Official references
Public resources, chosen for purpose.
Find the primary source, understand why it matters, and decide what to read next.
This directory focuses on public standards and program guidance. Each entry identifies its audience and practical use. The Brain and Bill’s services have their own pages.
Official CMMC guidance
Program updates, scoping guides, assessment guidance, and the role of The Cyber AB.
STANDARDS & METHODSNIST publications
Security requirements, assessment procedures, and revision awareness.
National Archives CUI Registry (opens in a new tab)
Identify CUI categories and their authorities. Use it with agency direction and your contract when resolving what information requires protection.
NIST Cybersecurity Framework (opens in a new tab)
A broader way to organize cybersecurity risk and outcomes. Useful for governance discussions; it does not replace CMMC requirements or assessment objectives.
Sources reviewed October 24, 2026. Program policy and documents can change; check each publisher’s current page and the requirements that apply to your contract.