirement. 800-171 protects Controlled Unclassified Information (CUI) in nonfederal systems; Cybersecurity Maturity Model Certification (CMMC) Level 2 uses its Rev. 2, with 110 requirements. 800-53 is a broader security and privacy control catalog. Your contract and system role determine which applies—not who owns the hardware. (NIST scope, CMMC Level 2, 800-53)

Both are Special Publications (SP) from the National Institute of Standards and Technology (NIST). One company can owe both, on different systems. The map below shows which is which, and the worked example shows how to document the decision.

Status, checked September 23, 2026: The Department of Defense (DoD), which now also uses the name Department of War, suspended CMMC's Phase II transition on July 13, 2026. Its CMMC program page says all Phase I self-assessment requirements remain in place. Class Deviation 2026-O0025, Revision 3, September 3, 2026 retains NIST SP 800-171 Rev. 2 in Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012 and limits current CMMC procurement designations to Level 1 (Self) or Level 2 (Self). The official implementation sources checked for this page do not supply a replacement Phase II date. What the suspension changed

Three quick checks before you read further:

1. Does your contract include DFARS 252.204-7012? If yes, its safeguarding requirement applies to covered contractor systems handling covered defense information—the clause-defined information to protect. For those systems not operated on behalf of an agency, the current deviation specifies 800-171 Rev. 2. (Clause (a), (b)(2))
2. Does any external cloud service store, process, or send that information? If yes, you must require and ensure the specific service meets the clause’s FedRAMP Moderate-equivalent security and incident-response obligations. FedRAMP—the Federal Risk and Authorization Management Program—uses 800-53-based controls. You still own your side. (Clause (b)(2)(ii)(D))
3. Do you run a system that does the government's own information processing for it? If yes, that system follows the agency's specified requirements, including its applicable 800-53-based controls. Analyze your other systems separately, including any shared services. (32 CFR 2002.14(h); clause (b)(1))

If you only handle Federal Contract Information (FCI), have no CUI in that environment, and have no other requirement for either publication, neither standard automatically applies in full. The basic safeguarding set is the 15 requirements in Federal Acquisition Regulation (FAR) clause 52.204-21; CMMC Level 1 applies when required by the governing instrument. An unknown answer above is not a “no.” See FCI vs. CUI. (FAR 52.204-21; 32 CFR 170.14(c)(2))

NIST 800-171 vs 800-53 at a glance

800-53 is a catalog that federal agencies choose from. 800-171 is a fixed requirement set that contractors holding CUI are measured against when their governing agreement requires it. An agency picks a baseline—a starting set of controls—from 800-53B and tailors it to the system; a contractor implements the applicable 800-171 requirements across its defined assessment boundary. That does not mean installing every safeguard on every device. (800-53B; 800-171 Rev. 2, §1.1)

The catalog and baseline counts come from NIST's own machine-readable files; how we counted is explained in the family-by-family section below. These are editorial counts from the NIST catalogs and baseline profiles, checked September 23, 2026—not workload or cost estimates.

Knowing which standard governs each system is half the decision. If that requirement points to CMMC, the next step depends on your situation. The other half is what kind of help closes the gap, and that isn't the same for every contractor. It depends on your required CMMC level, whether you handle FCI or CUI, your assessment type, where your CUI lives (your own network, an appropriately authorized or equivalent cloud service, or a CUI enclave—a separated environment for the CUI work in scope), and your contract timeline. The contract clause sets your level, not a checklist. Because a general comparison can't settle those for you, use The Defense Compliance Report's Find My CMMC Path tool to explore which path and kind of help fit your situation — a Registered Practitioner Organization (RPO) for readiness work, a Managed Security Service Provider (MSSP), a governance, risk, and compliance (GRC) platform, or a CUI enclave — before you request quotes. Do not submit CUI, drawings, or sensitive contract details.

Which one applies to your system?

