How we checked these guides

Sources

1. Department of War, business.defense.gov/cmmc, the section “New to Contracting or Need Help: Free Tools and Training with Project Spectrum” and the CMMC notice of 13 July 2026. Used for: who started Project Spectrum; the free account, tools and training; the Cyber Advisor email address; the suspension of CMMC Phase II.
2. Project Spectrum home page. Used for: Level 1 and Level 2 self-assessments, and the other services the site promotes.
3. Project Spectrum FAQ, with every answer opened. Used for: what the program offers, how long the self-assessments take, what the report shows, training topics, templates and advisor sessions.
4. LYNX Terms of Use, shown when you choose Register on projectspectrum.io (operated by Eccalon, LLC; effective 2 September 2025). Used for: who operates the account platform.
5. IAM CMMC Resource Center. Used for: which companies CMMC reaches in DP3.
6. DP3 Household Goods Tender of Service, 2026 Change 3 (effective 15 May 2026), section A.2 “General Cyber Security Requirements”. Used for: the DP3 Level 1 and Level 2 requirements for TSPs and subcontractors that hold CUI or FCI, and passing the requirement to subcontractors. We do not repeat its dates; see section A.2 for the current ones.
7. DoD CMMC Assessment Guide, Level 1 (version 2.13, September 2024). Used for: Level 1 has 15 requirements.
8. Census Bureau, 2022 NAICS code list (spreadsheet). Used for: the official titles of the NAICS codes on the NAICS page.
9. Federal Acquisition Regulation 19.102 (FAC 2026-01, effective 13 March 2026). Used for: how SBA size standards follow NAICS codes, and that each solicitation carries one NAICS code.
10. SBA table of size standards. Linked so you can look up the size standard for your code.
11. NIST SP 800-171 Revision 2. Used for: the official wording of all 110 Level 2 requirements and their 14 families.
12. 32 CFR 170.24, CMMC scoring (eCFR, current to 23 October 2026). Used for: the points each requirement costs if not met, and that a requirement that does not apply counts as met.
13. 32 CFR 170.21, plans of action (eCFR, current to 23 October 2026). Used for: when a gap may wait on a POA&M, the 88-point threshold, the 180-day limit and the six requirements that can never wait.
14. 32 CFR 170.14, the CMMC model (eCFR, current to 23 October 2026). Used for: Level 1 is the 15 requirements of FAR 52.204-21, and Level 2 is the 110 requirements of NIST SP 800-171 Rev 2.
15. 32 CFR 170.16, Level 2 self-assessment and affirmation (eCFR, current to 23 October 2026). Used for: Final and Conditional status, the three-year cycle, the 180-day closeout, the Department's right to assess you, the cloud rule, keeping evidence for six years, and needing a current status before award.
16. 32 CFR 170.19, scoping (eCFR, current to 23 October 2026). Used for: the assessment scope, the five asset types and what each requires, and outside service providers.
17. 32 CFR 170.22, affirmation (eCFR, current to 23 October 2026). Used for: who the Affirming Official is, what they affirm and when.
18. 32 CFR 170.23, subcontractors (eCFR, current to 23 October 2026). Used for: the Level 2 minimum for subcontractors that handle CUI, and passing the requirement down.
19. FedRAMP Marketplace. Linked so you can look up a cloud service's FedRAMP status.
20. DoD CMMC Assessment Guide, Level 2. Used for: where the official assessment objectives for each requirement are listed; also linked as further reading on how each requirement is assessed.
21. NIST SP 800-171A. Used for: the official assessment objectives a self-assessment is done against.
22. 32 CFR 170.4, definitions (eCFR, current to 23 October 2026). Used for: the CMMC Status Date, the operational plan of action in 3.12.2, and “periodically” meaning at least once a year.
23. SPRS access instructions and SPRS CMMC page. Used for: SAM, the CAGE code, PIEE, the Contractor Account Administrator and the SPRS Cyber Vendor User role.
24. SPRS CMMC Level 2 Self-Assessment Quick Entry Guide (version 4.0, February 2025). Used for: the steps and screens for entering and affirming a Level 2 self-assessment.
25. Johns Hopkins APL supplier briefing on SPRS (25 August 2026). Used for: the CAGE hierarchy, approvals, the CMMC UID, the False Claims Act note and when contracting officers see the record.
26. IAM: What You Need to Do for CMMC (January 2026). Used for: the DP3 Level 1 requirement and starting registration early.
27. Executive Order 14347, Restoring the United States Department of War (5 September 2025). Used for: why DoD and the Department of War are the same department.
28. DFARS 252.204-7012 (May 2024). Used for: the 72-hour incident report, the medium assurance certificate, images and monitoring data kept for 90 days, malicious software sent to DC3, the incident report number passed up the chain, and cloud services' incident terms, in the policies pack and the vendor and agent kit.

What we could not check

• The account form itself: we did not create an account.
• The on-demand webinar the Department mentions: we could not find its link.
• Anything behind the Project Spectrum sign-in.
• The Project Spectrum FAQ loads by script. On 6 November 2026 we could not open it again, so this guide no longer repeats its line about SPRS scores.
• The plain-English explanations of the 110 requirements are our own reading of the official wording. Your assessment is scored against the official wording, which each page shows.
• The “Usually applies to” lines and the list of typical systems describe a typical moving company. Your own assessment scope decides what applies to you.

Everything on this site is general information, not legal or compliance advice. See the disclaimer.

Corrections

Rules and websites change. If you spot something out of date, tell us through movegistics.com/contact and we will look into it. Please do not send DoD shipment information or other sensitive details.

Back to Resources home or Start here.