Guidelines: Defining rules & the setting direction of travel
There are several references documents which are important in understanding the CMMC programme and its application to the protection of FCI and CUI data.
Undersecretary of Defence for Acquisition and Sustainment (OUSD A&S)
CMMC 1.0 Level 1 assessment guide
CMMC 1.0 Level 3 assessment guide
Defence Contract Management Agency (DCMA) & NIST
NIST SP 800 – 171r2
DoD Assessment Methodology (DAM) – NIST (SP) 800 – 171A
Defence Acquisition Regulation – DFARS Interim Final Ruling
DFARS Case D041
Interim Final Ruling
DFARS Case 2019-D041
Regulatory Impact Assessment
Defence Acquisition Regulation
FAR 48 CFR 52.204 – 21
DFARS 48 CFR 252.204 – 7012
National Institute for Science and Technology (NIST)
NIST SP 800 – 171 r2
National Archives
CUI Policy and Guidance
CUI Implementation Regulation
Assessing CUI in non Federal Systems
 |  |  |  |  |