Guides
The rules, explained
What CMMC, SPRS, the DFARS and FAR clauses and Executive Order 14415 ask of defense suppliers and primes, in plain words, with the primary source for each rule. Each guide is dated. None is legal advice: the clauses in your contract decide what applies to you. To work out your own score as you read, there is a free SPRS score calculator; the 110 NIST SP 800-171 requirements themselves, with their points and how to meet each, are at Requirements.
For example: SPRS score, POA&M, 252.204-7012, executive order.
CMMC and SPRS
- SPRS score explained: range, weights, and what counts as goodAn SPRS score runs from 110 down to -203. How the DoD method subtracts 5, 3 or 1 points per unmet requirement, what 88 means, and how scores are posted.
- POA&M rules for CMMC Level 2: what can wait and for how longThe 32 CFR 170.21 rules for a CMMC Level 2 plan of action: the 88-point floor, the 1-point limit, six requirements that never wait, and the 180-day closeout.
- CMMC Phase II is suspended: what still appliesCMMC Phase II suspended on July 13, 2026: Level 1 and 2 self-assessments, SPRS scores, annual affirmations, the 180-day POA&M rule and DFARS 7012 still apply.
- How to do a NIST SP 800-171 self-assessment for CMMC Level 2How to do a NIST SP 800-171 self-assessment for CMMC Level 2 (Self): scope, the 110 requirements and 320 objectives, scoring, SSP, POA&M, SPRS and affirmation.
- What goes in a system security plan (SSP) for NIST SP 800-171What a NIST SP 800-171 system security plan must describe under 3.12.4, why no SSP means no SPRS score, NIST's own CUI SSP template, and Tiermark's outline.
- CUI or FCI: which CMMC level does your contract need?FCI calls for CMMC Level 1 and CUI for Level 2. What federal contract information and controlled unclassified information are, and how to tell which you hold.
- What CMMC costs a small business, by DoD's own estimatesDoD's CMMC rule estimates for a small entity: $5,977 for Level 1, $34,277 for a Level 2 self-assessment, $101,752 for Level 2 (C3PAO), and what they leave out.
DFARS and FAR
- DFARS and FAR cybersecurity clauses, as of 2026DFARS 252.204-7012, 7021 and 252.240-7997 and FAR 52.204-21 (52.240-93) in 2026: what each requires, what happened to 7019 and 7020, and what flows down.
- DFARS 7012 cyber incident reporting: the 72-hour ruleDFARS 252.204-7012 requires a cyber incident report to DoD through DIBNet within 72 hours of discovery, a medium assurance certificate and 90 days of evidence.
- NIST SP 800-171 Rev 2 vs Rev 3: which one does DoD require?DoD contracts and CMMC still require NIST SP 800-171 Revision 2, though NIST withdrew it in May 2024. What Revision 3 changed, and what to assess against today.
Supply chain rules
- Executive Order 14415 explained for defense contractorsExecutive Order 14415 makes primes and subcontractors at every tier map and vet supply chains, with 15-day and 45-day clocks. What is in force now.
- How primes check their suppliers' cybersecurityHow a prime verifies subcontractor cybersecurity: what DFARS 7012 and 7021 flow down, who can see a SPRS score, what to ask for, why a signed record matters.
- C-SCRM for a mid-tier defense prime: NIST SP 800-161 in practiceWhat NIST SP 800-161 Rev 1 and SP 1326 ask of a defense prime's supply chain program, what CMMC Level 2 does and does not require, and what to do this quarter.
Running a supplier program
- A DFARS 7012 supplier questionnaire: what to ask and whyThe 21 questions of a DFARS 252.204-7012 supplier cybersecurity questionnaire, the clause or rule each maps to, why it matters, and what a signed answer is not.
- Running a supplier cyber risk register at a defense primeA supplier cyber risk register for a defense prime: what to record per risk, the clocks the rules set (EO 14415, DFARS 7012, POA&M), a template, and closeout.
- What to show a contracting officer about your suppliers' cybersecurityEvidence of flowdown compliance: what DFARS 7012, 7021 and 252.240-7997 let DoD ask for, which records show supplier oversight, and what an audit package holds.
- How to find a company's subcontractors on USAspending.govUSAspending.gov Advanced Search in its Subawards view: what FFATA makes a prime report, the $40,000 threshold, what is missing, and a SAM.gov UEI lookup.
Reference
Still have a question?
Write to help@tiermark.io and a person will answer.