32 CFR Part 170 - Revision history

David at 01:33, 2 March 2026

2026-03-02T01:33:24Z

← Older revision		Revision as of 01:33, 2 March 2026
Line 1:		Line 1:
	'''Source of Reference: The official [https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program Cybersecurity Maturity Model Certification (CMMC) Program] final rule.'''		'''Source of Reference: The official [https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program Cybersecurity Maturity Model Certification (CMMC) Program] final rule.'''

	For inquiries and reporting errors on this wiki, please [mailto:support@~~cmmctoolkit~~.org contact us]. Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmcwiki.org contact us]. Thank you.

	== PART 170 - CYBERSECURITY MATURITY MODEL CERTIFICATION (CMMC) PROGRAM ==		== PART 170 - CYBERSECURITY MATURITY MODEL CERTIFICATION (CMMC) PROGRAM ==

David: /* § 170.4 Acronyms and definitions. */

2025-05-28T22:07:35Z

§ 170.4 Acronyms and definitions.

← Older revision		Revision as of 22:07, 28 May 2025
Line 136:		Line 136:
	CFR - Code of Federal Regulations<br>		CFR - Code of Federal Regulations<br>
	CIO - Chief Information Officer<br>		CIO - Chief Information Officer<br>
	CM - Configuration Management CMMC - Cybersecurity Maturity Model Certification<br>		CM - Configuration Management<br>
			CMMC - Cybersecurity Maturity Model Certification<br>
	CMMC PMO - CMMC Program Management Office<br>		CMMC PMO - CMMC Program Management Office<br>
	CNC - Computerized Numerical Control<br>		CNC - Computerized Numerical Control<br>
Line 145:		Line 146:
	DD - Represents any two-character CMMC Domain acronym<br>		DD - Represents any two-character CMMC Domain acronym<br>
	DFARS - Defense Federal Acquisition Regulation Supplement<br>		DFARS - Defense Federal Acquisition Regulation Supplement<br>
	DIB - Defense Industrial Base DIBCAC - DCMA’s Defense Industrial Base Cybersecurity Assessment Center<br>		DIB - Defense Industrial Base<br>
			DIBCAC - DCMA’s Defense Industrial Base Cybersecurity Assessment Center<br>
	DoD - Department of Defense DoDI - Department of Defense Instruction<br>		DoD - Department of Defense DoDI - Department of Defense Instruction<br>
	eMASS - Enterprise Mission Assurance Support Service<br>		eMASS - Enterprise Mission Assurance Support Service<br>

David: /* § 170.4 Acronyms and definitions. */

2025-05-28T22:06:56Z

§ 170.4 Acronyms and definitions.

← Older revision		Revision as of 22:06, 28 May 2025
Line 139:		Line 139:
	CMMC PMO - CMMC Program Management Office<br>		CMMC PMO - CMMC Program Management Office<br>
	CNC - Computerized Numerical Control<br>		CNC - Computerized Numerical Control<br>
	CoPC - Code of Professional Conduct CSP - Cloud Service Provider CUI - Controlled Unclassified Information<br>		CoPC - Code of Professional Conduct<br>
			CSP - Cloud Service Provider<br>
			CUI - Controlled Unclassified Information<br>
	DCMA - Defense Contract Management Agency<br>		DCMA - Defense Contract Management Agency<br>
	DD - Represents any two-character CMMC Domain acronym<br>		DD - Represents any two-character CMMC Domain acronym<br>

David at 01:44, 3 April 2025

2025-04-03T01:44:15Z

Show changes

David: David moved page 32 CFR Part 170 CMMC Rule to 32 CFR Part 170 without leaving a redirect

2025-03-16T16:23:03Z

David moved page 32 CFR Part 170 CMMC Rule to 32 CFR Part 170 without leaving a redirect

← Older revision	Revision as of 16:23, 16 March 2025
(No difference)