It depends on who the system serves and what your contract says, one system at a time. A defense contractor can owe 800-171 in its own nonfederal CUI environment and have separate cloud-provider obligations. 800-53-based requirements can apply directly when you operate a system on the government's behalf—or when another written requirement calls for them. (32 CFR 2002.14(h); DFARS 7012(b))

No web page, including this one, can tell you which standard your contract requires. Your contract does. Here is where to look: search your contract and any subcontract flow-down for 252.204-7012, for 52.204-21, and for any line that names 800-53 or says a system is "operated on behalf of the Government." If you can't find 252.204-7012, search for its title, "Safeguarding Covered Defense Information and Cyber Incident Reporting" — some newer DoD contracts use updated clause text, which our clause-search guide walks through. Read incorporated attachments and written amendments or modifications too. The September 3 deviation retains clause 252.204-7012 with revised text and includes the separate government-assessment clause 252.240-7997. A number alone does not identify the version in your contract. (Revision 3, memorandum and Attachment 1)

C3PAO means CMMC Third-Party Assessment Organization; DCMA DIBCAC is the Defense Contract Management Agency’s Defense Industrial Base Cybersecurity Assessment Center. For Level 2, Final status requires all 110 requirements to be MET under the rule’s assessment method; a documented NOT APPLICABLE determination is assessed as MET, not an unexamined blank. Conditional status is limited by the plan of action and milestones (POA&M) rules and a 180-day closeout window—it is not permission to omit requirements from the comparison. (§170.16, §170.21, §170.24)

Your own system vs. a system you run for the government

The line is set in the federal CUI rule, not by who owns the hardware. A system is a federal information system when a contractor operates it on an agency's behalf — meaning it processes, stores, or sends federal information as the service itself, not incidentally to delivering a product or service (32 CFR 2002.4(hh)).

Think of it this way. A machine shop that receives CUI drawings so it can make parts is using its own system; the drawings are incidental to the parts. For nonfederal systems within its scope, the CUI rule directs agencies to use 800-171 rather than treating the system as agency-operated (32 CFR 2002.14(h)(2)). A company hired to host and run a records system that agency staff log into is doing the agency's processing for it. That system is treated as agency-operated and follows the agency’s applicable security and authorization requirements, including its selected 800-53-based controls.

Say your company does both. Your contract has you host a scheduling portal that Army staff use, and your engineers also keep CUI drawings on the company network. That's two answers, not one: the portal's requirements come from the contract (NIST says 800-53 applies to systems run on an agency's behalf), and your company network still follows 800-171 under DFARS 7012(b)(2). A shared security tool can support both. It doesn't make the two records interchangeable. The shared services and connections still need to be evaluated in the relevant boundaries. (NIST Rev. 2, §1.1; CMMC scoping)

Your cloud provider: where 800-53 reaches your supply chain

If an external cloud service stores, processes, or sends covered defense information, DFARS 252.204-7012 says you must require and ensure the provider meets security equivalent to the FedRAMP Moderate baseline. FedRAMP's baselines are built from NIST SP 800-53; FedRAMP updated them to 800-53 Rev. 5 in May 2023 (FedRAMP). This is one way 800-53 reaches a subcontractor: through the provider’s applicable cloud baseline, not a requirement to implement the entire catalog. Clause 7012 also requires and obliges you to ensure the provider complies with paragraphs (c)–(g), covering incident reporting, malicious-software submission, preservation, forensic access, and damage-assessment cooperation. (Current clause (b)(2)(ii)(D))

The provider’s authorization covers the specific offering and its authorized boundary, not your whole company. Your tenant settings, user accounts, laptops, and the network that connects to the cloud remain in your assessment scope when they support the CUI environment, and the provider's customer responsibility matrix must be documented or referenced in your system security plan (32 CFR 170.16(c)(2)(iii)). A provider that locks its data center doesn't prove you turned on multifactor login. For the authorization-vs.-equivalency details, see CMMC vs. FedRAMP.

