Update — July 13, 2026: CMMC Phase 2 (mandatory C3PAO certification) is suspended pending a 60-day DoD review. Your NIST 800-171, DFARS 7012, self-assessment, and SPRS obligations remain in force. Read what changed →
Plain-English breakdowns of all 14 security requirement families — what each control requires, how to implement it, and what evidence a C3PAO assessor will look for.