Open SBIR and STTR topics

Level 1

Basic protection of Federal Contract Information: the 15 requirements of FAR 52.204-21. You assess yourself every year and post the result in SPRS.

Level 2

Protection of Controlled Unclassified Information: the 110 requirements of NIST SP 800-171 Rev. 2. "Self" means you assess yourself every three years; "C3PAO" means an accredited third-party assessor certifies you every three years. Both need a yearly affirmation.

Level 3

Level 2 certification plus 24 selected requirements of NIST SP 800-172, assessed by the government (DIBCAC) every three years.

CMMC is the Defense Department's cybersecurity certification; a topic that lists a level expects it by the time of award. This is a summary: the solicitation and 32 CFR Part 170 govern.