CMMC Resource Library
Official links, key terms, timelines, and templates to help you navigate CMMC Level 2 compliance.
Official Government Resources
Authoritative sources from the DoD and NIST — always go to the source for policy updates.
CMMC Official Program (DoD)
The official DoD CMMC program page with policy documents, rulemaking updates, and implementation guidance.
Visit site →NIST SP 800-171
The NIST special publication defining the 110 security requirements for protecting CUI in non-federal systems.
Visit site →SPRS Portal
Submit your self-assessment score to the Supplier Performance Risk System after completing your NIST SP 800-171 assessment.
Visit site →CMMC Accreditation Body (Cyber AB)
Find authorized C3PAOs, Registered Practitioners, and RPOs. The Cyber AB oversees the CMMC ecosystem.
Visit site →DoD Cybersecurity Policy
DoD CIO cybersecurity policy resources including guidance on CUI handling and contractor requirements.
Visit site →NIST Cybersecurity Framework
The NIST CSF provides a broader framework for cybersecurity risk management, complementing CMMC requirements.
Visit site →CMMC Level 2 Certification Path
The typical journey from self-assessment to certified compliance.
Self-Assessment
Complete intake and calculate your SPRS score
POA&M Creation
Document gaps and plan remediation actions
Remediation
Implement missing controls; update SSP
C3PAO Assessment
Engage a certified assessor for formal review
Certification
Receive CMMC Level 2 certification in PPIRS
Note: Self-attestation (without C3PAO) is permitted for lower-priority programs. Check your contract requirements.
CMMC Key Terms Glossary
Plain-language definitions for the acronyms and concepts you will encounter throughout the CMMC process.
Controlled Unclassified Information — information the government creates or possesses that requires safeguarding per law or policy, but is not classified.
Federal Contract Information — information provided by or generated for the government under a contract, not intended for public release.
Organization Seeking Assessment — the defense contractor or subcontractor seeking CMMC certification.
Certified Third-Party Assessment Organization — an organization authorized by the CMMC Accreditation Body (Cyber AB) to conduct official CMMC assessments.
Supplier Performance Risk System — the DoD portal where contractors self-report their NIST SP 800-171 assessment score.
Plan of Action & Milestones — a document listing unimplemented security controls, planned remediation actions, and target completion dates.
System Security Plan — the primary CMMC compliance document describing your information system and how each security control is implemented.
Multi-Factor Authentication — a security mechanism requiring two or more verification factors (password + token, biometric, etc.) to access systems.
Federal Information Processing Standard 140-2 — a U.S. government standard for cryptographic modules. CMMC requires FIPS-validated encryption for CUI.
Control Responsibility Matrix — a document mapping each of the 110 NIST SP 800-171 controls to the responsible party (your company, cloud provider, or shared).
Defense Industrial Base Cybersecurity Assessment Center — the DoD organization that conducts CMMC assessments for high-priority programs.
Registered Provider Organization — a company registered with the Cyber AB to provide CMMC consulting and advisory services (but not conduct assessments).
A bounded, isolated environment within your network that contains CUI. Many contractors scope their CMMC assessment to a CUI enclave.
Defense Federal Acquisition Regulation Supplement — the DoD supplement to federal acquisition regulations, including cybersecurity clauses like 252.204-7012.
The process of identifying which systems, assets, and personnel are in-scope for CMMC assessment because they process, store, or transmit CUI.
Downloadable Templates
All CMMC compliance templates are generated dynamically for your organization based on your intake answers.
System Security Plan (SSP)
Full 110-control narrative SSP tailored to your environment
POA&M
Plan of Action & Milestones listing all gaps with remediation timelines
Access Control Policy
Organization-specific access control policy document
Incident Response Policy
Incident response procedures customized for your organization
Control Responsibility Matrix
Maps all 110 controls to responsible parties
SPRS Score Report
Calculated score with control-by-control breakdown
Ready to generate your compliance documents?
Create a free account and complete the intake form. Your SSP, POA&M, and full document package will be ready in minutes.