A contractor stores security policies, system configuration files, and audit logs in a centralized file repository for later review. According to CMMC terminology, the file repository is being used to:
protect CUI.
transmit CUI.
store CUI.
generate CUI
A Lead Assessor is performing a CMMC readiness review. The Lead Assessor has already recorded the assessment risk status and the overall assessment feasibility. At MINIMUM, what remaining readiness review criteria should be verified?
Determine the practice pass/fail results.
Determine the preliminary recommended findings.
Determine the initial model practice ratings and record them.
Determine the logistics. Assessment Team, and the evidence readiness.
Understanding the CMMC Readiness Review Process
ALead Assessorconducting aCMMC Readiness Reviewevaluates whether anOrganization Seeking Certification (OSC)is prepared for a formal assessment.
After recording theassessment risk statusandoverall assessment feasibility, theminimum remaining criteriato be verified include:
Logistics Planning– Ensuring that the assessment timeline, locations, and necessary resources are in place.
Assessment Team Preparation– Confirming that assessors and required personnel are available and briefed.
Evidence Readiness– Ensuring the OSC has gathered all required artifacts and documentation for review.
Breakdown of Answer Choices
Option
Description
Correct?
A. Determine the practice pass/fail results.
Happensduringthe formal assessment, not the readiness review.
❌Incorrect
B. Determine the preliminary recommended findings.
Findings are only madeafterthe full assessment.
❌Incorrect
C. Determine the initial model practice ratings and record them.
Ratings are assigned during theassessment, not readiness review.
❌Incorrect
D. Determine the logistics, Assessment Team, and the evidence readiness.
✅Essential readiness criteria that must be confirmedbeforeassessment starts.
✅Correct
Official Reference from CMMC 2.0 Documentation
TheCMMC Assessment Process Guide (CAP)states that readiness review ensureslogistics, assessment team availability, and evidence readinessare verified.
Final Verification and Conclusion
The correct answer isD. Determine the logistics, Assessment Team, and the evidence readiness.This aligns withCMMC readiness review requirements.
When executing a remediation review, the Lead Assessor should:
help OSC to complete planned remediation activities.
plan two consecutive remediation reviews for an OSC.
submit a delta assessment remediation package for C3PAO ' s internal quality review.
validate that practices previously listed on the POA & M have been removed on an updated Risk Assessment.
In the context of the Cybersecurity Maturity Model Certification (CMMC) 2.0, the remediation review process is a critical phase where identified deficiencies from an initial assessment are addressed. The Lead Assessor, representing a Certified Third-Party Assessment Organization (C3PAO), plays a pivotal role in this process.
Role of the Lead Assessor in Remediation Reviews:
Validation of Remediation Efforts:
Objective: Ensure that the Organization Seeking Certification (OSC) has effectively addressed and corrected all deficiencies identified during the initial assessment.
Process: The Lead Assessor reviews the evidence provided by the OSC to confirm that each previously unmet practice now meets the required standards. This involves examining updated policies, procedures, system configurations, and other relevant artifacts.
Delta Assessment Remediation Package Submission:
Definition: A delta assessment focuses on evaluating only the components or practices that were previously found non-compliant or deficient.
Responsibility: After validating the remediation efforts, the Lead Assessor compiles a remediation package that includes:
Detailed documentation of the deficiencies identified in the initial assessment.
Evidence of the corrective actions taken by the OSC.
Findings from the reassessment of the remediated practices.
Internal Quality Review: This remediation package is then submitted for the C3PAO ' s internal quality review process. The purpose of this review is to ensure the accuracy, completeness, and consistency of the assessment findings before finalizing the certification decision.
Rationale for Selecting Answer C:
Alignment with CMMC Assessment Process: The submission of a delta assessment remediation package for internal quality review is a standard procedure outlined in the CMMC Assessment Process. This step ensures that all remediated items are thoroughly evaluated and validated, maintaining the integrity of the certification process.
Clarification of Incorrect Options:
Option A: " Help OSC to complete planned remediation activities. "
The Lead Assessor ' s role is to assess and validate the OSC ' s compliance, not to assist in the implementation or completion of remediation activities. Providing such assistance could lead to a conflict of interest and compromise the objectivity of the assessment.
Option B: " Plan two consecutive remediation reviews for an OSC. "
The standard process involves conducting a single remediation review after the OSC has addressed the identified deficiencies. Planning multiple consecutive remediation reviews is not a typical practice and could indicate a lack of proper remediation planning by the OSC.
Option D: " Validate that practices previously listed on the POA & M have been removed on an updated Risk Assessment. "
While it ' s essential to ensure that deficiencies are addressed, the primary focus of the Lead Assessor during a remediation review is to validate the implementation of remediated practices. Updating the Risk Assessment is the responsibility of the OSC ' s internal risk management team, not the Lead Assessor.
A CMMC Assessment is being conducted at an OSC ' s HQ. which is a shared workspace in a multi-tenant building. The OSC is renting four offices on the first floor that can be locked individually. The first-floor conference room is shared with other tenants but has been reserved to conduct the assessment. The conference room has a desk with a drawer that does not lock. At the end of the day, an evidence file that had been sent by email is reviewed. What is the BEST way to handle this file?
Review it. print it, and put it in the desk drawer.
Review it, and make notes on the computer provided by the client.
Review it, print it, make notes, and then shred it in cross-cut shredder in the print room.
Review it. print it, and leave it in a folder on the table together with the other documents.
In the context of the Cybersecurity Maturity Model Certification (CMMC) 2.0, particularly at Level 2, organizations are required to implement stringent controls to protect Controlled Unclassified Information (CUI). This includes adhering to specific practices related to media protection and physical security.
Media Protection (MP):
MP.L2-3.8.1 – Media Protection: Organizations must protect (i.e., physically control and securely store) system media containing CUI, both paper and digital. This ensures that sensitive information is not accessible to unauthorized individuals.
Defense Innovation Unit
MP.L2-3.8.3 – Media Disposal: It is imperative to sanitize or destroy information system media containing CUI before disposal or release for reuse. This practice prevents potential data breaches from discarded or repurposed media.
Defense Innovation Unit
Physical Protection (PE):
PE.L2-3.10.2 – Monitor Facility: Organizations are required to protect and monitor the physical facility and support infrastructure for organizational systems. This includes ensuring that areas where CUI is processed or stored are secure and access is controlled.
Defense Innovation Unit
Application to the Scenario:
Given that the Organization Seeking Certification (OSC) operates within a shared, multi-tenant building and utilizes a common conference room for assessments, the following considerations are crucial:
Reviewing the Evidence File: The evidence file, which contains CUI, should be reviewed on a secure, authorized device to prevent unauthorized access or potential data leakage.
Printing the Evidence File: If printing is necessary, ensure that the printer is located in a secure area, and the printed documents are retrieved immediately to prevent unauthorized viewing.
Making Notes: Any notes derived from the evidence file should be treated with the same level of security as the original document, especially if they contain CUI.
Disposal of Printed Materials: After the assessment, all printed materials and notes containing CUI must be destroyed using a cross-cut shredder. Cross-cut shredding ensures that the information cannot be reconstructed, thereby maintaining confidentiality.
totem.tech
Options A and D are inadequate as they involve leaving sensitive information in unsecured locations, which violates CMMC physical security requirements. Option B, while secure in terms of digital handling, does not address the proper disposal of any physical copies that may have been made. Therefore, Option C is the best practice, aligning with CMMC 2.0 guidelines by ensuring that all physical media containing CUI are properly reviewed, securely stored during use, and thoroughly destroyed when no longer needed.
What are CUI protection responsibilities?
Shielding
Governing
Correcting
Safeguarding
Understanding CUI Protection Responsibilities
Controlled Unclassified Information (CUI)is sensitive butnot classifiedinformation that requires protection underDoD Instruction 5200.48andDFARS 252.204-7012.
Theprimary responsibilityfor handling CUIis safeguardingit against unauthorized access, disclosure, or modification.
Why " D. Safeguarding " is Correct?
TheCUI Program (as per NARA and DoD)mandatessafeguarding measuresto protectCUI in both digital and physical forms.
CMMC 2.0 Level 2 (Advanced) practices align with NIST SP 800-171, which focuses on safeguarding CUIthrough access controls, encryption, and monitoring.
DFARS 252.204-7012requires DoD contractors to implementcybersecurity safeguardsto protect CUI.
Why Other Answers Are Incorrect?
A. Shielding (Incorrect)–Shieldingis not a cybersecurity term associated with CUI protection.
B. Governing (Incorrect)–Governing refers to policy-making, not direct protection.
C. Correcting (Incorrect)–Correcting implies remediation, but the primary responsibility is tosafeguardCUI proactively.
Conclusion
The correct answer isD. Safeguarding, asCUI protection focuses on implementing cybersecurity safeguards.
As defined in the CMMC-AB Code of Professional Conduct, what term describes any contract between two legal entities?
Union
Accord
Alliance
Agreement
Understanding the Definition of an Agreement in the CMMC-AB Code of Professional Conduct
TheCMMC-AB Code of Professional Conductdefines anagreementasany contract between two legal entities. This includes:
✔Contracts between an OSC and a C3PAOfor CMMC assessments.
✔Service agreements between cybersecurity providers and defense contractors.
✔Any formal, legally binding arrangement related to CMMC compliance.
Why is the Correct Answer " D. Agreement " ?
A. Union → Incorrect
Auniontypically refers to anorganization representing workersand is not used to describe acontractual relationship.
B. Accord → Incorrect
While anaccordcan mean an agreement, it isnot the standard legal term for a binding contractin CMMC documentation.
C. Alliance → Incorrect
Analliancerefers to astrategic partnership, but does not necessarily imply alegally binding contract.
D. Agreement → Correct
TheCMMC-AB Code of Professional Conductdefines anagreementas anylegally binding contract between two entities.
CMMC 2.0 References Supporting This Answer:
CMMC-AB Code of Professional Conduct
Defines " Agreement " as alegally binding contract between two parties.
CMMC-AB Licensed Training and Assessment Provider Guidelines
Requires that all engagementsbe governed by a formal agreement (contract) between the parties.
DFARS and CMMC Certification Contracts
States thatOSC-C3PAO relationships must be formalized through a legal agreement.
When assessing SI.L2-3.14.6: Monitor communications for attack, the CCA interviews the person responsible for the intrusion detection system and examines relevant policies and procedures for monitoring organizational systems. What would be a possible next step the CCA could conduct to gather sufficient evidence?
Conduct a penetration test
Interview the intrusion detection system ' s supplier.
Upload known malicious code and observe the system response.
Review an artifact to check key references for the configuration of the IDS or IPS practice for additional guidance on intrusion detection and prevention systems.
Understanding SI.L2-3.14.6: Monitor Communications for Attacks
The practiceSI.L2-3.14.6fromNIST SP 800-171(aligned with CMMC Level 2) requires an organization tomonitor organizational communications for indicators of attack. This typically includes:
✅Intrusion Detection Systems (IDS)andIntrusion Prevention Systems (IPS)
✅Log analysis and network monitoring
✅Incident response planningfor detected threats
As part of aCMMC Level 2 assessment, theCertified CMMC Assessor (CCA)must ensure that theOSC (Organization Seeking Certification)hasproperly implemented and documenteditsmonitoring capabilities.
Why " Review an artifact to check key references for the configuration of the IDS or IPS " is Correct?