David: /* Table 7 */

2025-03-03T04:20:39Z

Table 7

← Older revision		Revision as of 04:20, 3 March 2025
Line 1,462:		Line 1,462:
	\|+ TABLE 7 TO § 170.24(c)(2)(ii) - CMMC LEVEL 2 SCORING TABLE		\|+ TABLE 7 TO § 170.24(c)(2)(ii) - CMMC LEVEL 2 SCORING TABLE
	\|-		\|-
	! style="width: 75%;text-align:left" \| CMMC Level 2 requirement categories		! style="width: 80%;text-align:left" \| CMMC Level 2 requirement categories
	! style="width: 25%;text-align:right" \| Point value subtracted from maximum score		! style="width: 20%;text-align:right" \| Point value subtracted from maximum score
	\|-		\|-
	\| colspan="2" \| ''Basic Security Requirements:''		\| colspan="2" \| ''Basic Security Requirements:''
Line 1,487:		Line 1,487:
	\| style="text-align:right;" \| 3 or 5		\| style="text-align:right;" \| 3 or 5
	\|- style="vertical-align:top;"		\|- style="vertical-align:top;"
			\|
	: If not implemented, has specific and confined effect on the security of the network and its data		: If not implemented, has specific and confined effect on the security of the network and its data
	\| style="text-align:right;" \| 3		\| style="text-align:right;" \| 3

David at 04:19, 3 March 2025

2025-03-03T04:19:14Z

David at 04:13, 3 March 2025

2025-03-03T04:13:55Z

Show changes

David at 03:49, 3 March 2025

2025-03-03T03:49:38Z

Show changes

David: /* Table 3 */

2025-03-03T03:42:00Z

Table 3

← Older revision		Revision as of 03:42, 3 March 2025
Line 1,164:		Line 1,164:
	* Do not assess against other CMMC security requirements.		* Do not assess against other CMMC security requirements.
	\|-		\|-
	\| colspan="4" \| '''Assets that are not in the Level 2 CMMC Assessment Scope'''		\| colspan="4" style="text-align:center;" \| '''Assets that are not in the Level 2 CMMC Assessment Scope'''
	\|-		\|-
	\|Out-of-Scope Assets		\|Out-of-Scope Assets

← Older revision		Revision as of 04:19, 3 March 2025
Line 1,209:		Line 1,209:
	(1) The CMMC Assessment Scope for Level 3 is based on the specification of asset categories and their respective requirements as set forth in table 5 to this paragraph (d)(1). Additional information is available in the guidance document listed in paragraph (g) of appendix A to this part.		(1) The CMMC Assessment Scope for Level 3 is based on the specification of asset categories and their respective requirements as set forth in table 5 to this paragraph (d)(1). Additional information is available in the guidance document listed in paragraph (g) of appendix A to this part.

			==== Table 5 ====
	{\| class="wikitable" style="margin:auto"		{\| class="wikitable" style="margin:auto"
	\|+ TABLE 5 TO § 170.19(d)(1) - CMMC LEVEL 3 ASSET CATEGORIES AND ASSOCIATED REQUIREMENTS		\|+ TABLE 5 TO § 170.19(d)(1) - CMMC LEVEL 3 ASSET CATEGORIES AND ASSOCIATED REQUIREMENTS
Line 1,270:		Line 1,271:
	(2)(i) Table 6 to this paragraph (d)(2)(i) defines the requirements to be met when utilizing an External Service Provider (ESP). The OSA must consider whether the ESP is a Cloud Service Provider (CSP) and whether the ESP processes, stores, or transmits CUI and/ or Security Protection Data (SPD).		(2)(i) Table 6 to this paragraph (d)(2)(i) defines the requirements to be met when utilizing an External Service Provider (ESP). The OSA must consider whether the ESP is a Cloud Service Provider (CSP) and whether the ESP processes, stores, or transmits CUI and/ or Security Protection Data (SPD).

