{"asOf":"2026-09-05","merchant":"SSDF INC","disclaimer":"SSDF maps defense-acquisition clerks (SAM, CAGE, SPRS, Cyber AB, DCSA, DDTC, NIST, eCFR), CMMC phase status including the 13 July 2026 Phase 2 pause, and FY26 NDAA NDC/CAS relief. SSDF is not a defense contractor, not a C3PAO, not a CMMC consultant, and not a DDTC registrant.","live":{"human":"/defense","index":"/api/defense","card":"/api/defense/{slug}"},"objects":[{"object":"CUI / FCI","holder":"The contractor who processes it, under DFARS 252.204-7012 and 32 CFR 170","sells":"Nothing. SSDF does not receive CUI."},{"object":"ITAR technical data / USML article","holder":"DDTC registrant. License or exception before export.","sells":"A map of who the clerk is. Not a DS-2032. Not a CJ request."},{"object":"First-party SKU","holder":"SSDF INC, merchant of record","sells":"This atlas, and a Passport over the purchase."}],"hardRules":["SSDF is a Florida C-Corp merchant of record. SSDF is not a defense contractor, not a C3PAO, not a CMMC consultant, and not a DDTC registrant.","The clerks are SAM (UEI), DLA (CAGE), SPRS, Cyber AB, DCSA, DDTC, NIST, and the FAR/DFARS text on eCFR. SSDF is none of them.","CMMC Level 2 is NIST SP 800-171 Revision 2, identically. NIST already publishes the controls. OSCAL is the machine-readable clerk. This atlas does not restatement the 110 practices.","CMMC Phase 1 (self-assessment) took effect 10 November 2025. Phase 2 (C3PAO as a condition of award) was paused 13 July 2026. Do not sell a roadmap that still treats 10 November 2026 as a hard C3PAO date.","A Passport attests that a buyer paid this SKU. It does not attest CMMC status, a SPRS score, a facility clearance, or that the buyer handles CUI.","SSDF SKUs are commercial digital files about public rules. They are not CUI and are not ITAR technical data. The powered-lift atlas is a public-process map, not a defense article.","Map the clerks. Do not certify compliance. Do not handle CUI. Do not export a defense article."],"clerks":[{"id":"sam","title":"SAM.gov / UEI","kicker":"The registration clerk"},{"id":"cage","title":"CAGE code (DLA)","kicker":"The identity number"},{"id":"sprs","title":"SPRS","kicker":"The scoreboard"},{"id":"cyber_ab","title":"Cyber AB","kicker":"The C3PAO marketplace"},{"id":"dcsa","title":"DCSA","kicker":"Facility clearance"},{"id":"ddtc","title":"DDTC / ITAR","kicker":"The export clerk"},{"id":"nist","title":"NIST","kicker":"The control clerk"},{"id":"ecfr","title":"eCFR (FAR / DFARS / 32 CFR 170)","kicker":"The text"}],"roles":[{"id":"buyer","title":"DoD / DoW contracting officer","kicker":"The buyer"},{"id":"prime","title":"Prime contractor","kicker":"Flows the clause down"},{"id":"sub","title":"Subcontractor / supplier","kicker":"Same CUI, smaller firm"},{"id":"c3pao","title":"C3PAO","kicker":"The assessor"},{"id":"small_ndc","title":"Small business / NDC","kicker":"FY26 NDAA relief"},{"id":"merchant","title":"Commercial digital merchant","kicker":"This store"}],"events":[{"id":"cmmc-32cfr","date":"2024-12-16","title":"32 CFR Part 170 in force","kicker":"Program rule","status":"in_force"},{"id":"dfars-final","date":"2025-09-10","title":"DFARS CMMC acquisition rule published","kicker":"48 CFR","status":"in_force"},{"id":"phase-1","date":"2025-11-10","title":"CMMC Phase 1 begins","kicker":"Self-assessment at award","status":"in_force"},{"id":"ndaa-fy26","date":"2025-12-18","title":"FY2026 NDAA signed","kicker":"NDC and CAS thresholds","status":"in_force"},{"id":"phase-2-pause","date":"2026-07-13","title":"CMMC Phase 2 paused","kicker":"C3PAO-at-award on hold","status":"paused"}],"tam":{"title":"Do not confuse the TAMs","sipri2025UsdTn":"2.887"},"sku":"ssdf-defense-atlas","doctrine":{"surface":"DoD is the buyer. SAM, CAGE, SPRS, Cyber AB, DCSA, DDTC, NIST, and the FAR/DFARS text are the clerks. SSDF publishes a machine-readable atlas of that surface, including CMMC Phase 1 in force and the 13 July 2026 Phase 2 pause.","filter":"Map the clerks. Credential the purchase. Do not become the contractor, the C3PAO, or the exporter. That is the title-file rule on a different clerk.","phase":"Phase 1 self-assessment remains. Phase 2 C3PAO-at-award is paused. NIST 800-171 Rev 2 is still the Level 2 baseline. OSCAL is already the machine-readable control clerk — this SKU does not restate the 110 practices.","itar":"SSDF SKUs are commercial digital files about public rules. They are not CUI and are not ITAR technical data. SSDF is not a DDTC registrant."}}