Official CMMC resources, organized by what you need to do

The memo behind the July 2026 pause.

The official overview deck. A good first read for leadership.

Defines the levels, assessments, and affirmations.

The contract clause behind the Level 1 requirements.

Requires NIST SP 800-171 and incident reporting for CUI.

The requirements CMMC Level 2 assesses against. NIST has since published Rev 3, but the CMMC rule still uses Rev 2.

How each level maps to the NIST publications.

The structure of the model and its practices.

What's in scope when you handle FCI. Scoped separately from CUI.

The objectives you self-assess against.

Asset categories and drawing your CUI boundary.

How each NIST SP 800-171 requirement is assessed.

Procurement Integrated Enterprise Environment. You sign in here to reach SPRS.

Enter assessment results and annual affirmations. Contracting officers check it before award.

How CMMC results appear in SPRS.

The official CMMC accreditation body. Its Marketplace lists authorized C3PAOs, RPOs, and certified professionals.

The Cyber AB's nonprofit arm for CMMC training, education, and outreach.

Check a cloud service's FedRAMP status before it touches CUI.

The official list of what counts as CUI.

Free training on identifying and handling CUI.

No-cost government contracting counseling.

Manufacturing extension help, including CMMC.

Free cybersecurity training and tools for small businesses.

CMMC conferences, webinars, and round tables across the US where Cyber AB leaders take part. CMMC-PNW is on the list.

The Cyber AB's monthly town hall: ecosystem news, program updates, and Q&A.

Acquisition training and reference material.

People, offices, and channels that post CMMC updates first.