TheCCA must collect sufficient objective evidenceto determine compliance.
Reviewing anartifact(such as system configurations, IDS/IPS logs, or security policies)helps validatethat intrusion detection is properly implemented.
Configuration settings providedirect evidenceof whethermonitoring for attacksis effectively applied.
Breakdown of Answer Choices
Option
Description
Correct?
A. Conduct a penetration test
❌Incorrect–Penetration testing isnot requiredfor CMMC Level 2 assessments and falls outside an assessor ' s responsibilities.
B. Interview the intrusion detection system ' s supplier.
❌Incorrect–Thesupplier does not determine compliance; the assessor needs evidence from theOSC’s implementation.
C. Upload known malicious code and observe the system response.
❌Incorrect–This would beinvasive testing, which isnot part of a CMMC assessment.
D. Review an artifact to check key references for the configuration of the IDS or IPS practice for additional guidance on intrusion detection and prevention systems.
✅Correct – Reviewing system artifacts provides direct evidence of compliance with SI.L2-3.14.6.
Official References from CMMC 2.0 and NIST SP 800-171 Documentation
NIST SP 800-171 SI.L2-3.14.6– Requires monitoring communications for attack indicators.
CMMC Assessment Process Guide (CAP)– Describesartifact reviewas an essential assessment method.
Final Verification and Conclusion
The correct answer isD. Review an artifact to check key references for the configuration of the IDS or IPS practice for additional guidance on intrusion detection and prevention systems.
This aligns withCMMC 2.0 Level 2 assessment requirementsandSI.L2-3.14.6 compliance verification.
In the CMMC Model, how many practices are included in Level 1?
15 practices
17 practices
72 practices
110 practices
CMMC (Cybersecurity Maturity Model Certification) 2.0 Level 1 is designed to protectFederal Contract Information (FCI)and consists of17 foundational cybersecurity practices. These practices are directly derived fromFAR 52.204-21(Basic Safeguarding of Covered Contractor Information Systems), which outlines minimum security requirements for contractors handling FCI.
Breakdown of CMMC Level 1 Practices
The17 practicesin Level 1 focus on basic cybersecurity hygiene and fall under the following6 domains:
Access Control (AC)– 4 practices
AC.L1-3.1.1: Limit system access to authorized users
AC.L1-3.1.2: Limit user access to authorized transactions and functions
AC.L1-3.1.20: Verify and control connections to external systems
AC.L1-3.1.22: Control information posted or processed on publicly accessible systems
Identification and Authentication (IA)– 2 practices
IA.L1-3.5.1: Identify and authenticate system users
IA.L1-3.5.2: Use multifactor authentication for local and network access
Media Protection (MP)– 1 practice
MP.L1-3.8.3: Sanitize media before disposal or reuse
Physical Protection (PE)– 4 practices
PE.L1-3.10.1: Limit physical access to systems containing FCI
PE.L1-3.10.3: Escort visitors and monitor visitor activity
PE.L1-3.10.4: Maintain audit logs of physical access
PE.L1-3.10.5: Control and manage physical access devices
System and Communications Protection (SC)– 2 practices
SC.L1-3.13.1: Monitor and control communications at system boundaries
SC.L1-3.13.5: Implement subnetworks for publicly accessible system components
System and Information Integrity (SI)– 4 practices
SI.L1-3.14.1: Identify, report, and correct system flaws in a timely manner
SI.L1-3.14.2: Provide protection from malicious code at designated locations
SI.L1-3.14.4: Update malicious code protection mechanisms periodically
SI.L1-3.14.5: Perform scans of system components and real-time file scans
Official Reference from CMMC 2.0 Documentation
The 17 practices forCMMC Level 1are explicitly listed in theCMMC 2.0 Appendices and Assessment Guide for Level 1, as well as in theFAR 52.204-21 requirements. These practices representbasic safeguarding measuresthat all DoD contractors handlingFCImust implement.
???? CMMC 2.0 Level 1 Summary:
Focus:Basic safeguarding of FCI
Total Practices:17
Derived From:FAR 52.204-21
Assessment Type:Self-assessment (annual)
Final Verification and Conclusion
The correct answer isB. 17 practicesas verified from theCMMC 2.0 official documentsandFAR 52.204-21 requirements.
A cyber incident is discovered that affects a covered contractor IS and the CDI residing therein. How long does the contractor have to inform the DoD?
24 hours
48 hours
72 hours
96 hours
Contractors that handle Covered Defense Information (CDI) are required to report cyber incidents to the Department of Defense within 72 hours of discovery.
Supporting Extracts from Official Content:
DFARS 252.204-7012(c)(1): “When the Contractor discovers a cyber incident that affects a covered contractor information system or the covered defense information residing therein, the Contractor shall conduct a review… and rapidly report the cyber incident to DoD within 72 hours of discovery.”
Why Option C is Correct:
The regulation explicitly specifies 72 hours.
Options A (24 hrs), B (48 hrs), and D (96 hrs) do not align with DFARS requirements.
References (Official CMMC v2.0 Content and Source Documents):
DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting.
CMMC v2.0 Governance – Source Documents list includes DFARS 252.204-7012.
===========
A server is used to store FCI with a cloud provider long-term. What is the server considered?
In scope, because the cloud provider will be storing the FCI data
Out of scope, because the cloud provider stores the FCI data long-term
In scope, because the cloud provider is required to be CMMC Level 2 certified
Out of scope, because encryption is always used when the cloud provider stores the FCI data
Assets that store, process, or transmit FCI or CUI are always in scope for CMMC. If a server with a cloud provider is used for long-term storage of FCI, that server is considered in scope because it directly holds covered data.
Supporting Extracts from Official Content:
CMMC Scoping Guide for Level 1: “Assets that store, process, or transmit FCI are in scope.”
CMMC Scoping Guide for Level 2: confirms the same rule applies for CUI.
Why Option A is Correct:
The server stores FCI, making it automatically in scope.
Option B is incorrect because long-term storage does not make an asset out of scope.
Option C is incorrect — Level 1 (FCI) does not require a Level 2 certified provider.
Option D is incorrect because encryption does not remove scope requirements.
References (Official CMMC v2.0 Content):
CMMC Scoping Guide, Level 1.
CMMC Model v2.0, Scoping and Implementation guidance.
===========
During an assessment, the Lead Assessor reviews the evidence for each CMMC in-scope practice that has been reviewed, verified, rated, and discussed with the OSC during the daily reviews. The Assessment Team records the final recommended MET or NOT MET rating and prepares to present the results to the assessment participants during the final review with the OSC and sponsor. As a part of this presentation, which document MUST include the attendee list, time/date, location/meeting link, results from all discussed topics, including any resulting actions, and due dates from the OSC or Assessment Team?
Final log report
Final CMMC report
Final and recorded OSC CMMC report
Final and recorded Daily Checkpoint log
Understanding the Final Review Process in a CMMC Assessment
During aCMMC Level 2 Assessment, theAssessment Teamand theOrganization Seeking Certification (OSC)holddaily checkpoint meetingsto discuss progress, review evidence, and ensure transparency.
At theend of the assessment, afinal review meetingis conducted, during which theLead Assessor presents the results. Therecorded Daily Checkpoint logserves as theofficial document summarizing:
Theattendee list
Time, date, and locationof the final review
Final MET or NOT MET ratingsfor all practices
Discussion points, resulting actions, and due datesfor both the OSC and Assessment Team
Why " D. Final and recorded Daily Checkpoint log " is Correct?
TheCMMC Assessment Process (CAP) Guidespecifies that all assessment findings and discussions must bedocumented throughout the assessment in daily checkpoint logs.
TheFinal and Recorded Daily Checkpoint Logincludes all necessary details, such as attendee lists, discussion topics, and action items.
This document isused to ensure all discussed topics and agreed-upon actions are properly tracked and recordedbefore submission.
Why Other Answers Are Incorrect?
A. Final log report (Incorrect)
There isno specific " Final Log Report " required in CMMC assessments.
B. Final CMMC report (Incorrect)
TheFinal CMMC Reportdocuments the overall assessment results butdoes not serve as the official meeting logfor the final review discussion.
C. Final and recorded OSC CMMC report (Incorrect)
This documentdoes not include detailed discussion points from the daily checkpoint meetings.
Conclusion
The correct answer isD. Final and recorded Daily Checkpoint log, as this is the official document that captures thefinal meeting details, discussions, and action items.
A machining company has been awarded a contract with the DoD to build specialized parts. Testing of the parts will be done by the company using in-house staff and equipment. For a Level 1 Self-Assessment, what type of asset is this?
CUI Asset
In-scope Asset
Specialized Asset
Contractor Risk Managed Asset
According to the CMMC Scoping Guidance, Level 1, the categorization of assets is much simpler than at Level 2. At Level 1, there are only two primary categories for assets within the Organization Seeking Certification (OSC): In-Scope Assets (FCI Assets) and Out-of-Scope Assets.
FCI Asset Definition: An asset is considered " In-Scope " for Level 1 if it processes, stores, or transmits Federal Contract Information (FCI). Since the company is building specialized parts under a DoD contract and using in-house staff and equipment for testing, the information related to that contract (the specifications, schedules, and test results) constitutes FCI.
The Level 1 Universe:
Level 1 does not use the complex sub-categories found in Level 2 scoping, such as " Specialized Assets " (OT/IoT/Test Equipment) or " Contractor Risk Managed Assets. " Those distinctions are specific to CMMC Level 2 Scoping.
In a Level 1 environment, any piece of equipment or software that handles the contract ' s information is simply termed an FCI Asset, which falls under the broader umbrella of In-Scope Assets.
Why other options are incorrect:
Option A (CUI Asset): Level 1 is focused exclusively on FCI. CUI (Controlled Unclassified Information) is the focus of Level 2 and Level 3.
Option C (Specialized Asset) and Option D (Contractor Risk Managed Asset): These are specific scoping categories defined in the CMMC Level 2 Scoping Guidance. In Level 1, these categories do not exist; an asset either handles FCI (In-Scope) or it does not (Out-of-Scope).
Reference Documents:
CMMC Scoping Guidance, Level 1 (Version 2.0): Section 2.0 (CMMC Level 1 Asset Categories), which defines FCI Assets and Out-of-Scope Assets.
32 CFR Part 170 (CMMC Program Rule): Establishes the simplified scoping requirements for Level 1 self-assessments.
CMMC Level 1 Assessment Guide: Clarifies that the scope includes all " information systems " (including test equipment) used by the contractor to process, store, or transmit FCI.
An assessor needs to get the most accurate answers from an OSC ' s team members. What is the BEST method to ensure that the OSC ' s team members are able to describe team member responsibilities?
Interview groups of people to get collective answers.
Understand that testing is more important that interviews.
Ensure confidentiality and non-attribution of team members.
Let team members know the questions prior to the assessment.
During aCMMC assessment, assessors rely on interviews to validate the implementation of cybersecurity practices within anOrganization Seeking Certification (OSC). Ensuringconfidentiality and non-attributionallows employees to speak freely without fear of retaliation or bias, leading to more accurate and candid responses.
Step-by-Step Breakdown:
CMMC Assessment Process and the Role of Interviews
TheCMMC Assessment Guide(Level 2) states thatinterviews are a key methodto verify compliance with security controls.
Employees may hesitate to provide truthful information if they fear negative consequences.
To obtain accurate information, assessors must create an environment where team members feel safe.
