Where the rules live
The official places to read each regulation and standard the tools are built on, how citations work and how to tell that what you are reading is current.
L.5.26 min readLast revised November 2026
On this page
Everything the tools and guides rest on has been officially released to the public, and all of it is free to read. This page lists where. Go to these sources, not to a summary, when you need to check a result or settle a disagreement.
On a network with no internet connection, none of these links will open. Bring the documents you need across through your organization’s own process.
Reading a citation#
A citation is an address. Once you can read one, you can find the text.
| Citation | How to read it |
|---|---|
| FAR 31.205-14 | Federal Acquisition Regulation, Part 31, Subpart 31.2, section 31.205, subsection 14 |
| FAR 52.232-25 | A FAR clause. Clauses and provisions are all in Part 52. The middle number, 232, points to the part that prescribes it: Part 32 |
| DFARS 252.204-7012 | A defense clause. Defense clauses are in Part 252, and their final number starts at 7000 |
| 48 CFR 31.205-14 | The same FAR section, cited by its place in the Code of Federal Regulations. The FAR is Title 48, Chapter 1 |
| 32 CFR Part 170 | Title 32 of the Code of Federal Regulations, Part 170 |
| 13 CFR 121.201 | Title 13, Part 121, section 201 |
| 10 U.S.C. 3014 | Title 10 of the United States Code, section 3014. This is a law passed by Congress, not a regulation |
| NIST SP 800-171 Rev. 2 | A NIST Special Publication, number 800-171, second revision |
| 91 FR 42594 | Volume 91 of the Federal Register, page 42594 |
Laws passed by Congress sit above regulations. Regulations sit above agency guidance. Your contract sits on top of all of them for your own work, because it says which of them apply to you.
- HighestYour contractThe specific contract clauses and dates that bind your project.
- StatutoryUnited States Code (U.S.C.)Acts of Congress establishing statutory mandates and thresholds.
- RegulatoryFederal Acquisition Regulation (FAR / 48 CFR)Government-wide codified acquisition baseline and agency supplements.
- Defense & AgencyDFARS and agency supplementsAgency-specific clauses and class deviations (e.g. DFARS 252.204-7012).
- Technical StandardsIncorporated standards (NIST, DISA, NARA)NIST SP 800-171, CUI Registry markings, and DISA STIGs.
- InformationalAgency guidance and FAQsHelpful explanations that yield to codified regulations if they conflict.
Acquisition regulations#
| Source | Where | What is there |
|---|---|---|
| Federal Acquisition Regulation | acquisition.gov/browse/index/far | The full FAR, searchable, with every clause |
| Defense FAR Supplement | acquisition.gov/dfars | The DFARS and its companion guidance |
| Other agency supplements | acquisition.gov | Each agency’s additions to the FAR |
| Code of Federal Regulations | ecfr.gov | Every federal regulation, updated daily, with a view of the text as of any past date |
| Federal Register | federalregister.gov | Proposed and final rules as they are published, with the reasoning behind them |
| United States Code | uscode.house.gov | The laws themselves |
Pricing, cost and payment#
| Source | Where | What is there |
|---|---|---|
| Cost principles | FAR Part 31, at acquisition.gov | What costs are allowable |
| Cost Accounting Standards | 48 CFR Chapter 99, at ecfr.gov | The standards and their exemptions |
| DCAA guidance for contractors | dcaa.mil | “Information for Contractors” and checklists for accounting systems and cost submissions |
| Prompt payment rules | 5 CFR Part 1315, at ecfr.gov | Due dates, proper invoices and interest formulas |
| Prompt Payment interest rate | fiscal.treasury.gov/prompt-payment | The current rate, every past rate and Treasury’s calculators |
| Wage determinations | SAM.gov | Minimum wages and benefits by job class and place |
| Travel rates | gsa.gov | Per diem rates for lodging and meals |
Security and compliance#
| Source | Where | What is there |
|---|---|---|
| NIST publications | csrc.nist.gov | SP 800-171, 800-171A, 800-172, 800-53 and the rest, with every revision |
| CMMC program rule | 32 CFR Part 170, at ecfr.gov | Levels, assessment rules and the scoring method |
| CMMC program pages | dodcio.defense.gov/CMMC | Assessment and scoping guides, and the current rollout schedule |
| CUI rule | 32 CFR Part 2002, at ecfr.gov | Government-wide rules for designating, marking and handling CUI |
| CUI Registry | archives.gov/cui | Every CUI category, with its authority and marking |
| DoD CUI program | dodcui.mil | Defense marking guidance and training |
| STIGs and SRGs | cyber.mil/stigs | The guides themselves and the viewer for reading them |
| OSCAL | pages.nist.gov/OSCAL | The models, schemas and NIST’s published catalogs in OSCAL form |
| Supplier Performance Risk System | sprs.csd.disa.mil | Where assessment results are entered, and its user guides |
Some defense sites limit access from outside the United States or ask for a certificate on parts of the site. The public pages listed here do not need one.
Registration, codes and small business#
| Source | Where | What is there |
|---|---|---|
| System for Award Management | SAM.gov | Registration, contract opportunities and entity records |
| NAICS | census.gov/naics | Every code, with its definition and a search |
| Product and Service Code Manual | acquisition.gov/psc-manual | Every PSC, with its description |
| Size standards | sba.gov | The table of size standards by NAICS code |
| Size and program regulations | 13 CFR Parts 121 to 128, at ecfr.gov | The rules for size, affiliation and each program |
| Past contract awards | usaspending.gov | What agencies bought, from whom, searchable by NAICS and PSC |
Is it current?#
A source can be official and still out of date on your screen. Four checks:
- Look for the date. The eCFR shows the date its text is current as of, at the top of each page. FAR pages show the acquisition circular and its effective date. NIST publications carry a publication date and a revision number.
- Check for something pending. A proposed rule in the Federal Register is not yet the rule, but it tells you a change is coming.
- Check for a deviation. Agencies can direct their contracting officers to depart from the published regulation by issuing a class deviation. Defense deviations are published with the DFARS.
- Check your contract. The version of a clause in your contract, identified by its date, is the version that binds you, even after the regulation changes.
To see what a regulation said on an earlier date, the eCFR has a point-in-time view. That is how you check a tool’s figure against the rule as it stood when the tool was written.
Guidance is not regulation#
Agencies publish a great deal of helpful material that is not binding: frequently asked questions, guidebooks, training slides, memos. It is often the clearest explanation available, and it can change without notice. When a tool or a guide relies on guidance instead of a regulation, it should say so. When guidance and the regulation conflict, the regulation governs.
What does not count as a source#
- A leaked document, or one marked for limited distribution that can be found online anyway. Public means officially released.
- A document from behind a login that you can reach because of your job.
- A consultant’s summary, a vendor’s white paper or a forum post, however accurate. They are useful for finding the rule. They are not the rule.
- A generated answer from a chat assistant or a search summary. Ask it where the rule is, then go and read the rule.
This project builds only from the first kind of material: officially released regulations, standards and guidance.
Report a dead or wrong link#
Government sites are reorganized often, and links here will break. If one does, or if a better official source exists, email [email protected] or open an issue on GitHub.
Found a mistake, or something that has gone out of date? Open an issue or write to [email protected]. This page is a text file you can read and correct: Source of this page.