Trace the basis
Official sources, with their limits.
Source research checked 25 October 2026. Use each document for the question it addresses, then verify applicability to the actual work.
DFARS 252.204-7025 — CMMC notice provision
Standard notice includes CO level fill-in and system UIDs. Check operative/deviated version.
DFARS 252.204-7021 — CMMC contract clause
Standard November 2025 clause; never treat as universal operative text during deviation changes.
DFARS 252.204-7019 — NIST assessment notice
NIST DoD assessment mechanism, not automatically a CMMC status.
DFARS 252.204-7020 — NIST DoD assessment requirements
Assessment definitions and framework; actual contract must be checked.
DARS — official RFO class deviation index
The official index identifies 2026-O0025 Revision 3, dated 3 September 2026. Read the applicable memorandum and attachments before interpreting operative changes; this publication does not analyze their complete terms.
DoD CIO — current CMMC program overview
Current program policy context, including the July 2026 Phase II suspension. Recheck before relying on timing and review the applicable acquisition documents.
FAR 15.206 — Solicitation amendments
Acquisition-context source, not a claim all procurements use Part 15.
FAR 15.201 — Exchanges before proposals
Acquisition-context source; use actual question mechanism and applicable deviations.
Acquisition.gov — FAR Overhaul resources
Locate current parts and agency deviations; applicability must be checked.
32 CFR 170.22 — Affirmation
Authorized affirmation and continuing compliance, not an editorial checkbox.
NIST SP 800-171 Revision 2 publication record
Publication is superseded at NIST; distinguish publication currency from revision incorporated into applicable requirements.
FAR 52.204-21 — Basic safeguarding
FCI definition,15 safeguards and flowdown; standard text not assumed operative where a deviation applies.
DFARS 252.204-7012 — Safeguarding and cyber incident reporting
Standard clause source; actual applicable acquisition text and deviations need review.
32 CFR 170.19 — CMMC scoping
Scope specified before assessment; asset rules differ by level. No automatic classification from tool inputs.
SAM.gov — laboratory-services notice, source-currency example
Official notice excerpt read 2026-10-25. Used only to illustrate amendment/version warnings, not complete terms or bidding advice.
National Archives — About CUI
CUI framework and authority, not a designation of a reader-provided file.
Recheck before a material decision
Use current official pages and the exact revision, date, amendment and applicability. Older slides and archived publications can explain history without controlling today’s procurement. Refer a material conflict to authorized contracts, security or legal reviewers. This publication cannot settle it for an individual acquisition.
Read our editorial approach and common ownership disclosure.