Ensuring Non-Attribution for Accurate Responses
DoD Assessment Methodologyhighlights thatinterviewees should remain anonymousin reports.
Non-attribution reduces the risk of OSC leadership influencing responses or retaliating against employees.
Employees are more likely to provideaccurateandhonestdescriptions of their responsibilities when confidentiality is guaranteed.
Why the Other Answer Choices Are Incorrect:
(A) Interview groups of people to get collective answers:
Group interviews may limit honest responses due topeer pressure or management presence.
Employees mayhesitate to contradictsupervisors or peers in a group setting.
(B) Understand that testing is more important than interviews:
While testing (e.g., reviewing logs, configurations, and security settings) is crucial, interviews providecontexton how security practices are implemented and followed.
Interviewscomplementtesting rather than being less important.
(D) Let team members know the questions prior to the assessment:
Advanced notice may allow employees toprepare rehearsed answers, which might not reflect actual practices.
This couldreduce the effectivenessof the interview process.
Final Validation from CMMC Documentation:
TheCMMC Assessment Process Guideand DoDAssessment Methodologyemphasize the importance of confidentiality in interviews to ensure accuracy.Non-attribution protects employees and ensures assessors get honest, unfiltered answers.
Thus, the correct answer is:
C. Ensure confidentiality and non-attribution of team members.
Which CMMC Levels focus on protecting CUI from exfiltration?
Levels 1 and 2
Levels 1 and 3
Levels 2 and 3
Levels 1, 2, and 3
Level 1 only addresses the protection of Federal Contract Information (FCI) and does not include requirements for safeguarding Controlled Unclassified Information (CUI).
Level 2 is explicitly designed to protect Controlled Unclassified Information (CUI). It requires implementation of all 110 security requirements from NIST SP 800-171 Rev. 2, which directly support the safeguarding of CUI and help prevent its unauthorized disclosure or exfiltration.
Level 3 builds on Level 2 by including a subset of requirements from NIST SP 800-172. These additional practices are designed to enhance the protection of CUI against advanced persistent threats (APTs), further strengthening defenses against exfiltration.
Therefore, the levels that focus on protecting CUI from exfiltration are Levels 2 and 3.
Reference Documents:
CMMC Model v2.0 Overview (DoD, December 2021)
NIST SP 800-171 Rev. 2,Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
NIST SP 800-172,Enhanced Security Requirements for Protecting Controlled Unclassified Information
Contractor scoping requirements for a CMMC Level 2 Assessment to document the asset in an inventory, in the SSP and on the network diagram apply to:
GUI Assets.
CUI and Security Protection Asset categories.
all asset categories except for the Out-of-scope Assets.
Contractor Risk Managed Assets and Specialized Assets.
According to the CMMC Scoping Guidance, Level 2, assets are categorized to determine the level of assessment rigor required. The requirement to document an asset in the Asset Inventory, the System Security Plan (SSP), and on the Network Diagram is a specific administrative requirement for high-priority asset classes.
CUI Assets: These are assets that process, store, or transmit Controlled Unclassified Information (CUI). They are part of the " Assessed " group and must be fully documented in the inventory, SSP, and network diagram.
Security Protection Assets (SPA): These are assets that provide security functions or capabilities to the assessment scope (e.g., firewalls, log servers, or AV management consoles), even if they do not process CUI themselves. Because they are critical to the security of CUI, they must also be documented in the inventory, SSP, and network diagram.
Why other options are incorrect:
Option A: " GUI Assets " is likely a typo or misnomer in this context (possibly meant to refer to CUI assets or a distractor).
Option C: This is incorrect because Contractor Risk Managed Assets (CRMA) and Specialized Assets have different documentation requirements. For instance, while CRMA are documented in the inventory and SSP, they are often not required to be on the network diagram in the same detail as CUI assets, depending on the specific assessment boundary. Out-of-Scope Assets are not documented at all.
Option D: Contractor Risk Managed Assets (CRMA) and Specialized Assets (like IoT, OT, or Restricted Information Systems) are required to be in the Asset Inventory and SSP, but the CMMC Scoping Guidance specifies that the most stringent documentation (Inventory + SSP + Network Diagram) is the primary mandate for those assets directly handling CUI or protecting it (SPAs).
Reference Documents:
CMMC Scoping Guidance, Level 2 (Version 2.0/2.1): Section 3.0, Table 1 (CUI Assets) and Table 2 (Security Protection Assets), which explicitly list the " Documentation Requirements " for each category.
CMMC Assessment Process (CAP): Section on Scoping Boundaries and Evidence Validation.
Which DFARS clause considers Safeguarding CDI and Cyber Incident Reporting?
252.204-7022
252.204-7020
252.204-7012
252.204-7021
The correct answer is C because DFARS 252.204-7012 is explicitly titled “Safeguarding Covered Defense Information and Cyber Incident Reporting.” This clause is one of the core governance and source-document foundations for CMMC because it establishes contractor obligations for protecting covered defense information, including CUI/CDI, on covered contractor information systems. It defines covered contractor information systems as unclassified systems owned or operated by or for a contractor that process, store, or transmit covered defense information. It also requires contractors to provide adequate security and implement NIST SP 800-171 security requirements where applicable. In addition, it requires contractors to rapidly report cyber incidents affecting covered contractor systems or covered defense information, with “rapidly report” defined as within 72 hours of discovery. Options A, B, and D are not the clause titled for safeguarding CDI and cyber incident reporting. DFARS 252.204-7020 relates to NIST SP 800-171 DoD assessment requirements, while DFARS 252.204-7021 addresses CMMC requirements. Reference/topics: DFARS 252.204-7012, CDI/CUI safeguarding, cyber incident reporting, CMMC source documents.
An OSC has submitted evidence for an upcoming assessment. The assessor reviews the evidence and determines it is not adequate or sufficient to meet the CMMC practice. What can the assessor do?
Notify the CMMC-AB.
Cancel the assessment.
Postpone the assessment.
Contact the C3PAO for guidance.
CAP v2.0 makes “assessment readiness” a formal gate in Phase 1 (Conduct the Pre-Assessment) . The purpose of Phase 1 is for the C3PAO to evaluate whether the OSC has adequately prepared for the assessment of its Level 2 security requirements. If evidence submitted ahead of the assessment is found to be insufficient such that the OSC is not prepared to proceed, CAP describes an Adverse Determination of Assessment Readiness : the Lead CCA should inform the Affirming Official and provide a written explanation for recommending the assessment be suspended —without giving remedial advice.
CAP then addresses what happens next: if the OSC decides to cancel or postpone the assessment, both parties should settle affairs per the agreement (including return of proprietary information), and they may discuss revisiting the assessment when the OSC is fully prepared. This maps directly to “Postpone the assessment” as the best answer.
The other options don’t match CAP’s prescribed handling. CAP does not require notifying the Cyber AB for routine evidence insufficiency (A). “Cancel” (B) is an OSC decision path, but CAP explicitly calls out postponement/suspension as the appropriate procedural response to lack of readiness. “Contact the C3PAO for guidance” (D) is unnecessary framing here because the assessor/Lead CCA is acting on behalf of the C3PAO under CAP’s Phase 1 readiness determination and suspension process.
===========
Which entity specifies the required CMMC Level in Requests for Information and Requests for Proposals?
DoD
NARA
NIST
Department of Homeland Security
Step 1: Understanding Who Specifies CMMC Levels
TheU.S. Department of Defense (DoD)determines the requiredCMMC Levelbased on thesensitivity of the information involved in a contract.
The required CMMC Level isspecified in Requests for Information (RFIs) and Requests for Proposals (RFPs).
What is the LAST step when developing an assessment plan for an OSC?
Verify the readiness to conduct the assessment.
Perform certification assessment readiness review.
Update the assessment plan and schedule as needed
Obtain and record commitment to the assessment plan.
Last Step in Developing an Assessment Plan for an OSC
Developing anassessment planinvolves:
Defining the assessment scope(e.g., systems, networks, locations).
Planning test activities(e.g., interviews, evidence review, technical testing).
Verifying the OSC’s readiness(e.g., ensuring required documents are available).
Updating the assessment plan and schedule as needed.
Final Step: Obtaining and recording the OSC’s commitment to the assessment plan.
Why is obtaining commitment the last step?
✔Theassessment cannot proceed unless the OSC agrees to the finalized plan.
✔This ensuresOSC leadership understands the scope, timeline, and responsibilities.
✔TheC3PAO must document this commitmentto formalize the agreement.
Why is the Correct Answer " D. Obtain and record commitment to the assessment plan " ?
A. Verify the readiness to conduct the assessment → Incorrect
Readiness verification happens earlierin the planning process, not as the last step.
B. Perform certification assessment readiness review → Incorrect
Areadiness review is conducted before finalizing the plan, not at the very end.
C. Update the assessment plan and schedule as needed → Incorrect
Updating the plan happens before commitment is obtained; it is not the final step.
D. Obtain and record commitment to the assessment plan → Correct
This is the final step before conducting the assessment. The OSC must formally agree to the plan.
CMMC 2.0 References Supporting This Answer:
CMMC Assessment Process (CAP) Document
States that theOSC must confirm agreement to the assessment plan before execution.
CMMC-AB Guidelines for C3PAOs
Specifies thatfinalizing the assessment plan requires documented commitment from the OSC.
CMMC Assessment Guide
Outlines thatassessments cannot begin without formal approval of the plan.
Final Answer:
✔D. Obtain and record commitment to the assessment plan.
Prior to initiating an OSC ' s CMMC Assessment, the Lead Assessor briefed the team on the most important requirements of the assessment. The assessor also insisted that the same results of the findings summary, practice ratings, and Level recommendations must be submitted to the C3PAO for initial processes and review. After several weeks of assessment, the C3PAO completes the internal review, the recommended results are then submitted through the C3PAO for final quality review and rating approval. Which document stipulates these reporting requirements?
CMMC Assessment reporting requirements
DFARS 52.204-21 assessment reporting requirements
NISTSP 800-171 Revision 2 assessment reporting requirements
DFARS clause 252.204-7012 assessment reporting requirements
The correct answer isA. CMMC Assessment Reporting Requirementsbecause this document specifically outlines thestructured processthat Certified Third-Party Assessment Organizations (C3PAOs) must follow when conducting and reporting CMMC assessments.
Step-by-Step Breakdown:
Understanding the CMMC Assessment Process
TheLead Assessorbriefs the team on theassessment requirementsand theevaluation criteriabefore the assessment begins.
Throughout the assessment,findings summaries, practice ratings, and level recommendationsare documented and reported.
These findings are internally reviewed by theC3PAObefore they are formally submitted forquality review and final rating approval.
Key Document Stipulating Reporting Requirements: CMMC Assessment Reporting Requirements
This documentspecifically details how assessments must be reportedwithin theCMMC ecosystem.
It describes the structured process for assessment submission, internalC3PAO reviews, andquality checks by the CMMC-ABbefore an organization can receive a final certification decision.
It ensures thatresults are consistent, transparent, and aligned with DoD cybersecurity compliance expectations.
Why Other Options Are Incorrect:
B. DFARS 52.204-21 Assessment Reporting Requirements
This clause only specifiesbasic safeguardingof Federal Contract Information (FCI) but doesnotdictate the reporting process for CMMC assessments.
