CMMC Resources &
Reference Materials
Official links, reference documents, and quick-reference checklists for CMMC Level 1 (17 practices) and Level 2 (110 practices across 14 domains). All content sourced from the Cyber-AB and DoD CMMC program office.
Official CMMC Links
Always verify CMMC information from these official government and Cyber-AB sources.
Cyber-AB (CMMC Accreditation Body)
The official Cyber-AB website — the DoD-authorized accreditation body that manages the CMMC ecosystem, RPO/C3PAO listings, and practitioner certifications.
DoD CMMC Program Office
The official DoD CMMC program website with the latest policy updates, DFARS clauses, model documentation, and implementation guidance for contractors.
Cyber-AB CMMC Marketplace
The official Cyber-AB marketplace where you can verify RPO, C3PAO, and RP listings — including Galaxy Consulting's RPO authorization.
NIST SP 800-171 Rev 2
NIST Special Publication 800-171 Revision 2 — the security standard that underpins CMMC Level 2. Understanding this document provides context for Level 1 requirements.
FAR 52.204-21
Federal Acquisition Regulation clause 52.204-21 — the legal basis for CMMC Level 1. The 15 requirements in this clause form the foundation of the 17 Level 1 practices.
DFARS 252.204-7012
Defense Federal Acquisition Regulation Supplement clause 252.204-7012 — Safeguarding Covered Defense Information. The legal basis for CMMC Level 2. If this clause is in your contract, you handle CUI and need Level 2.
SPRS (Supplier Performance Risk System)
The DoD's Supplier Performance Risk System where contractors submit their CMMC self-assessment scores. DoD contracting officers can view your SPRS score.
CMMC Level 1 — All 17 Practices at a Glance
Use this checklist to do a quick self-check of your current compliance posture. For a thorough assessment, contact Galaxy Consulting.
For detailed practice descriptions and implementation guidance, see the CMMC Level 1 page or visit cyberab.org.
CMMC Level 2 — 14 Domains at a Glance
All 110 Level 2 practices from NIST SP 800-171 r2 are organized into 14 security domains. Every organization seeking Level 2 must demonstrate compliance across all domains.
Total: 110 practices across 14 domains — sourced from NIST SP 800-171 r2.
Full Level 2 DetailsNeed Help Interpreting These Requirements?
Galaxy Consulting is a Cyber-AB authorized CMMC RPO with Registered Practitioners on staff. We translate official CMMC requirements into plain-English action steps tailored to your specific business environment. Contact us for a free initial consultation.