Expert CMMC · CMMC 2.13
Understand CMMC.
Make progress.
Learn what applies to your organization, understand each requirement, and build a clear plan for the work ahead. Start with public guidance, then organize your preparation in the workspace pilot.
Free · No credit card · Nothing to install
The point
Learn, define your scope, review requirements, and track the work.
Understand the requirements
Use the learning path and reference catalog to understand the terminology, requirements, and related NIST controls.
Public learning, free access
Start learning without an account. Sign in for additional reference tools and the workspace pilot when available.
Turn gaps into work
The workspace pilot connects scope, objective reviews, evidence references, and remediation tasks.
Prepare together
Assign responsibilities, review progress with your team, and turn implementation notes into draft documentation.
149
CMMC 2.13 practices
2,207
Supporting NIST controls
436
Cross-references mapped
The model
Browse CMMC 2.13 — by level and domain
Every CMMC practice, cross-referenced to the NIST SP 800-171, 800-172, and 800-53 controls that support it. Start with a maturity level, or jump straight to a domain.
By level
All 149 practices →15practices
Basic safeguarding of Federal Contract Information (FCI).
Browse Level 1110practices
Protecting Controlled Unclassified Information (CUI); aligned to NIST SP 800-171.
Browse Level 224practices
Reducing risk from advanced persistent threats; adds NIST SP 800-172 requirements.
Browse Level 3By domain
A worked example
One practice, mapped across every framework
This is a live record from the catalog — the same cross-references you get on every page.
Manage Visitors & Physical Access [FCI Data]
Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.
Get started
Start with one requirement. Build from there.
Use the learning path to understand your next step, then explore requirements and their reference material.