C. NIST SP 800-171 Revision 2 Assessment Reporting Requirements
WhileNIST SP 800-171 Rev. 2outlines security controls, it doesnotdefine how CMMC assessments must be conducted and reported.
D. DFARS Clause 252.204-7012 Assessment Reporting Requirements
This DFARS clause focuses onincident reportingandcyber incident response requirementsbut does not detail theCMMC assessment reporting process.
Official Reference:
CMMC Assessment Reporting Requirements, issued byThe Cyber ABandDoD, governs how C3PAOs must report assessment results.
CMMC Assessment Process (CAP)also outlines reporting workflows for certification.
Thus, theCMMC Assessment Reporting Requirementsdocument is the authoritative source that dictates the reporting procedures for CMMC assessments.
Which assessment method compares actual-specified conditions with expected behavior?
Test
Examine
Compile
Interview
Understanding CMMC Assessment Methods
TheCybersecurity Maturity Model Certification (CMMC) 2.0follows theNIST SP 800-171A assessment methodology, which includesthree primary assessment methods:
Examine– Reviewing policies, procedures, system configurations, and documentation.
Interview– Engaging with personnel to validate their understanding and execution of security practices.
Test– Conducting actual technical or operational tests to determine whether security controls function as expected.
Why " Test " is the Correct Answer?
" Test " is the method that compares actual-specified conditions with expected behavior.
It involvesexecuting procedures, configurations, or automated toolsto see if thesystem behaves as required.
For example, if a policy states that multi-factor authentication (MFA) must be enforced, a test would involveattempting to log in without MFAto confirm whether access is blocked as expected.
TheNIST SP 800-171A Guide (Assessment Procedures for CUI)defines testing as an assessment method that:
Actively verifies a security control is functioning
Simulates real-world attack scenarios
Checks compliance through system actions rather than documentation
Why Other Answers Are Incorrect?
B. Examine (Incorrect)
Examining only involvesreviewing policies, procedures, or configurationsbut does not actively test system behavior.
C. Compile (Incorrect)
" Compile " is not an assessment method in CMMC 2.0 or NIST SP 800-171A.
D. Interview (Incorrect)
Interviews are used to gather insights from personnel, but they do not compare actual conditions with expected behavior.
Conclusion
The correct answer isA. Testbecause itactively verifies system performance against expected security conditions.
Which term describes a group of individuals that conduct operational network vulnerability evaluations and provide mitigation techniques to customers?
Red team
Blue team
White hat hackers
Penetration test team
The best match is Penetration test team because penetration testing is an authorized, structured security evaluation intended to find vulnerabilities in systems or networks and produce results that enable remediation/mitigation .
Authoritatively, NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment) is a primary federal reference for technical security testing. It describes the purpose of technical testing as helping organizations plan and conduct tests , analyze findings , and develop mitigation strategies —which aligns directly with “vulnerability evaluations” and “providing mitigation techniques.” The DoD also points its Components to NIST SP 800-115 as guidance for penetration testing activities.
By contrast, a Red Team is typically framed as an “ethical adversary” that emulates attackers to test detection/response and overall readiness; it is often broader, scenario-driven, and focused on demonstrating what a capable adversary can accomplish rather than performing a scoped vulnerability evaluation with remediation-oriented outputs. A Blue Team is primarily defensive operations (monitoring, detection, response), not the group defined by conducting vulnerability evaluations for customers. “ White hat hackers ” is a general label for ethical hackers, but it is less specific than the established service construct of a penetration test team .
Because the question emphasizes operational network vulnerability evaluations plus mitigation techniques , the most precise and standard term is D: Penetration test team , supported by NIST’s testing-and-mitigation framing.
A Data Access Policy (DAP) document has been provided for review. It outlines the policies, procedures, and requirements for data access within the corporate area and the controlled environment. Which DAP policy statement about visitors is correct?
Visitors must not be escorted.
Visitors must be escorted in the corporate area, but not in the controlled environment.
Visitors must be escorted in the controlled environment, but not in the corporate area.
Visitors must be escorted at all times.
The correct answer is C because the CMMC physical protection requirement focuses on protecting areas where in-scope information systems, equipment, and controlled environments are located. CMMC Level 2 requirement PE.L2-3.10.3, Escort Visitors , requires the organization to “escort visitors and monitor visitor activity.” The official CMMC Level 2 Assessment Guide states that the assessment objectives include determining whether visitors are escorted, visitor activity is monitored, physical access audit logs are maintained, and physical access devices are controlled and managed. The same guide explains that individuals with permanent physical access authorization credentials are not considered visitors, and that audit logs can be used to monitor visitor activity.
For CMMC purposes, the key issue is whether the visitor could physically access organizational systems, equipment, FCI, CUI, or the respective operating environment. A general corporate area that is outside the controlled environment may not require the same escort rule unless it provides access to in-scope assets. However, the controlled environment must be protected from unauthorized physical access. Therefore, visitors should be escorted in the controlled environment, where FCI/CUI systems or related assets may be present. Option A is incorrect because CMMC requires visitor escorting. Option B reverses the protection priority. Option D is overly broad for this question because it does not distinguish between a general corporate area and the controlled environment defined in the DAP.
===========
For CMMC Assessments, during Phase 1 of the CMMC Assessment Process, which are responsible for identifying potential conflicts of information?
C3PAO and OSC
OSC and CMMC-AB
CMMC-AB and C3PAO
Lead Assessor and Assessment Team Members
In Phase 1 (Planning) of the CMMC Assessment Process, the Lead Assessor is responsible for managing the team and identifying conflicts of interest. Assessment team members must also disclose potential conflicts.
Supporting Extracts from Official Content:
CAP v2.0, Planning (§2.5–2.8): “The Lead Assessor and Assessment Team Members must identify and disclose any conflicts of interest prior to conducting the assessment.”
Why Option D is Correct:
Only the Lead Assessor and assessment team are responsible for identifying conflicts of interest during Phase 1.
Options A, B, and C incorrectly assign this role to organizations that do not hold the responsibility.
References (Official CMMC v2.0 Content):
CMMC Assessment Process (CAP) v2.0, Phase 1 Planning responsibilities.
===========
What is the primary intent of the verify evidence and record gaps activity?
Map test and demonstration responses to CMMC practices.
Conduct interviews to test process implementation knowledge.
Determine the one-to-one relationship between a practice and an assessment object.
Identify and describe differences between what the Assessment Team required and the evidence collected.
Understanding the “Verify Evidence and Record Gaps” Activity in a CMMC Assessment
During aCMMC Level 2 Assessment, theAssessment Teamfollows a structured methodology toverify evidenceand determine whether theOrganization Seeking Certification (OSC)has met all required practices. One of the key activities in this process is " Verify Evidence and Record Gaps " , which ensures that the assessment findings accurately reflect any missing or inadequate compliance evidence.
Step-by-Step Breakdown:
✅1. Primary Intent: Identifying Gaps Between Required and Collected Evidence
TheAssessment Teamcompares the evidence provided by the OSC against theCMMC practice requirements.
If evidence ismissing, insufficient, or inconsistent, assessors mustdocument the gapand describe what is lacking.
This ensures that compliance deficiencies are clearly identified, allowing the OSC to understand what must be corrected.
✅2. How This Process Works in a CMMC Assessment
Assessorsreview collected documentation, system configurations, policies, and interview responses.
They verify that the evidencematches the expected implementationof a practice.
If gaps exist, they arerecordedfor discussion and potential remediation before assessment completion.
✅3. Why the Other Answer Choices Are Incorrect:
(A) Map test and demonstration responses to CMMC practices.❌
Incorrect:While mapping evidence to CMMC practices is part of the assessment, theprimary intentof the " Verify Evidence and Record Gaps " step is toidentify deficiencies, not just mapping responses.
(B) Conduct interviews to test process implementation knowledge.❌
Incorrect:Interviews are a method used during evidence collection, but they arenot the primary focusof the verification and gap analysis step.
(C) Determine the one-to-one relationship between a practice and an assessment object.❌
Incorrect:The assessment teamreviews multiple sources of evidencefor each practice, and some practices require multiple assessment objects. The goal isnot a strict one-to-one mappingbut rathera holistic validation of compliance.
Final Validation from CMMC Documentation:
TheCMMC Assessment Process Guidestates that " Verify Evidence and Record Gaps " is the step where assessorscompare expected evidence against what has been provided and document discrepancies. This ensurestransparent assessment findings and remediation planning.
Thus, the correct answer is:
D. Identify and describe differences between what the Assessment Team required and the evidence collected.
Who makes the final determination of the assessment method used for each practice?
CCP
osc
Site Manager
Lead Assessor
Who Determines the Assessment Method for Each Practice?
In aCMMC Level 2 Assessment, theLead Assessorhas thefinal authorityin determining theassessment methodused to evaluate each practice.
Key Responsibilities of the Lead Assessor
✅Ensures theCMMC Assessment Process (CAP) Guideis followed.
✅Determines whether a practice is evaluated usinginterviews, demonstrations, or document reviews.
✅Directs theCertified CMMC Professionals (CCPs)and other assessors on themethodologyfor gathering evidence.
✅Works under aCertified Third-Party Assessment Organization (C3PAO)to ensure proper assessment execution.
Why " Lead Assessor " is Correct?
CCP (Option A) assists in the assessment but does not make final decisionson methods.
OSC (Option B) is the Organization Seeking Certification, and they do not control assessment methodology.
Site Manager (Option C) may coordinate logistics but has no authority over assessment decisions.
Breakdown of Answer Choices
Option
Description
Correct?
A. CCP
❌Incorrect–A CCPassistsbut doesnot determine assessment methods.
B. OSC
❌Incorrect–The OSC is beingassessedand does not decide assessment methods.
C. Site Manager
❌Incorrect–The Site Manager handles logistics butdoes not control assessment methods.
D. Lead Assessor
✅Correct – The Lead Assessor has the final say on the assessment method used.
Official References from CMMC 2.0 Documentation
CMMC Assessment Process Guide (CAP)– Defines theLead Assessor’s rolein determining assessment methods.
Final Verification and Conclusion
The correct answer isD. Lead Assessor, as they havefinal decision-making authority over the assessment methodology.
Which CMMC Levels meet the standards of protecting FCI (Federal Contract Information) ?
Level 1
Level 2
Levels 2 and 3
Levels 1, 2, and 3
In CMMC v2.0, Level 1 is explicitly the level that “focuses on the protection of FCI ” and is composed of the basic safeguarding requirements aligned to FAR 52.204-21 . This directly establishes Level 1 as meeting the standard for protecting FCI.
However, the question asks which levels meet the standard of protecting FCI—not which level is primarily intended for FCI. The official CMMC Model Overview (Version 2.0) states that the CMMC levels and associated sets of practices are cumulative , meaning that to achieve a higher level, an organization must also demonstrate achievement of the preceding lower levels. Because Level 2 and Level 3 certifications require meeting lower-level requirements as part of achieving the higher certification, an organization certified at Level 2 or Level 3 necessarily satisfies the Level 1 requirements that protect FCI.
In addition, the later Model Overview v2.13 reiterates the structure of the model: Level 1 requirements correspond to FAR 52.204-21 safeguards (FCI), while Level 2 and Level 3 focus on CUI protection at increasing rigor. Taken together, the official documents support that Levels 1, 2, and 3 all meet the standard for protecting FCI, with Level 1 being the foundational baseline and Levels 2/3 building on it.