When the request just says "NIST compliant"

"NIST compliant" isn't enough to scope a project or answer a customer. Before you answer a questionnaire or sign a proposal, ask for the publication, the revision, the system, and the evidence they expect. Copy this, send it through your normal contracting channel, and leave CUI out of it:

Please identify the system and the written security requirement you are asking us to meet. If it is based on NIST SP 800-53, please specify the revision, the baseline or selected control set, any required parameters, and the assessment or authorization evidence you expect. If it is NIST SP 800-171 or CMMC, please identify the required revision and any CMMC level and assessment type. Please also confirm whether this system is operated on behalf of the agency or is our own system.

Write the answer down: the baseline decision record

Once you have answers, record them. One record per system boundary. This is our own worksheet, not an official NIST or CMMC form, and it isn't an assessment result — it's the paper trail that lets an owner, a prime, or an assessor see why you built to what you built to. Fill it in your own approved workspace, not on a website.

A filled-in example (hypothetical). Say you run a 30-person machine shop. Your prime's subcontract includes DFARS 252.204-7012, requires 800-171 Rev. 2, and calls for CMMC Level 2 (Self). You keep CUI drawings on your own file server and in a cloud offering that, for this fictional example, has a current FedRAMP Moderate authorization. A consultant has pitched a full 800-53 program. Your record reads: System—engineering file server, computer-aided design (CAD) workstations, cloud tenant. Role—our own nonfederal system. Information—CUI, confirmed by the prime's contracts manager. Standard—800-171 Rev. 2. Level—2 (Self). If 800-53 applies—nothing in this fictional contract requires our own system to meet a separate 800-53 baseline. Cloud—specific authorized offering checked; customer responsibility matrix and clause 7012(c)–(g) obligations documented. Existing evidence—a multifactor login configuration, not yet accepted as evidence for requirement 3.5.3. Open question—does it also cover local privileged access? Decision—build to 800-171 Rev. 2, evaluate the evidence, and keep the unresolved check visible; the 800-53 pitch is optional extra work, not a requirement of this fictional contract. You haven't ruled out doing more than the minimum. You've just stopped paying for it by mistake.

The headcount and circumstances are illustrative. The cloud conditions come from clause 7012(b)(2)(ii)(D) and §170.16(c)(2); the authentication check comes from 800-171A, 3.5.3. The worksheet does not establish the shop’s assessment result.

Once each system has a standard next to it, the question left is what kind of help gets you there — scoping, a managed service provider (MSP) or MSSP to run the controls, a CUI enclave, or cloud work — and that depends on where your CUI lives and what your contract calls for.

If your only obligation turns out to be a system you run for an agency, your next step is that agency's security office and your contracting officer, not a CMMC tool.

Is NIST 800-171 a subset of 800-53?

Yes, in origin. NIST built Rev. 2 from FIPS 200’s basic requirements and the 800-53 Rev. 4 Moderate baseline, tailoring the derived requirements for CUI in nonfederal systems. FIPS means Federal Information Processing Standards. It's smaller because it's narrower, not because it's weaker: NIST says the tailoring isn't meant to reduce the protection CUI gets (SP 800-171 Rev. 2, §1.1).

Here's the size comparison, counted from NIST's own files and publications. The editions are labeled because these rows are not successive cuts from one current baseline:

The 1,196-entry catalog count includes the withdrawn entries; 1,014 excludes them. Neither catalog total is an automatic implementation checklist. The selected baseline, tailoring, and other applicable requirements define the actual set. (NIST catalog and profiles; 800-53B)

NIST gives three reasons for cutting controls (SP 800-171 Rev. 2, §2.2):

