32 CFR Part 170: The CMMC Program Rule, Explained Section by Section

What does 32 CFR Part 170 cover?

The final rule made the CMMC program requirements effective on December 16, 2024. Part 170 explains the program. Contract clauses such as DFARS 252.204-7021 tell a contractor when a specific CMMC level is required.

The table is a reading map. Use the full eCFR text for the operative language.

What assessment types does the rule define?

Part 170 distinguishes assessment type from security requirement set. Level 1 Self assesses the 15 FAR 52.204-21 safeguarding requirements. Level 2 Self and Level 2 C3PAO assess the 110 NIST SP 800-171 Revision 2 requirements. Level 3 has its own assessment path and prerequisites. Four assessment types do not mean four separate sets of Level 2 controls.

As of September 30, 2026, the DoW CMMC page describes implementation as paused in Phase I. It says Level 1 and Level 2 Self assessments remain the levels that may be required in new designations. Keep the date with that statement because program policy can change.

What does the rule say about POA&Ms and affirmations?

Part 170 allows limited POA&Ms for specified Level 2 findings. Conditional status requires the required threshold and only eligible items on the POA&M. The closeout deadline is 180 days from the Conditional CMMC Status Date. § 170.22 requires an Affirming Official to affirm after the assessment and annually thereafter. A signature is not a substitute for evidence. It is a statement about the assessed scope and its continuing compliance.

What does the rule require for subcontractors?

Part 170 ties the subcontractor’s minimum level to the information it will process, store, or transmit and to the prime’s required level. The flowdown question starts with FCI or CUI and ends with the actual contractual requirement. A prime should not represent a marketplace listing or generic security claim as proof that a subcontractor has the status the subcontract requires.

How should you use the DoW CIO FAQ?

Use the DoW CMMC FAQ as dated agency guidance alongside the rule. The FAQ can explain agency practice. It does not amend a regulation or override a contract clause. Record the FAQ revision, publication date, and the rule section it addresses whenever you rely on it.

Example: a regulation, a memo and an unchanged contract

Consider a hypothetical contractor reading three documents. Part 170 describes the C3PAO assessment path. The July 13, 2026 implementing memo suspends new designations of that path. The contractor’s signed agreement still contains a third-party assessment requirement.

Those documents answer different questions. The program rule explains the assessment. The policy memo directs implementation changes. The incorporated contract remains the document the contractor needs to reconcile through the contracting channel.

Our recommended working note has three entries: the rule section, the dated implementation instruction, and the actual amendment or modification received. Mark an expected change as pending until the record shows what happened. Do not turn an announcement into a claim that a particular contract has already changed.

What should a contractor do with this rule?

Read the clause, identify the assessed system boundary, and build evidence to the requirements that apply today. Use the CMMC overview, self-assessment and C3PAO guide, and POA&M outcome guide for task-level detail. Keep future program changes as watch items rather than present obligations. Deep Fathom can organize the requirement, work, evidence, and review record. The contracting officer and assessor retain their separate decisions.

Don’t use the FAQ to replace the rule. Don’t use the rule to replace the clause in a real procurement. The DFARS 252.204-7012 guide explains that contract layer.