===========
Within the CMMC Ecosystem which organization ultimately will manage and oversee the training, testing, authorization, and certification of candidate assessors and instructors?
DoD OUSD
DIB Collaborative Information Sharing Environment
Committee on National Security Systems Instructions
CMMC Assessors and Instructors Certification Organization
Understanding the Role of CAICO in the CMMC Ecosystem
TheCMMC Ecosystemconsists of multiple organizations that manage, implement, and oversee different aspects of theCybersecurity Maturity Model Certification (CMMC)program.
One of the key organizations is theCMMC Assessors and Instructors Certification Organization (CAICO), which is responsible for:
Training and certifying assessors and instructors.
Managing testing, authorization, and certificationfor CMMC professionals.
Ensuring assessors meet qualification and compliance standards.
Why Option D (CAICO) is Correct
TheCAICO is explicitly taskedwith thetraining, testing, authorization, and certification of candidate assessors and instructors.
Option A (DoD OUSD)is incorrect because theDoD Office of the Under Secretary of Defense(OUSD) provides policy oversight butdoes not handle certification of assessors.
Option B (DIB Collaborative Information Sharing Environment)is incorrect because theDIB CISfocuses on information sharing within the Defense Industrial Base, not assessor certification.
Option C (Committee on National Security Systems Instructions)is incorrect because CNSSI provides security standards butdoes not manage assessor training or certification.
Official CMMC Documentation References
CMMC Ecosystem Overview – Role of the CAICO
CMMC Assessment Process (CAP) Guide – Assessor Certification and Training
Final Verification
SinceCAICO is responsible for training, testing, and certifying CMMC assessors and instructors, the correct answer isOption D: CMMC Assessors and Instructors Certification Organization.
According to DFARS clause 252.204-7012, who is responsible for determining that Information in a given category should be considered CUI?
The NARA CUI Executive Agent
The contractor who generated the information
The DoD agency for whom the contractor is performing the work
The military personnel assigned to the contractor for that purpose
DFARS clause 252.204-7012 establishes the safeguarding of Covered Defense Information (CDI), which aligns with CUI categories. The clause specifies that the DoD is responsible for determining whether information is Controlled Unclassified Information (CUI) and marking it accordingly before sharing it with contractors. Contractors do not make determinations about what constitutes CUI; they are responsible for safeguarding information once it is received and marked as CUI.
Reference Documents:
DFARS 252.204-7012,Safeguarding Covered Defense Information and Cyber Incident Reporting
CMMC Model v2.0 Overview, December 2021
Who has the initial responsibility for identifying and managing conflicts of interest?
OSC
C3PAO
CMMC-AB
Lead Assessor
Under the CMMC Assessment Process (CAP) v2.0 , the C3PAO holds the initial (and ultimate) responsibility to identify and manage conflicts of interest (COI) related to a CMMC Level 2 certification assessment. CAP v2.0 includes an explicit pre-assessment activity titled “Identify and Manage Initial Conflicts of Interest (COI)” and states that C3PAOs are ultimately responsible for managing impartiality and identifying conflicts of interest for the assessment.
CAP v2.0 further clarifies that this responsibility cannot be delegated to the assessment team (including the Lead Assessor/Lead CCA) or to the OSC. In other words, while the Lead Assessor participates in executing the process and the OSC must cooperate (e.g., disclose relationships or prior services that could create COI), CAP places the duty to run the COI identification/mitigation process squarely on the C3PAO as the assessment organization.
This aligns with the intent of impartiality controls in certification programs: the certification body (here, the C3PAO) must ensure objective assessments by identifying conflicts early, applying mitigation (or avoidance), and documenting the resolution before the assessment proceeds. Since the question asks who has the initial responsibility , the CAP’s direct assignment of COI management to the C3PAO makes B the correct answer.
===========
What is a PRIMARY activity that is performed while conducting an assessment?
Develop assessment plan.
Collect and examine evidence.
Verify readiness to conduct assessment.
Deliver recommended assessment results.
Step 1: Understand the Assessment Phases (CAP v1.0)
TheCMMC Assessment Process (CAP)outlines a structured lifecycle for assessments, including:
Plan and Prepare Phase– Develop the assessment plan (before the assessment starts).
Conduct Assessment Phase– Execute the actual assessment activities.
Report Results Phase– Finalize and deliver the assessment outcomes.
CAP v1.0 – Section 3.5 (Conduct Assessment):
“The assessment team collects, examines, and evaluates evidence to determine if practices are MET or NOT MET.”
✅Step 2: Why “Collect and Examine Evidence” Is the Primary Activity
During the“Conduct Assessment” phase, the main activity is to:
Collect evidence(documentation, interviews, testing),
Validate adequacy and sufficiency,
Score practicesas MET/NOT MET.
This is thecore responsibilityof assessorswhile conductingan assessment.
❌Why the Other Options Are Incorrect
A. Develop assessment plan
✘This occurs in thePlan and Preparephasebeforeconducting the assessment.
C. Verify readiness to conduct assessment
✘Readiness verification is part ofpre-assessment activities, not during the assessment itself.
D. Deliver recommended assessment results
✘This is done during theReport Resultsphase after the assessment has been conducted.
Theprimary activity performed during the actual executionof a CMMC assessment iscollecting and examining evidenceto determine compliance with practices.
During assessment planning, the OSC recommends a person to interview for a certain practice. The person being interviewed MUST be the person who:
funds that practice.
audits that practice.
supports, audits, and performs that practice.
implements, performs, or supports that practice.
Who Should Be Interviewed During a CMMC Assessment?
During assessment planning, theOrganization Seeking Certification (OSC)may suggest personnel for interviews. However, the person interviewedmustbe someone who:
✅Implementsthe practice (directly responsible for executing it).
✅Performsthe practice (carries out day-to-day security operations).
✅Supportsthe practice (provides necessary resources or oversight).
Why " Implements, Performs, or Supports That Practice " is Correct?
Theassessor needs direct insightsfrom individuals actively involved in the practice.
Funding (Option A)does not providetechnical or operationalinsight into practice execution.
Auditing (Option B)focuses on compliance checks, but auditorsdo not implementthe practice.
Supporting, auditing, and performing (Option C)includesauditors, who arenot necessarily the right interviewees.
Breakdown of Answer Choices
Option
Description
Correct?
A. Funds that practice.
❌Incorrect–Funding is important but doesnot mean direct involvement.
B. Audits that practice.
❌Incorrect–Auditors check compliance but donot implementpractices.
C. Supports, audits, and performs that practice.
❌Incorrect–Auditing isnot a requirementfor interviewees.
D. Implements, performs, or supports that practice.
✅Correct – The interviewee must have direct involvement in execution.
Official References from CMMC 2.0 Documentation
CMMC Assessment Process Guide (CAP)– Requires that interviewees bedirectly responsiblefor implementing, performing, or supporting the practice.
Final Verification and Conclusion
The correct answer isD. Implements, performs, or supports that practice, as the interviewee mustactively contribute to the execution of the practice.
Who is responsible for ensuring that subcontractors have a valid CMMC Certification?
CMMC-AB
OUSD A & S
DoD agency or client
Contractor organization
Under DFARS and CMMC requirements, the prime contractor is responsible for ensuring its subcontractors meet the required CMMC level. Neither the DoD, The Cyber AB, nor OUSD A & S directly manages subcontractor certification.
Supporting Extracts from Official Content:
DFARS 252.204-7021: “The contractor shall ensure that its subcontractors have the appropriate CMMC level certification for the information they will handle.”
Why Option D is Correct:
Compliance responsibility flows through the contractor supply chain.
CMMC-AB (The Cyber AB) accredits assessors but does not police subcontractors.
OUSD A & S sets policy, not enforcement at contract level.
DoD agencies only require compliance at award/contract oversight level.
References (Official CMMC v2.0 Content):
DFARS 252.204-7021.
CMMC Model v2.0 governance guidance.
===========
A Lead Assessor is preparing to conduct a Readiness Review during Phase 1 of the Assessment Process. How much evidence MUST be gathered for each practice?
A sufficient amount
At least 2 Assessment Objects
Evidence that is deemed adequate
Evidence to support at least 2 Assessment Methods
During a Readiness Review (Phase 1), the purpose is to validate whether an OSC is prepared to move forward with a formal assessment. The CAP specifies that the Lead Assessor must collect sufficient evidence for each practice to make a preliminary determination of readiness.
Supporting Extracts from Official Content:
CAP v2.0, Readiness Review (§2.14): “The Lead Assessor must collect a sufficient amount of evidence for each practice to determine the OSC’s readiness.”
Why Option A is Correct:
The requirement is for sufficient evidence; CAP does not mandate a set number of assessment objects or methods.
Options B, C, and D incorrectly suggest minimum counts or methods that are not part of the readiness review requirements.
References (Official CMMC v2.0 Content):
CMMC Assessment Process (CAP) v2.0, Phase 1 Readiness Review.
===========
Which phase of the CMMC Assessment Process includes the task to identify, obtain inventory, and verify evidence?
Phase 1: Plan and Prepare Assessment
Phase 2: Conduct Assessment
Phase 3: Report Recommended Assessment Results
Phase 4: Remediation of Outstanding Assessment Issues
Understanding the CMMC Assessment Process
TheCMMC Assessment Process (CAP)consists offour phases, each with specific tasks and objectives.
Phase 1: Plan and Prepare Assessment– Planning, scheduling, and preparing for the assessment.
Phase 2: Conduct Assessment–Gathering and verifying evidence, conducting interviews, and evaluating compliance.
Phase 3: Report Recommended Assessment Results– Documenting findings and reporting results.
Phase 4: Remediation of Outstanding Assessment Issues– Allowing the organization to address any deficiencies.
Why " Phase 2: Conduct Assessment " is Correct?
DuringPhase 2: Conduct Assessment, theAssessment Teamperforms key activities, including:
✅Identifying required evidencefor compliance verification.
✅Obtaining and reviewing artifacts(e.g., security policies, configurations, logs).
✅Verifying the sufficiency of evidenceagainst CMMC practice requirements.
✅Interviewing key personneland observing cybersecurity implementations.
Since the question specifically mentions " identify, obtain inventory, and verify evidence, " this task directly falls underPhase 2: Conduct Assessment.
Breakdown of Answer Choices
Option
Description
Correct?
A. Phase 1: Plan and Prepare Assessment
❌Incorrect–This phase focuses onscheduling, logistics, and planning, not evidence collection.
B. Phase 2: Conduct Assessment
✅Correct – This phase involves gathering, verifying, and reviewing evidence.
C. Phase 3: Report Recommended Assessment Results
❌Incorrect–This phasedocumentsresults but doesnotcollect evidence.
D. Phase 4: Remediation of Outstanding Assessment Issues
❌Incorrect–This phase focuses oncorrective actions, not evidence collection.
Official References from CMMC 2.0 Documentation
CMMC Assessment Process Guide (CAP)–Phase 2: Conduct Assessmentexplicitly includes tasks such asgathering and verifying evidence.
Final Verification and Conclusion
The correct answer isB. Phase 2: Conduct Assessment, as this phase includesidentifying, obtaining, and verifying evidence, which is critical for determining CMMC compliance.
Which statement is NOT a requirement for a Licensed Partner Publisher?