• It's uniquely federal. The Moderate baseline expects federal systems to accept government Personal Identity Verification (PIV) smart cards (800-53 IA-2(12)). 800-171 says its multifactor login requirement does not mean you need PIV or Common Access Card (CAC)-style cards. These are the standard’s tailoring decisions, not permission to disregard a separate contractual smart-card requirement. (Rev. 2, note 24; Rev. 3 Appendix C, IA-02(12))
• It is not directly about CUI confidentiality. This is an 800-171 tailoring criterion, not a statement that the entire federal CUI rule ignores integrity and availability. Rev. 2 omits a standalone Contingency Planning family while retaining backup confidentiality under Media Protection. (Rev. 2, §2.2, note 18; 32 CFR 2002.14)
• Organizations were expected to do it anyway. Rev. 2 treated some controls, including policy-and-procedure controls, as expected organizational practices. Rev. 3 eliminated that “NFO” tailoring category and explicitly added some requirements previously covered by the assumption; other controls were reassigned to other tailoring categories. NFO meant “expected to be routinely satisfied by nonfederal organizations without specification.” (NIST Rev. 3 FAQ)

An everyday way to picture it: 800-53 is a building-code library. A baseline is the starting selection for a defined impact level, not the whole library or a measure of building size. 800-171 selects and adapts requirements for protecting the government's CUI in a nonfederal environment. Leaving a general contingency-planning requirement out of that selection does not mean the backup generator is useless—and it does not erase the incident-recovery and backup-confidentiality requirements that are included.

The family-by-family map

800-53 has 20 control families; 800-171 Rev. 2 has 14 requirement families and Rev. 3 has 17. Neither 800-171 edition has a standalone Contingency Planning, Program Management, or Personally Identifiable Information (PII) Processing and Transparency family. That does not mean every related safeguard is absent: backup confidentiality appears under Media Protection. The table separates catalog size, the untailored Moderate baseline, and requirement counts. (Rev. 2, §2.2; Rev. 3, §3 and Appendix C)

How to read it. Read across a row. The first number counts active controls and enhancements in that family. The second is the untailored Moderate baseline. The next two count 800-171 requirements: Rev. 2 for CMMC today, Rev. 3 for NIST's newest version. The last column counts entries that NIST’s published Rev. 3 Appendix C marks “CUI,” meaning directly related to protecting CUI confidentiality. A dash means no standalone family or selected entries in that column—not an unknown input or permission to skip related requirements.

Requirements and controls aren't one-for-one. Media Protection has 9 Rev. 2 requirements but 7 controls in the Rev. 5 Moderate baseline; those are different units and editions, not a compliance percentage. A requirement can relate to several source controls, and one control can support more than one requirement. A control not retained separately is not necessarily unaddressed: another control may cover its outcome. NIST’s Rev. 3 Appendix C records the tailoring reasons.

Rev. 2's families have slightly different names (“Physical Protection,” “Security Assessment”). Its development discussion identifies Contingency Planning, System and Services Acquisition, and Planning as omitted standalone families, while retaining three requirements: backup confidentiality (from CP-9), the system security plan (from PL-2), and security engineering principles (from SA-8), placed in Media Protection, Security Assessment, and System and Communications Protection. Rev. 3 adds Planning, System and Services Acquisition, and Supply Chain Risk Management as standalone families. (Rev. 2, §2.2, note 18; Rev. 3 FAQ)

What 800-171 leaves out, and why you might still want it

800-171 Rev. 2 does not prescribe the full contingency-planning program represented by 800-53’s disaster-recovery plans, restoration tests, and alternate sites. It does retain backup confidentiality in requirement 3.8.9, and requirement 3.6.1 includes recovery in incident handling. Meeting 800-171 alone doesn't mean you can recover from ransomware. (Rev. 2, 3.6.1, 3.8.9 and Appendix E)

