{"asOf":"2026-09-05","merchant":"SSDF INC","kind":"clerk","id":"nist","title":"NIST","kicker":"The control clerk","body":"SP 800-171 Rev 2 is the CMMC Level 2 baseline (32 CFR 170.14). Rev 3 (May 2024) exists and has OSCAL content; DoD has not incorporated Rev 3 into CMMC. SP 800-171A is the assessment procedure. OSCAL is the machine-readable format. NIST publishes this for free.","url":"https://csrc.nist.gov/pubs/sp/800/171/r2/final","ssdf":"SSDF does not sell the 110 controls as a how-to. That clerk already published them."}