Sources & Official References

Standards & baselines

NIST SP 800-171 Rev 2 — Protecting CUI in nonfederal systems
NIST SP 800-171 Rev 3 — Updated baseline (confirm applicability for your contracts)
NIST — standards organization home

CMMC program

DoD CMMC program — official program information
DoD CIO — cyber policy context
Class Deviation 2026-O0025, Revision 3(3 Sep 2026) — implements the Phase 2 pause in contracting instructions

SPRS & acquisition

SPRS (DISA) — Supplier Performance Risk System
DFARS — Defense Federal Acquisition Regulation Supplement
Acquisition.gov — FAR / DFARS portal

CUI

National Archives — CUI Program

How to verify a claim (ops)

Find the primary instrument (NIST SP, DFARS clause, program memo)—not a LinkedIn summary.
Confirm the version and effective date that apply to your contract.
Separate safeguarding/SPRS duties from certification-path timing.
Update your status register only after the primary text is clear.
If this site and a primary source disagree, trust the primary source.

Policy pulse (manual)

We do not auto-scrape news. When major primary-source changes land, we revise pillar pages and bumpLast verified / Next scheduled review dates.

Where things stand — 14 Sep 2026:Class Deviation 2026-O0025, Revision 3(3 Sep) implements the Phase 2 pause in contracting instructions: Level 1/2Self permitted; NIST SP 800-171 Rev 2 via DFARS 252.204-7012 remains; C3PAO / Phase 2 requirements to be removed or revised. 32 CFR Part 170 isnot repealed. Reform Task Force RFI closed 14 Aug; Task Force reportnot yet public. Full framing:suspension guide ·RFI closed / what’s next.

Living pillars:

CMMC Reform Task Force RFI —closed 14 Aug 2026 · what’s next + archival filing template
CMMC after Phase II suspension (Last verified 14 Sep · next review ~1 Oct 2026)
Is CMMC still required? (Last verified 14 Sep)
Do I still need a SPRS score? (Last verified 14 Sep)
Rev 2 vs Rev 3
SPRS & FCA — public DOJ settlements table

How we use these

DefensibleScore articles translate these topics for small contractors. They are educational and may lag official updates. If a page and a primary source disagree, trust the primary source and your contract language.