NIST says this plainly. It calls 800-171 a subset of what a full security program needs and strongly advises organizations to review the whole Moderate baseline so their plans provide necessary and sufficient protection (SP 800-171 Rev. 2, cautionary note and note 17). That's worth reading as permission, not pressure: you can borrow the parts of 800-53 that protect your business without claiming compliance with an entire 800-53 baseline. Whether a system or security service belongs in CMMC scope still follows its actual role, not whether you call its controls voluntary. (32 CFR 170.19)

What we counted and how. On September 23, 2026, we recalculated the catalog, baseline, and Rev. 3 requirement counts using NIST’s official machine-readable files (usnistgov/oscal-content): the SP 800-53 Release 5.2.0 catalog, the SP 800-53B Release 5.2.0 profiles, and the SP 800-171 Rev. 3 catalog. “Active” excludes entries NIST marks withdrawn; a base control and each enhancement count separately. For the last column, we counted the distinct entries marked CUI in the published Rev. 3 Appendix C, grouped by their 800-53 family—not a count of source links in the machine-readable requirement records. That yields 33 for Access Control and 156 overall. Rev. 2 family counts were checked against its Chapter 3 requirement set and the CMMC model. The figures describe structure and lineage, not implementation effort or automatic equivalence. (Rev. 3 Appendix C; Rev. 2; CMMC model)

Can you reuse 800-53 work for 800-171 or CMMC?

Often, yes, as a starting point. 800-171 came from 800-53's Moderate baseline, and NIST built its mapping tables for organizations whose programs are organized around 800-53 or ISO/IEC 27001, an information-security management standard. But a mapping isn't proof: NIST calls those mappings informal, and a CMMC assessment tests the 800-171 Rev. 2 requirements using the incorporated assessment procedures, within your CUI boundary. (Rev. 2, Appendix D; §170.14(d))

The reverse is not automatic either. You can evaluate 800-171 evidence for an 800-53-based program, but it does not prove that the broader selected set is satisfied. NIST warns that meeting 800-171 shouldn't be assumed to satisfy 800-53 (SP 800-171 Rev. 2, cautionary note).

Here is where existing 800-53 work can help, and what still needs checking:

Requirement text is from NIST SP 800-171 Rev. 2. CMMC Level 2 is assessed using NIST SP 800-171A (June 2018), per 32 CFR 170.14(d). Suggested evidence is our judgment, not a promise any assessor will accept a particular document.

One version trap: Rev. 2 Appendix D footnote 31 explicitly says its mappings use 800-53 Revision 4. This is not an inference from publication dates. Control IDs and their content can change between editions; match the requirement, edition, scope, implementation, and assessment objectives—not the ID alone. (Appendix D, printed page 61)

Say you already sell a FedRAMP Moderate-authorized software product, and you just won a DoD subcontract that expressly requires 800-171 Rev. 2 and puts CUI in your corporate email. The product's authorization covers that offering, not automatically your corporate email, laptops, or file shares. Evaluate your policies, tools, and evidence through a mapping—then write the system security plan against the 110 requirements and demonstrate implementation inside the applicable boundary. This is a hypothetical example, not a provider authorization check. (§170.16(c)(2); Rev. 2 Appendix D)

Should a small contractor build to 800-53 anyway? Our judgment: do not commission a complete 800-53 baseline project merely because your contract requires 800-171. A separate agency or customer requirement—or a documented business-risk decision—can justify broader work. Meet the required edition of 800-171 and borrow from 800-53 where it protects the business, like backup and restore testing. Before you pay for another project, ask the provider to separate what your contract requires from optional improvements, and to say which existing evidence it will check against which requirement.

If you're starting from an existing 800-53 or FedRAMP program, the right help depends on your CUI boundary and your contract, not on how many controls you already have.

Which revisions are you actually comparing?

For CMMC Level 2 today, 800-171 Rev. 2 — even though NIST withdrew it on May 14, 2024. CMMC's rule names Rev. 2 as the Level 2 requirement set, and a new NIST edition doesn't change a regulation or a contract by itself. (32 CFR 170.14(c)(3); current clause 7012)

A page that says 800-171 has "110 controls in 17 families" is mixing Rev. 2's count with Rev. 3's families. For which document binds you, see which revision your contract requires. For what changed between the two editions, see 800-171 Rev. 2 vs. Rev. 3.