			==== Table 6 ====
	{\| class="wikitable" style="margin:auto"		{\| class="wikitable" style="margin:auto"
	\|+ TABLE 6 TO § 170.19(d)(2)(i) - ESP SCOPING REQUIREMENTS		\|+ TABLE 6 TO § 170.19(d)(2)(i) - ESP SCOPING REQUIREMENTS
Line 1,465:		Line 1,467:
	\| colspan="2" \| ''Basic Security Requirements:''		\| colspan="2" \| ''Basic Security Requirements:''
	\|- style="vertical-align:top;"		\|- style="vertical-align:top;"
			\|
	: If not implemented, could lead to significant exploitation of the network, or exfiltration of CUI		: If not implemented, could lead to significant exploitation of the network, or exfiltration of CUI
	\| 5		\| style="text-align:right;" \| 5
	\|- style="vertical-align:top;"		\|- style="vertical-align:top;"
	\|		\|
	: If not implemented, has specific and confined effect on the security of the network and its data		: If not implemented, has specific and confined effect on the security of the network and its data
	\| 3		\| style="text-align:right;" \| 3
	\|-		\|-
	\| colspan="2" \| ''Derived Security Requirements:''		\| colspan="2" \| ''Derived Security Requirements:''
Line 1,476:		Line 1,479:
	\|		\|
	: If not implemented, could lead to significant exploitation of the network, or exfiltration of CUI		: If not implemented, could lead to significant exploitation of the network, or exfiltration of CUI
	\| 5		\| style="text-align:right;" \| 5
	\|- style="vertical-align:top;"		\|- style="vertical-align:top;"
	\|		\|
Line 1,482:		Line 1,485:
	:: - Partially effective implementation - 3 points.		:: - Partially effective implementation - 3 points.
	:: - Non-effective (not implemented at all) - 5 points.		:: - Non-effective (not implemented at all) - 5 points.
	\| 3 or 5		\| style="text-align:right;" \| 3 or 5
	\|- style="vertical-align:top;"		\|- style="vertical-align:top;"
	: If not implemented, has specific and confined effect on the security of the network and its data		: If not implemented, has specific and confined effect on the security of the network and its data
	\| 3		\| style="text-align:right;" \| 3
	\|- style="vertical-align:top;"		\|- style="vertical-align:top;"
	\|		\|
	: If not implemented, has a limited or indirect effect on the security of the network and its data		: If not implemented, has a limited or indirect effect on the security of the network and its data
	\| 1		\| style="text-align:right;" \| 1
	\|}		\|}

Line 1,498:		Line 1,501:
	Guidance documents include:		Guidance documents include:

	(a) ‘‘CMMC Model Overview’’ available at [https://DoDcio.defense.gov/CMMC/ \| ''https://DoDcio.defense.gov/CMMC/''.]		(a) ‘‘CMMC Model Overview’’ available at [https://DoDcio.defense.gov/CMMC/ ''https://DoDcio.defense.gov/CMMC/''.]

	(b) ‘‘CMMC Assessment Guide - Level 1’’ available at [https://DoDcio.defense.gov/CMMC/ \| ''https://DoDcio.defense.gov/CMMC/''.]		(b) ‘‘CMMC Assessment Guide - Level 1’’ available at [https://DoDcio.defense.gov/CMMC/ ''https://DoDcio.defense.gov/CMMC/''.]

	(c) ‘‘CMMC Assessment Guide - Level 2’’ available at [https://DoDcio.defense.gov/CMMC/ \| ''https://DoDcio.defense.gov/CMMC/''.]		(c) ‘‘CMMC Assessment Guide - Level 2’’ available at [https://DoDcio.defense.gov/CMMC/ ''https://DoDcio.defense.gov/CMMC/''.]

	(d) ‘‘CMMC Assessment Guide - Level 3’’ available at [https://DoDcio.defense.gov/CMMC/ \| ''https://DoDcio.defense.gov/CMMC/''.]		(d) ‘‘CMMC Assessment Guide - Level 3’’ available at [https://DoDcio.defense.gov/CMMC/ ''https://DoDcio.defense.gov/CMMC/''.]

	(e) ‘‘CMMC Scoping Guide - Level 1’’ available at [https://DoDcio.defense.gov/CMMC/ \| ''https://DoDcio.defense.gov/CMMC/''.]		(e) ‘‘CMMC Scoping Guide - Level 1’’ available at [https://DoDcio.defense.gov/CMMC/ ''https://DoDcio.defense.gov/CMMC/''.]

	(f) ‘‘CMMC Scoping Guide - Level 2’’ available at [https://DoDcio.defense.gov/CMMC/ \| ''https://DoDcio.defense.gov/CMMC/''.]		(f) ‘‘CMMC Scoping Guide - Level 2’’ available at [https://DoDcio.defense.gov/CMMC/ ''https://DoDcio.defense.gov/CMMC/''.]

	(g) ‘‘CMMC Scoping Guide - Level 3’’ available at [https://DoDcio.defense.gov/CMMC/ \| ''https://DoDcio.defense.gov/CMMC/''.]		(g) ‘‘CMMC Scoping Guide - Level 3’’ available at [https://DoDcio.defense.gov/CMMC/ ''https://DoDcio.defense.gov/CMMC/''.]

	(h) ‘‘CMMC Hashing Guide’’ available at [https://DoDcio.defense.gov/CMMC/'' \| https://DoDcio.defense.gov/CMMC/''.]		(h) ‘‘CMMC Hashing Guide’’ available at [https://DoDcio.defense.gov/CMMC/ ''https://DoDcio.defense.gov/CMMC/''.]

	Dated: September 30, 2024.		Dated: September 30, 2024.