Official references
Program, scope, and assessment.
Start with government direction, then use the guides that fit your boundary and level.
Official CMMC program overview (opens in a new tab)
Check the program’s purpose, current implementation position, and assessment routes. The official site currently identifies a Phase II suspension while Phase I obligations remain.
CMMC resources & documentation (opens in a new tab)
The government’s index of program documents. Start here for the current Level 1 and Level 2 scoping and assessment guides; verify the version shown on the document before use.
Read scoping before scoring
Use the relevant scoping guide to classify assets and dependencies. Then use the matching assessment guide to understand what will be examined. Keep a dated copy of the documents used for your readiness review.
DFARS 252.204-7012 (opens in a new tab)
Read the clause governing covered defense information safeguards and cyber incident reporting when it is included in your contract. Review related clauses and flowdowns with the contracts team.
The Cyber AB (opens in a new tab)
Understand accreditation and the CMMC ecosystem. Consult its official role and assessment information when checking the responsibilities of practitioners and assessment organizations.
Practitioner roles: RP and RPA (opens in a new tab)
Learn how Registered Practitioner and Registered Practitioner Advanced roles fit consulting and implementation. Practitioner assistance is separate from an independent assessment decision.
CMMC professional and assessor credentials (opens in a new tab)
Read the issuer’s descriptions of CCP, CCA, and Lead CCA. Use official verification channels when checking an individual’s credential status; a role description is not verification of a person.