Questions that can change the answer

Is there a "NIST 800-53 certification" or a "NIST 800-171 certification"?

NIST does not issue contractor certification against either publication. A federal-system authorization, a specific cloud offering’s FedRAMP authorization, and a CMMC status are different results; evidence has to match the applicable scope and process. A CMMC self-assessment is not a third-party certification, and “we’re NIST certified” does not identify an official result a prime can rely on. (NIST Risk Management Framework; 32 CFR 170.16)

Does 800-171 ignore integrity and availability?

Not entirely. It focuses on keeping CUI confidential, and NIST notes its requirements also protect against unauthorized changes. Rev. 2 includes recovery in incident handling and backup confidentiality, but it is not a complete disaster-recovery or availability program; your business may need more. (Rev. 2, note 19, 3.6.1, and 3.8.9)

Is 800-53 High the same thing as CMMC Level 3?

No. The untailored 800-53B High baseline has 370 controls and enhancements under the Release 5.2.0 count above. CMMC Level 3 instead adds 24 selected requirements from SP 800-172, February 2021, requires Final Level 2 (C3PAO) as a prerequisite, and is assessed by DCMA DIBCAC; current procurement direction suspends new Level 3 designations. (§170.14, §170.18, current deviation) See CMMC levels.

Can we use 800-53 voluntarily even if our contract requires 800-171?

Yes. NIST says nongovernmental organizations may use its publications voluntarily. Just keep voluntary work and required work labeled separately in your plan, so your SPRS results and affirmation describe what the contract actually requires. (NIST Rev. 2, Authority and cautionary note; §170.16)

Does 800-53 cover classified systems?

800-53 controls can be used for national security systems under the responsible authorities; ordinary NIST federal-system applicability does not automatically extend to those systems. Classified information is not CUI, and its governing security requirements are outside this contractor-CUI comparison. Confirm them through the relevant agency security process, not the worksheet above. (NIST Rev. 5, Authority and §1.1, note 11; CUI definition, 32 CFR 2002.4)

What we verified

On September 23, 2026, we read the relevant primary-source provisions below, recalculated the catalog and baseline figures from NIST's official data, and counted the CUI-designated entries in Rev. 3 Appendix C. We did not see your contract, inspect your systems, or test any provider, and the decision record above organizes your decision—it isn't an assessment result.

• Rules and clauses: the relevant CMMC model, self-assessment, affirmation, scoping, and Level 3 provisions in 32 CFR Part 170; 32 CFR Part 2002, including §2002.4 and §2002.14(h); and clause 252.204-7012 in the September 3, 2026 deviation and its attachment. The retrieved eCFR display was current through September 21, 2026. We distinguish the codified Acquisition.gov clause from the revised deviation text rather than treating them as interchangeable.
• NIST publications and data: SP 800-171 Rev. 2 scope, development discussion, requirements, and Appendix D—including footnote 31 and the original mapping tables; the June 2018 SP 800-171A assessment objectives; SP 800-171 Rev. 3 and its Appendix C and FAQ; SP 800-53/800-53B publication records; and NIST’s machine-readable catalogs and baseline profiles. The catalog and baseline profiles checked identify Release 5.2.0; the Rev. 3 requirement catalog identifies version 1.1.0.
• Program status: the Department’s CMMC program page, July 13 implementation memo, and Class Deviation 2026-O0025 Revision 3, dated September 3, 2026. The deviation retains Phase I self-assessment requirements and Rev. 2; it directs written changes to existing C3PAO/Level 3 procurement requirements rather than telling contractors to ignore their contracts.
• Proposed civilian rule: FAR Case 2026-001 at 91 FR 37550, published June 23, 2026. Its proposed Rev. 3 text is identified as a proposal, not applied to a reader’s contract by this article.
• What we could not establish: a published Reform Task Force outcome or replacement Phase II date from the official implementation sources reviewed. A review deadline is not a restart instruction. We also did not verify a specific provider’s authorization or equivalency, or complete the Find My CMMC Path interactive flow; its description here is limited to its live landing page.

