The quickest way to tell if compliance is a requirement of your contracts is to look for the DFARS clauses governing the protection of CUI in your contracts. They are: – DFARS 252.204-7012 Requirement for NIST 800-171a Compliance   – DFARS 252.204-7019 Requirement to submit self-assessment score for NIST 800-171a to the SPRS database – DFARS 252.204-7020 Requirement for contractors to have an SSP (System Security Plan) and a self- assessment score no more then 3 years old – DFARS 252.204-7021 Contractor must be CMMC certified to the level specified by the contract at the time of award