Terms / The contract
32 CFR Part 170
The regulation that creates the CMMC Program: the levels, the assessment types, the scoping rules, and the affirmation you sign each year.
Also called 32 CFR 170, Part 170, the CMMC Program rule.
Official Source Material
This part describes the Cybersecurity Maturity Model Certification (CMMC) Program of the Department of Defense (DoD) and establishes requirements for defense contractors and subcontractors to implement prescribed cybersecurity standards for safeguarding Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).
Source: 32 CFR 170.1(a), eCFR text current as of September 17, 2026
Practitioner Guidance
What it means in practice
This is the rule that answers almost every CMMC question you have.
32 CFR Part 170 is the CMMC program rule. It defines the vocabulary in 170.4 and sets the requirements for each level in 170.15 through 170.18. It governs scoping in 170.19 and plans of action in 170.21. It requires the annual affirmation in 170.22 and handles suppliers in 170.23. When someone tells you what CMMC requires, ask which section of Part 170 says so. The rule is freely readable, and most disagreements end when you open it.
The rule describes the program, and a separate clause binds you to it.
Part 170 sits in Title 32, the national defense title, and it speaks to how DoD runs the program. DFARS 252.204-7021 sits in 48 CFR (the DFARS rule) and is what actually appears in your contract. The two work together. Part 170 tells you what a Level 2 assessment is. The clause tells you that this contract requires one.
Two sections decide most of your cost before you write a policy.
Section 170.19 sets out the asset categories and how your CMMC assessment scope is drawn. Section 170.21 sets out which requirements you may leave open on a plan of action and for how long. Read both before you buy anything. A scope decision made from 170.19 saves more money than any product you can buy.
No one may waive these requirements for you.
Section 170.5 reserves waivers to the Government, and a waiver applies to an entire contract before solicitation rather than to a single company. Your customer cannot grant you one. A prime contractor cannot grant you one. If someone offers to waive CMMC for you, they are describing something that does not exist.
What falls short
- A compliance plan built from a vendor's summary of the rule. The sections are short and numbered, and the citation belongs in your own documentation.
- A scope decision made after buying tools. Section 170.19 defines the asset categories the assessor will use, so the categories come first.
- An assumption that Part 170 applies only at Level 2. Section 170.15 sets out Level 1 and its annual self-assessment, and the affirmation in 170.22 applies there too.
Edge cases
- Your contract predates the CMMC clause. Part 170 governs the program, but your obligation arrives through the clause in your contract, so check whether DFARS 252.204-7012 alone applies to you today.
- A prime asks for a level higher than 170.23 requires. Cite the subsection. A supplier handling Controlled Unclassified Information under a Level 3 prime contract needs Level 2 (C3PAO), not Level 3.
- Your work is exclusively commercially available off-the-shelf items. Section 170.3 excludes contracts solely for those items from the program requirements.
Over-engineering
- A gap analysis against every section of the rule. Most of Part 170 governs assessors, the accreditation body, and DoD itself, and only a handful of sections describe what you must do.
- A subscription service to tell you when the rule changes. The eCFR publishes the current text with its amendment history at no cost.