Before you commission the work

Leave with a standard written next to each system, not a framework name. Your record should show the clause, the revision, the boundary, the evidence you'll evaluate, and any question still open. For a covered nonfederal system under the current DoD clause, that's 800-171 Rev. 2. If an external cloud holds the covered defense information, check the specific offering’s authorization or equivalency, its clause 7012(c)–(g) obligations, and the responsibility matrix. If you run a system for the government, get that system's requirements in writing from the agency. An unknown fact stays open until the right person answers it. (Current clause 7012(b); §170.16(c)(2))

Still not sure which CMMC path fits your company? Use The Defense Compliance Report's Find My CMMC Path tool to see which path and kind of help fit your contract, CUI, environment, and timeline — before you hire anyone.

Sources

Relevant provisions and records checked September 23, 2026; the verification limits above apply. Catalog totals are editorial calculations, not quoted regulatory totals.

• NIST SP 800-171 Rev. 2 (February 2020, updated January 28, 2021; withdrawn May 14, 2024): publication record · PDF
• NIST SP 800-171 Rev. 3 (May 14, 2024): publication record · FAQ · full publication and Appendix C
• NIST SP 800-171A (June 2018): PDF
• NIST SP 800-53 Rev. 5: publication PDF, including Authority and §1.1. Release 5.2.0 (August 27, 2025): NIST announcement · Risk Management Framework page
• NIST SP 800-53 Rev. 4 (withdrawn September 23, 2021): publication record
• NIST machine-readable catalogs and baselines (SP 800-53 Rel. 5.2.0, SP 800-53B Rel. 5.2.0, SP 800-171 Rev. 3): usnistgov/oscal-content · SP 800-53B publication · SP 800-53 Rev. 5 publication and mapping caveat
• 32 CFR 170.14, CMMC Model: eCFR
• 32 CFR 170.16, Level 2 self-assessment and affirmation: eCFR
• 32 CFR Part 2002, Controlled Unclassified Information: eCFR
• CMMC Level 1, Level 3, scope, POA&M, and assessment method: §170.15, §170.18, §170.19, §170.21, §170.24
• FAR 52.204-21, basic safeguarding: Acquisition.gov
• DFARS 252.204-7012: codified Acquisition.gov text · Class Deviation 2026-O0025 Revision 3, September 3, 2026, including revised clause and assessment provisions. Use the text applicable to the actual instrument, not the number alone.
• Department of War CIO, CMMC program page: dowcio.war.gov/CMMC
• Implementing Suspension of CMMC Phase II (July 13, 2026): memo
• DoD CMMC Model Overview, Version 2.13: PDF
• FedRAMP Rev. 5 baselines release (May 2023): FedRAMP
• FAR Case 2026-001, proposed rule, 91 FR 37550 (June 23, 2026): Federal Register

About The Defense Compliance Report

The Defense Compliance Report is the independent trade publication and decision resource for CMMC and Defense Industrial Base compliance — explaining the CMMC Final Rule with primary-source citation on every claim and mapping a contractor's level, CUI scope, assessment type, and timeline to the right provider category, so DIB contractors choose the right CMMC path before they spend six figures.

We are not affiliated with the Cyber AB, DoD, DCMA DIBCAC, NIST, or any U.S. government agency. This page is educational research, not legal, contractual, or compliance advice. Confirm scope and applicability with a CMMC Registered Practitioner (RP) or a qualified federal-contracts attorney. See our Editorial & Advertising Policy.