32 CFR 170 (CMMC Program): § 170.21 Plan of Action and Milestones requirements. amended 2024-12-16

32 CFR 170.24 establishes the CMMC scoring methodology, allowing partial credit for certain controls like MFA and FIPS implementation.

This section of the CMMC Program regulation outlines the methodology used to score contractor compliance with the CMMC Model. It specifically addresses how partial credit is awarded for controls such as Multi-Factor Authentication (MFA) and FIPS-compliant cryptographic modules, aligning with the broader CMMC assessment framework.

1. Understand and apply the CMMC scoring methodology, including partial credit rules for MFA and FIPS.
2. Ensure self-assessments and third-party assessments accurately reflect the scoring methodology.