Must have at least two years of history in publishing
Must possess a Dun and Bradstreet number and background check
Must receive CMMC Level 3 certification
Must be approved by CMMC-AB or authorized organization
The correct answer is C because a Licensed Partner Publisher is an ecosystem participant that produces or distributes approved CMMC-related learning or publishing content; it is not the same thing as an Organization Seeking Assessment or a Defense Industrial Base contractor pursuing a CMMC Level 3 certification status. CMMC certification levels apply to organizations handling FCI or CUI in connection with DoD contract performance, not to every training, publishing, or ecosystem-support organization. The CMMC Assessment Process describes CMMC as the DoD initiative for assessing and certifying conformance by companies and organizations in the Defense Industrial Base, specifically to safeguard CUI and FCI processed, stored, or transmitted during DoD contract performance. A publisher may need business validation, authorization, background checks, and approval by the CMMC Accreditation Body or authorized program entity, but requiring CMMC Level 3 certification would be misaligned with the role. Level 3 is an advanced contractor cybersecurity status, not a publishing-partner qualification. Reference/topics: CMMC Ecosystem, Licensed Partner Publisher, Cyber AB ecosystem roles, CMMC certification applicability.
Which document is used to protect sensitive and confidential information from being made available by the recipient of that information?
Legal agreement
CMMC agreement
Assessment agreement
Non-disclosure agreement
The correct document is a Non-Disclosure Agreement (NDA) , because its specific purpose is to restrict a receiving party from disclosing sensitive or confidential information to unauthorized parties. In the official CMMC Assessment Process (CAP) v2.0 , NDAs are called out directly as a required element of the contracting relationship for a Level 2 certification assessment.
CAP v2.0 states that the C3PAO and the OSC must execute a written contractual agreement for the assessment and then specifies that “A mutual non-disclosure agreement (NDA) between the parties shall be incorporated into the contractual agreement or negotiated and executed in a separate document (e.g., stand-alone NDA, master services agreement, etc.).”
This is important because CMMC assessments can involve access to highly sensitive organizational information, including details about system architectures, security implementations, and potentially CUI handling processes. The CAP’s NDA requirement supports controlling dissemination of that information and reinforces the broader confidentiality expectations placed on assessment participants.
While an “assessment agreement” or generic “legal agreement” might contain confidentiality clauses, CAP v2.0 explicitly identifies the NDA instrument (either embedded or standalone) as the mechanism to protect information exchanged during the assessment engagement. Therefore, the best answer—consistent with CMMC v2.0 official process documentation—is D (Non-disclosure agreement) .
As part of CMMC 2.0, the change to Level 1 Self-Assessments supports " reduced assessment costs " allows all companies at Level 1 (Foundational) to:
to conduct self-assessments.
opt out of CMMC Assessments.
have assessment costs reimbursed by the DoD.
pay no more than $500.00 for their annual assessment.
Step 1: Review CMMC 2.0 Reforms (Level 1 – Foundational)
As part ofCMMC 2.0, the DoD announced changes toreduce burden and costsfor companies that only handleFederal Contract Information (FCI):
DoD Statement (CMMC 2.0 Overview):
“Level 1 (Foundational) will only require an annual self-assessment, affirming implementation of the 17 FAR 52.204-21 controls.”
✅Step 2: Intent of “Reduced Assessment Costs”
The move to allowself-assessments at Level 1was explicitly designed toeliminate the costof hiring third-party assessors for organizations that only handle FCI.
Level 1 self-assessments are:
Conductedinternally by the OSC,
Affirmed annuallyby a senior company official,
Submitted via SPRS(Supplier Performance Risk System).
❌Why the Other Options Are Incorrect
B. Opt out of CMMC Assessments
✘Incorrect. Organizations must still perform aself-assessmentannually — they cannot opt out entirely.
C. Have assessment costs reimbursed by the DoD
✘No such reimbursement mechanism exists.
D. Pay no more than $500.00…
✘No such fixed cost is set or guaranteed in CMMC documentation.
UnderCMMC 2.0, all companies atLevel 1 (Foundational)are permitted toconduct self-assessmentsannually to demonstrate compliance, supporting the DoD’s goal ofreducing assessment costsfor low-risk contractors.
Which government agency are DoD contractors required to report breaches of CUI to?
FBI
NARA
DoD Cyber Crime Center
Under Secretary of Defense for Intelligence and Security
Who Do DoD Contractors Report CUI Breaches To?
PerDFARS 252.204-7012, all DoD contractors handlingControlled Unclassified Information (CUI)must report cyber incidents to theDoD Cyber Crime Center (DC3).
Key Reporting Requirements
✅Cyber incidents involving CUI must be reported toDC3 within 72 hours.
✅Reports must be submitted via theDoD ' s Cyber Incident Reporting Portal.
✅Contractors mustpreserve forensic evidencefor potential investigation.
Why " DoD Cyber Crime Center " is Correct?
The FBI (Option A) handles criminal investigations, but DoD contractorsmust report cyber incidents to DC3.
NARA (Option B) oversees the CUI Registry, butis not responsible for breach reporting.
The Under Secretary of Defense for Intelligence and Security (Option D) is responsible for intelligence operations, not incident reporting.
Breakdown of Answer Choices
Option
Description
Correct?
A. FBI
❌Incorrect–The FBI handlescriminal cases, not CUI breach reporting.
B. NARA
❌Incorrect–NARA manages theCUI Registry, butdoes not handle breaches.
C. DoD Cyber Crime Center
✅Correct – Per DFARS 252.204-7012, cyber incidents involving CUI must be reported to DC3.
D. Under Secretary of Defense for Intelligence and Security
❌Incorrect–This office doesnothandle cyber incident reports.
Official References from CMMC 2.0 and DFARS Documentation
DFARS 252.204-7012– Requires DoD contractors to report CUI-related cyber incidents toDC3.
DoD Cyber Crime Center (DC3) Website– The official platform forcyber incident reporting.
Final Verification and Conclusion
The correct answer isC. DoD Cyber Crime Center, as perDFARS 252.204-7012, which mandates that all DoD contractors reportCUI breaches to DC3 within 72 hours.
Which authority leads the CMMC direction, standards, best practices, and knowledge framework for how to map the controls and processes across different Levels that range from basic cyber hygiene to advanced cyber practices?
NIST
DoD CIO office
Federal CIO office
Defense Federal Acquisition Regulation Council
Understanding the Role of the DoD CIO Office in CMMC
TheDepartment of Defense (DoD) Chief Information Officer (CIO) officeis theprimary authorityresponsible for leading the direction, standards, and best practices of theCybersecurity Maturity Model Certification (CMMC)framework.
Why " B. DoD CIO Office " is Correct?
The DoD CIO Oversees CMMC Policy and Implementation
TheDoD CIO Office is responsible for the governance and strategic direction of CMMC.
It ensures thatCMMC aligns with DoD cybersecurity policies, such asDoD Instruction 5200.48 (Controlled Unclassified Information)andNIST SP 800-171.
CMMC Development and Evolution
TheDoD CIO played a critical role in launching CMMCto improve cybersecurity across theDefense Industrial Base (DIB).
The CIO office leadspolicy development and updates to the CMMC framework, including the transition fromCMMC 1.0 to CMMC 2.0.
Alignment of CMMC with Federal Cybersecurity Strategy
The DoD CIO ensures that CMMCintegrates with federal cybersecurity policiesandNIST frameworks.
It provides oversight formapping CMMC Levels (1-2-3) to existing cybersecurity standards and controls.
Why Other Answers Are Incorrect?
A. NIST (Incorrect)
TheNational Institute of Standards and Technology (NIST)provides thetechnical framework (NIST SP 800-171, SP 800-172), butNIST does not lead the CMMC program.
C. Federal CIO Office (Incorrect)
TheFederal CIO focuses on broader government IT policiesandnot specifically on DoD cybersecurity requirementslike CMMC.
D. Defense Federal Acquisition Regulation Council (Incorrect)
TheDFARS Counciloverseescontracting regulationsrelated to CMMC (e.g.,DFARS 252.204-7012, 7019, 7020, 7021), but it doesnot lead CMMC standards and best practices.
Conclusion
The correct answer isB. DoD CIO Office, as it isthe lead authority guiding the CMMC framework, standards, and implementation across the Defense Industrial Base (DIB).
Which principles are included in defining the CMMC-AB Code of Professional Conduct?
Objectivity, classification, and information accuracy
Objectivity, confidentiality, and information integrity
Responsibility, classification, and information accuracy
Responsibility, confidentiality, and information integrity
The Cyber AB (formerly CMMC-AB) Code of Professional Conduct (CoPC) is a mandatory agreement that all CMMC ecosystem members—including Certified CMMC Professionals (CCPs) and Certified CMMC Assessors (CCAs)—must adhere to. This code ensures the reliability and trustworthiness of the assessment process.
The fundamental principles that form the foundation of the CoPC include:
Responsibility: This refers to the obligation of the CMMC professional to act in the best interest of the CMMC program, the Department of Defense (DoD), and the public. It includes maintaining professional competence and performing duties with due care.
Confidentiality: Assessors and professionals are granted access to sensitive information, including Controlled Unclassified Information (CUI) and proprietary business data of the Organization Seeking Certification (OSC). They must ensure this information is protected from unauthorized disclosure.
Information Integrity: This principle requires that all data, findings, and reports generated during the assessment are accurate, complete, and have not been tampered with. It ensures that the " Met " or " Not Met " determinations are based on honest evidence.
Why other options are incorrect:
Options A and B (Objectivity): While " Objectivity " is a crucialbehavioralrequirement for an assessor (remaining unbiased), the specific high-level triad often emphasized in the CMMC Professional training and the formal CoPC documentation focuses on the Responsibility-Confidentiality-Integrity framework to align with standard professional ethics and information security pillars.
Options A and C (Classification): " Classification " is a process used for National Security Information (Classified info), whereas CMMC is primarily focused on unclassified information (CUI and FCI). Classification is not a core principle of the professional code of conduct.
Options A and C (Information Accuracy): While accuracy is vital, it is considered a subset of Information Integrity within the formal definitions provided in the CCP curriculum.
Reference Documents:
CMMC-AB (The Cyber AB) Code of Professional Conduct: The official ethical framework for all credentialed individuals.
CMMC Professional (CCP) Study Guide: Section on " Ethics and the Code of Professional Conduct. "
CMMC Assessment Process (CAP): References the ethical standards required to maintain the integrity of the assessment ecosystem.
What is the legal entity under a contract that has agreed to deliver products or services?
Supporting Organization/Unit
Commercial and Government Entity Code
Host Unit
HQ Organization
The correct answer is D because the HQ Organization represents the legal entity associated with the contract obligation to deliver products or services. In assessment scoping, it is critical to separate the overall legal contracting entity from the specific Host Unit or operational segment that processes, stores, or transmits FCI or CUI. A Host Unit is the assessed operational environment or business unit within the organization where the relevant contract work and information handling occur. A Supporting Organization/Unit provides people, processes, or technology that support the Host Unit but is not the prime legal entity delivering the contractual product or service. A Commercial and Government Entity Code, or CAGE code, is an identifier associated with the entity; it is not itself the legal entity. CAP guidance requires the C3PAO to confirm the specific corporate legal entity being assessed and to solicit the associated CAGE code or codes. That distinction points to the HQ Organization as the contractual legal entity, while the CAGE code is only the identifier used to associate the entity with DoD systems. Reference/topics: CAP scoping, HQ Organization, Host Unit, CAGE code, legal entity confirmation.
