/cmmc-expert

name: cmmc-expert
description: "CMMC v2.0 expert for DoD contractors. Covers NIST 800-171 Rev 2 (14 families, 110 controls), SPRS scoring, POA&M rules, 32 CFR Part 170, DFARS clauses, scoping, ESP/CSP, C3PAO assessment lifecycle, and Rev 2 → Rev 3 transition."
allowed-tools: Read, Glob, Grep, Write

CMMC Expert

> **Review required:** This material is an unverified working aid, not an authoritative assessment or legal determination. Verify every control, objective, scope, assessment type, scoring and contractual claim against current official sources and obtain qualified CMMC and contracting review before use. If a source or contract is unavailable, mark the conclusion unverified; do not infer compliance.

Deep, practitioner-grade expertise in the Cybersecurity Maturity Model Certification (CMMC) v2.0 for Department of Defense contractors. Built from the authoritative chain: **NIST SP 800-171 Rev 2** (control text), **NIST SP 800-171A (June 2018)** (assessment procedures), **32 CFR Part 170** (CMMC program rule), and **48 CFR / DFARS Part 204.75** (acquisition rule).

1. Program Overview & Authority

**Purpose:** Standardize verification of NIST SP 800-171 cybersecurity controls across the Defense Industrial Base (DIB) protecting Controlled Unclassified Information (CUI) and Federal Contract Information (FCI).

**Authority chain:**

• **32 CFR Part 170** — CMMC program rule. Effective **December 16, 2024**.
• **48 CFR / DFARS Part 204.75** — Acquisition rule that puts CMMC into contracts. Effective **November 10, 2025**.
• **DFARS 252.204-7012** — Pre-existing CUI safeguarding + 72-hour cyber incident reporting clause.
• **DFARS 252.204-7019** — Solicitation provision requiring a current NIST 800-171 self-assessment score in SPRS.
• **DFARS 252.204-7020** — Contract clause giving DoD/DIBCAC the right to verify SPRS assessments.
• **DFARS 252.204-7021** — The primary CMMC certification requirement clause.
• **DFARS 252.204-7025** — Solicitation provision identifying the required CMMC level for a given procurement.

**Authoritative sources to cite in deliverables:**

• NIST SP 800-171 Rev 2 — https://doi.org/10.6028/NIST.SP.800-171r2 (Final, including updates as of 01-28-2021; withdrawn May 14, 2024 but remains operative for CMMC).
• NIST SP 800-171A (June 2018) — assessment procedures, 320 objectives.
• CMMC Assessment Guide L2 (current version on dodcio.defense.gov).
• CMMC Scoping Guide L2.
• CMMC Scoring Methodology.
• 32 CFR Part 170 (89 FR 83214, Oct. 15, 2024).

Implementation status requires current verification

The Department announced on July 13, 2026 that Phase II requirements were suspended while Phase I self-assessment requirements remain in place; the announcement also describes a program review. See the [official announcement and current resource links](https://business.defense.gov/cmmc/). Do not represent the originally published phase dates as the current rollout. Check for subsequent changes and review the actual contract, regulations and guidance before advising on required assessment type or timing.

---

2. CMMC Levels (L1 / L2 / L3)

| Level | Name | Practices | Source | Assessment | POA&M Allowed | Cycle | |---|---|---|---|---|---|---| | **Level 1** | Foundational | **15** | FAR 52.204-21 | Self only | **No — never** | Annual self + annual affirmation | | **Level 2** | Advanced | **110** | NIST SP 800-171 Rev 2 | Self **or** C3PAO | Yes — restricted (see §11) | Triennial + annual affirmation | | **Level 3** | Expert | **134** (110 + 24 selected from 800-172) | NIST SP 800-171 Rev 2 + 800-172 | DCMA **DIBCAC** | Per DIBCAC methodology | Triennial + annual affirmation |

**Acronyms used here (correctly):**

• **OSA** — Organization Seeking Assessment.
• **OSC** — Organization Seeking Certification (used specifically in C3PAO context; OSA/OSC are largely interchangeable in practice).
• **C3PAO** — Certified Third-Party Assessor Organization. Accredited by the Cyber AB.
• **CCA** — Certified CMMC Assessor. Assessment personnel must meet the applicable Tier 3 investigation or equivalence requirements in [32 CFR 170.9(b)(3)–(4)](https://www.ecfr.gov/current/title-32/section-170.9#p-170.9(b)(3)).
• **CCP** — Certified CMMC Professional (support role).
• **DIBCAC** — **Defense Industrial Base Cybersecurity Assessment Center** (DCMA's assessment arm; conducts L3 assessments and high-water-mark L2 verifications).
• **DC3** — DoD Cyber Crime Center (recipient of malware samples under DFARS 7012).
• **eMASS** — Enterprise Mission Assurance Support Service (DoD system where C3PAO assessment results are posted).
• **SPRS** — Supplier Performance Risk System (where self-assessment scores and CMMC Status live).

**Who needs what:**

• Verify the solicitation or contract and applicable clauses before assigning a status; if unavailable, leave it unverified.
• FCI-only subcontracts subject to [32 CFR 170.23](https://www.ecfr.gov/current/title-32/section-170.23) require L1 (Self); CUI subcontract minimums depend on the prime requirement. The [DFARS 252.204-7021(f)](https://www.ecfr.gov/current/title-48/section-252.204-7021#p-252.204-7021(f)) flow-down excludes commercially available off-the-shelf items.
• The contract specifies the required CMMC level and assessment type, including any Level 3 requirement.

---

3. NIST 800-171 Rev 2 — 14 Families, 110 Controls

**These are the only 14 families in Rev 2.** Any reference to Asset Management (AM), Recovery (RE), Risk Management (RM), or Situational Awareness (SA) as 800-171 families is incorrect — those names belong to CMMC v1.0 or to other catalogs.

| # | ID | Family | Controls | |---|---|---|---| | 1 | AC | Access Control | 22 | | 2 | AT | Awareness and Training | 3 | | 3 | AU | Audit and Accountability | 9 | | 4 | CM | Configuration Management | 9 | | 5 | IA | Identification and Authentication | 11 | | 6 | IR | Incident Response | 3 | | 7 | MA | Maintenance | 6 | | 8 | MP | Media Protection | 9 | | 9 | PS | Per