A CCP is providing consulting services to a company who is an OSC. The CCP is preparing the OSC for a CMMC Level 2 assessment. The company has asked the CCP who is responsible for determining the CMMC Assessment Scope and who validates its CMMC Assessment Scope. How should the CCP respond?
" The OSC determines the CMMC Assessment Scope, and the CCP validates the CMMC Assessment Scope. "
" The OSC determines the CMMC Assessment Scope, and the C3PAO validates the CMMC Assessment Scope. "
" The CMMC Lead Assessor determines the CMMC Assessment Scope, and the OSC validates the CMMC Assessment Scope. "
" The CMMC C3PAO determines the CMMC Assessment Scope, and the Lead Assessor validates the CMMC Assessment Scope. "
Step 1: Understanding CMMC Assessment Scope Determination
In a CMMC Level 2 assessment, the Organization Seeking Certification (OSC) is responsible for identifying the assessment scope based on the CMMC Scoping Guidance provided by the Cyber AB (Cyber Accreditation Body) and DoD.
The OSC must determine which assets and systems handle Controlled Unclassified Information (CUI) and categorize them accordingly.
When are contractors required to achieve a CMMC certificate at the Level specified in the solicitation?
At the time of award
Upon solicitation submission
Thirty days from the award date
Before the due date of submission
PerDFARS 252.204-7021, contractors must achieve the requiredCMMC certification levelbefore contract awardif the solicitation specifies it.
Key Requirements:
✔Contractorsmust be certified at the required CMMC levelprior to contract award.
✔Thecertification must be conducted by a C3PAO(for Level 2) orthrough self-assessment(for Level 1).
✔The certification must bevalid and registered in the Supplier Performance Risk System (SPRS)before award.
Why is the Correct Answer " At the Time of Award " (A)?
A. At the time of award → Correct
DFARS 252.204-7021requires CMMC certification before a contract can be awardedif the solicitation includes CMMC requirements.
B. Upon solicitation submission → Incorrect
Contractorsdo notneed to be CMMC-certified at thetime of bid submission, only by the time of award.
C. Thirty days from the award date → Incorrect
Contractorsmust already be certified before the award is granted. There isno grace period.
D. Before the due date of submission → Incorrect
While compliance planning is important,CMMC certification is only required before contract award, not before bid submission.
CMMC 2.0 References Supporting This Answer:
DFARS 252.204-7021 (CMMC Requirement Clause)
CMMC certification is required prior to contract awardif specified in the solicitation.
CMMC 2.0 Program Overview
States that certificationis not needed at bid submission but is required before award.
DoD Interim Rule & SPRS Guidance
Contractors must havea valid CMMC certification recorded in SPRSbefore award.
A Lead Assessor is ensuring all actions have been completed to conclude a Level 2 Assessment. The final Assessment Results Package has been properly reviewed and is ready to be uploaded. What other materials is the Lead Assessor responsible for maintaining and protecting?
Any additional notes and information from the Assessment
A final assessment plan, and a Quality Control report from C3PAO
A final assessment plan, and a letter from the Lead Assessor explaining the process
A final assessment plan, a letter from the Lead Assessor explaining the results, and a Quality Control report from C3PAO
The Lead Assessor is responsible for protecting and maintaining all assessment records, notes, and information gathered during the assessment process. This includes working papers and supplemental documentation that may be needed for auditability or dispute resolution.
Supporting Extracts from Official Content:
CAP v2.0, Post-Assessment Responsibilities (§3.17): “The Lead Assessor must ensure that all assessment artifacts, notes, and information are archived or disposed of in accordance with C3PAO policy.”
Why Option A is Correct:
The CAP specifies that notes and information from the assessment must be preserved or disposed of according to policy.
Options B, C, and D list items not required in the CAP. The “letter” and “quality control report” are not part of the Lead Assessor’s required maintained materials.
References (Official CMMC v2.0 Content):
CMMC Assessment Process (CAP) v2.0, Phase 3 Post-Assessment (§3.17).
===========
Within how many days from the Assessment Final Recommended Findings Brief should the Lead Assessor and Assessment Team Members, if necessary, review the accuracy and validity of (he OSC ' s updated POA & M with any accompanying evidence or scheduled collections?
90 days
180 days
270 days
360 days
In theCMMC 2.0 Assessment Process, after theAssessment Final Recommended Findings Brief, theLead Assessor and Assessment Team Membersmustreview the accuracy and validity of the Organization Seeking Certification (OSC)’s updated Plan of Action & Milestones (POA & M) and any accompanying evidence or scheduled collectionswithin180 days.
Relevant CMMC 2.0 Reference:
TheCMMC Assessment Process (CAP)outlines that organizations haveup to 180 daysto address identifieddeficienciesafter their initial assessment.
During this time, the OSC can update itsPOA & M with additional evidenceto demonstrate compliance.
Why is the Correct Answer 180 Days (B)?
A. 90 days → Incorrect
The CMMC CAP does not impose a90-day limiton POA & M updates; instead,180 daysis the standard timeframe.
B. 180 days → Correct
PerCMMC Assessment Process guidelines, theLead Assessor and Teammust review updateswithin 180 days.
C. 270 days → Incorrect
No official CMMC documentation mentions a270-dayreview period.
D. 360 days → Incorrect
The process must be completedfar sooner than 360 daysto maintain compliance.
CMMC 2.0 References Supporting this Answer:
CMMC Assessment Process (CAP) Document
Defines the180-day windowfor the OSC to update itsPOA & M and submit evidencefor review.
CMMC 2.0 Official Guidelines
Specifies that organizations are givenup to 180 daysto remediate deficiencies before reassessment.
Where can a listing of all federal agencies ' CUI indices and categories be found?
32 CFR Section 2002
Official CUI Registry
Executive Order 13556
Official CMMC Registry
Understanding the Official CUI Registry
TheControlled Unclassified Information (CUI) Registryis theauthoritative sourcefor all federal agencies ' CUI categories and indices. It is maintained by theNational Archives and Records Administration (NARA)and provides:
✅Acomprehensive listof CUI categories and subcategories.
✅Details onwho can handle, store, and share CUI.
✅Guidance onCUI marking and safeguarding requirements.
Why " Official CUI Registry " is Correct?
TheOfficial CUI Registryis theonly federal resourcethat listsall CUI categories and agencies that use them.
32 CFR Section 2002(Option A) definesCUI policiesbut doesnotprovide a full listing of CUI categories.
Executive Order 13556(Option C) established theCUI Programbut doesnotmaintain an active list of categories.
The " Official CMMC Registry " (Option D) does not exist—CMMC is a security framework, not a CUI classification system.
Breakdown of Answer Choices
Option
Description
Correct?
A. 32 CFR Section 2002
❌Incorrect–Defines CUI program rules butdoes not listcategories.
B. Official CUI Registry
✅Correct – The registry contains the full list of CUI categories.
C. Executive Order 13556
❌Incorrect–Established the CUI program butdoes not maintain a category list.
D. Official CMMC Registry
❌Incorrect–No such registry exists; CMMC is a cybersecurity framework, not a CUI classification system.
Official References from CMMC 2.0 and Federal Documentation
National Archives (NARA) CUI Registry– The authoritative source forall federal agency CUI categories.
32 CFR 2002– Provides CUIpolicy guidancebut refers agencies to theOfficial CUI Registryfor classification.
Final Verification and Conclusion
The correct answer isB. Official CUI Registry, as it is theonly official source listing all federal agencies ' CUI indices and categories.
Which statement BEST describes the requirements for a C3PA0?
An authorized C3PAO must meet some DoD and all ISO/IEC 17020 requirements.
An accredited C3PAO must meet all DoD and some ISO/IEC 17020 requirements.
AC3PAO must be accredited by DoD before being able to conduct assessments.
A C3PAO must be authorized by CMMC-AB before being able to conduct assessments.
Understanding C3PAO Requirements
ACertified Third-Party Assessment Organization (C3PAO)is an entityauthorized by the CMMC Accreditation Body (CMMC-AB)to conductCMMC Level 2 Assessmentsfor organizations handlingControlled Unclassified Information (CUI).
Key Requirements for a C3PAO to Conduct Assessments:
✔Must be authorized by CMMC-AB before conducting assessments.
✔Must meet CMMC-AB and DoD cybersecurity and process requirements.
✔Must comply with ISO/IEC 17020 standards for inspection bodies.
✔Must undergo a rigorous vetting process, including cybersecurity verification.
Why is the Correct Answer " D " (A C3PAO must be authorized by CMMC-AB before being able to conduct assessments)?
A. An authorized C3PAO must meet some DoD and all ISO/IEC 17020 requirements → Incorrect
C3PAOs must comply with CMMC-AB authorization requirementsbefore performing assessments.
While they must align withISO/IEC 17020, they donotnecessarily meet all requirements upfront.
B. An accredited C3PAO must meet all DoD and some ISO/IEC 17020 requirements → Incorrect
C3PAOs are not accredited by DoD; they areauthorized by CMMC-ABto perform assessments.
Accreditation follows full compliance with CMMC-AB and ISO/IEC 17020 requirements.
C. A C3PAO must be accredited by DoD before being able to conduct assessments → Incorrect
The DoD does not directly accredit C3PAOs—CMMC-AB is responsible forauthorization and oversight.
D. A C3PAO must be authorized by CMMC-AB before being able to conduct assessments → Correct
CMMC-AB grants authorization to C3PAOs, allowing them to perform assessmentsonly after meeting specific requirements.
CMMC 2.0 References Supporting This Answer:
CMMC-AB Certified Third-Party Assessment Organization (C3PAO) Guidelines
States thatC3PAOs must receive CMMC-AB authorization before conducting assessments.
CMMC 2.0 Assessment Process (CAP) Document
Specifies that onlyC3PAOs authorized by CMMC-AB can conduct official CMMC assessments.
ISO/IEC 17020 Compliance for C3PAOs
Defines theinspection body requirements for C3PAOs, which must be met for accreditation.
Who will verify the adequacy and sufficiency of evidence to determine whether the practices and related components for each in-scope Host Unit. Supporting Organization/Unit, or enclave has been met?
OSC
Assessment Team
Authorizing official
Assessment official
Who Verifies the Adequacy and Sufficiency of Evidence?
In the CMMC assessment process, it is theAssessment Teamthat is responsible for verifying whether thepractices and related componentshave been met for each in-scopeHost Unit, Supporting Organization/Unit, or enclave.
TheCMMC Assessment Teamis composed of certified assessors and led by aCertified CMMC Assessor (CCA). Their primary role is to:
Review evidenceprovided by theOrganization Seeking Certification (OSC).
Determine compliancewith required CMMC practices and processes.
Evaluate the sufficiencyof evidence to confirm that all required practices have been properly implemented.
Document and report findingsto the CMMC Accreditation Body (CMMC-AB).
Breakdown of Answer Choices
Option
Description
Correct?
A. OSC (Organization Seeking Certification)
The OSC provides documentation and evidence but doesnotverify its adequacy.
❌Incorrect
B. Assessment Team
✅Responsible for verifying the adequacy and sufficiency of evidence.
✅Correct
C. Authorizing Official
Typically refers to an official responsible for system accreditation underNIST RMF, not CMMC.
❌Incorrect
D. Assessment Official
Not a defined role in the CMMC framework.
❌Incorrect
Official Reference from CMMC 2.0 Documentation
TheCMMC Assessment Process Guide(CAP) outlines theAssessment Team ' sresponsibility in verifying evidence.
TheCMMC Assessment Teamevaluates whether theorganization ' s cybersecurity practices meet CMMC requirements.
Final Verification and Conclusion
The correct answer isB. Assessment Team, as per CMMC 2.0 documentation and official assessment processes.
In preparation for a CMMC Level 1 Self-Assessment, the IT manager for a DIB organization is documenting asset types in the company ' s SSP The manager determines that identified machine controllers and assembly machines should be documented as Specialized Assets. Which type of Specialized Assets has the manager identified and documented?
loT
Restricted IS
Test equipment
Operational technology
Understanding Specialized Assets in a CMMC Self-Assessment
DuringCMMC Level 1 Self-Assessments, organizations must classify theirassetsin theSystem Security Plan (SSP).
Specialized Asset Type: Operational Technology (OT)
Operational Technology (OT)includesmachine controllers, industrial control systems (ICS), and assembly machines.
Thesesystems control physical processesin manufacturing, energy, and industrial environments.
OT assets are distinct from traditional IT systemsbecause they haveunique security considerations(e.g., real-time control, legacy system constraints).
Why is the Correct Answer " D. Operational Technology " ?
A. IoT (Internet of Things) → Incorrect
IoT devicesinclude smart home systems, connected sensors, and networked appliances, butmachine controllers and assembly machines fall under OT, not IoT.
B. Restricted IS → Incorrect
Restricted Information Systems (IS) refer to classified or highly controlled systems, whichdoes not apply to standard industrial machines.
C. Test Equipment → Incorrect
Test equipment includes diagnostic tools or measurement devicesused forquality assurance, not industrial machine controllers.
D. Operational Technology → Correct
Machine controllers and assembly machinesare part ofindustrial automation and control systems, which are classified asOperational Technology (OT).
CMMC 2.0 References Supporting This Answer:
CMMC Scoping Guidance for Level 1 & Level 2 Assessments
DefinesOperational Technology (OT) as a category of Specialized Assetsthat requirespecific security considerations.
NIST SP 800-82 (Guide to Industrial Control Systems Security)
Identifiesmachine controllers and assembly machinesas part ofOperational Technology (OT).
CMMC 2.0 Asset Classification Guidelines
Specifies thatOT systems should be documented separately in an organization ' s SSP.
Which term describes assessing the ability of a unit equipped with a system to support its mission while withstanding cyber threat activity representative of an actual adversary?
Penetration test
Black hat testing
Red cell assessment
Adversarial assessment
The term Adversarial Assessment is formally defined in DoD cyber terminology. It describes testing that evaluates a unit or system’s ability to perform its mission while facing simulated cyber threat activity representative of a real-world adversary.
Supporting Extracts from Official Content:
DoD Cybersecurity Test and Evaluation Guidebook: “Adversarial Assessment: Test conducted to evaluate a unit’s ability to support its mission while withstanding cyber threat activity representative of an actual adversary.”
Why Option D is Correct:
A penetration test is narrower and focuses on identifying vulnerabilities.
Black hat testing is not an official DoD or CMMC term.
Red cell assessment refers more broadly to force-on-force exercises and is not the term used in CMMC/governing DoD definitions.
References (Official CMMC v2.0 Content and Source Documents):
DoD Cybersecurity Test and Evaluation Guidebook.
CMMC v2.0 Governance – Source Documents (incorporating DoD definitions).
Which code or clause requires that a contractor is meeting the basic safeguarding requirements for FCI during a Level 1 Self-Assessment?
FAR 52.204-21
22CFR 120-130
DFARS 252.204-7011
DFARS 252.204-7021
1. Understanding Basic Safeguarding Requirements for FCI in CMMC Level 1
Federal Contract Information (FCI) is defined as information provided by or generated for the government under a contract that isnot intended for public release.
CMMCLevel 1is designed to ensurebasic safeguardingof FCI, aligning with15 security requirementsfound inFAR 52.204-21 (Basic Safeguarding of Covered Contractor Information Systems).
Contractors handlingonly FCImust meetCMMC Level 1, which alignsdirectlywith the safeguarding requirements set inFAR 52.204-21.
2. FAR 52.204-21 and Its Role in CMMC Level 1 Compliance
FAR 52.204-21establishes the baseline cybersecurity controls that contractors must implement to protectFCI.
The15 basic safeguarding requirementsinclude:
Limiting information accessto authorized users.
Identifying and authenticating usersbefore allowing system access.
Protecting transmitted FCIfrom unauthorized disclosure.
Monitoring and controlling connectionsto external systems.
Applying boundary protectionand cybersecurity measures.
Sanitizing mediabefore disposal.
Updating security configurationsto reduce vulnerabilities.
Providing physical securityprotections.
Controlling physical accessto systems that process FCI.
Enforcing multi-factor authentication (MFA) where applicable.
Patching vulnerabilitiesin software and hardware.
Limiting the use of removable media.
Creating and retaining system audit logs.
Performing risk-based security assessments.
Developing an incident response plan.
These 15 practices form thefoundationof CMMCLevel 1 Self-Assessment, ensuring contractorsmeet minimum cybersecurity expectationsfor handling FCI.
3. Why the Other Options Are Incorrect
B. 22 CFR 120-130:
This refers toInternational Traffic in Arms Regulations (ITAR), which controls the export of defense-related articles and services,notFCI safeguarding requirements.
C. DFARS 252.204-7011:
This clause refers toalternative line item structuresand does not pertain to cybersecurity or safeguarding FCI.
D. DFARS 252.204-7021:
This clause enforcesCMMC requirementsbut doesnot definebasic safeguarding controls. It requires compliance with CMMC but does not specify the foundational requirements (which come fromFAR 52.204-21for Level 1).
4. Official CMMC 2.0 Reference & Study Guide Alignment
TheCMMC 2.0 model documentationconfirms that Level 1 is focused on the15 practices from FAR 52.204-21.
TheDoD’s official CMMC Assessment Guidefor Level 1 explicitly states that meeting FAR 52.204-21 is therequirement for passing a Level 1 Self-Assessment.
TheCMMC 2.0 Scoping Guideclarifies that contractors handling onlyFCIand seekingLevel 1 certificationmust implementonly FAR 52.204-21security controls.
Final Confirmation:
The correct answer isA. FAR 52.204-21, as it directly governs the basic safeguarding ofFCIand is the foundational requirement for aLevel 1 Self-Assessmentin CMMC 2.0.
A test or demonstration is being performed for the Assessment Team during an assessment. Which environment MUST the OSC perform this test or demonstration?
Client
Production
Development
Demonstration
Understanding the Assessment Environment Requirement
During aCMMC Level 2 assessment, assessors requireobjective evidencethat security controls are implementedin the actual operating environmentwhereControlled Unclassified Information (CUI)is handled.
This means thattests or demonstrations must be conducted in the production environment, where the organization’s real systems and security controls are in use.
Why Option B (Production) is Correct
Assessment teams need to validate security controls in the actual environment where they are applied, ensuring that security measures are in effect in thereal-world operating conditions.
Option A (Client)is incorrect because " Client " is not a defined assessment environment.
Option C (Development)is incorrect because testing in a development environmentdoes not accurately represent the production security posture.
Option D (Demonstration)is incorrect becausedemonstrations in a separate test environment do not provide valid evidence for CMMC assessments—actual security implementations must be verified in production.
Official CMMC Documentation References
CMMC Assessment Process (CAP) Guide – Section 3.5 (Assessment Methods)
NIST SP 800-171 Assessment Procedures(Verification must occur in the actual system where CUI resides.)
Final Verification
SinceCMMC assessments require security controls to be validated in the actual production environment, the correct answer isOption B: Production.
During a CMMC readiness review, the OSC proposes that an associated enclave should not be applicable in the scope. Who is responsible for verifying this request?
CCP
C3PAO
Lead Assessor
Advisory Board
During aCMMC readiness review, anOrganization Seeking Certification (OSC)may argue that a specificenclave (network segment or system) is out of scopefor assessment. TheLead Assessor is responsible for verifying and approving this request.
Roles and Responsibilities in CMMC Assessments:
Certified CMMC Professional (CCP)
A CCP supports OSCs inpreparing for assessmentsbutdoes not make final scope determinations.
Certified Third-Party Assessment Organization (C3PAO)
The C3PAOoversees the assessmentbut doesnot personally verify scope exclusions—that falls under theLead Assessor’s role.
Lead Assessor (Correct Answer)
TheLead Assessor has the authorityto determine if anenclave is out of scopebased on OSC-provided evidence.
The Lead Assessor followsCMMC Assessment Process (CAP) guidelinesto ensure proper scoping.
Advisory Board
TheCMMC-AB (Advisory Board) does not make scope determinations. It focuses onprogram oversightandcertification processes.
Official References Supporting the Correct Answer:
CMMC Assessment Process (CAP) v1.0
TheLead Assessor is responsible for confirming the assessment scopeand determining enclave applicability.
CMMC Scoping Guidance for Level 2 Assessments
Requires theLead Assessor to review and approve any enclave exclusionsbefore finalizing the assessment scope.
Conclusion:
TheLead Assessoris the correct answer because they have the authority to verify scope determinations during the assessment.
✅Correct Answer: C. Lead Assessor
In the Code of Professional Conduct, what does the practice of Professionalism require?
Do not copy materials without permission to do so.
Do not make assertions about assessment outcomes.
Refrain from dishonesty in all dealings regarding CMMC.
Ensure the security of all information discovered or received.
What Does the Practice of Professionalism Require in the CMMC Code of Professional Conduct?
TheCMMC Code of Professional Conduct (CoPC)sets ethical and professional standards forCertified CMMC Assessors (CCAs) and Certified CMMC Professionals (CCPs).Professionalismrequireshonesty and integrity in all CMMC-related activities.
Step-by-Step Breakdown:
✅1. Professionalism Requires Ethical Behavior
TheCoPC states that professionalismincludes:
Acting with integrityin all assessment-related activities.
Providing truthful and objective assessmentsof cybersecurity practices.
Avoiding deceptive or misleading claimsabout assessments or compliance.
✅2. Why the Other Answer Choices Are Incorrect:
(A) Do not copy materials without permission to do so❌
This falls underIntellectual Property (IP) protection, notProfessionalism.
(B) Do not make assertions about assessment outcomes❌
Assessorsmustprovide findings based on evidence. The rule is aboutnot making false or misleading claims, not about avoiding assertions altogether.
(D) Ensure the security of all information discovered or received❌
This falls underConfidentiality, notProfessionalism.
Final Validation from CMMC Documentation:
TheCMMC Code of Professional Conduct (CoPC)definesProfessionalism as requiring honesty and integrityin allCMMC-related activities.
Thus, the correct answer is:
✅C. Refrain from dishonesty in all dealings regarding CMMC.
An organization ' s sales representative is tasked with entering FCI data into various fields within a spreadsheet on a company-issued laptop. This laptop is an FCI Asset being used to:
process and transmit FCI.
process and organize FCI.
store, process, and transmit FCI.
store, process, and organize FCI.
According to the CMMC Scoping Guidance, Level 1, the fundamental definition of an FCI Asset is any asset that performs at least one of three primary functions with Federal Contract Information (FCI). These functions are consistently defined across both Level 1 and Level 2 documentation as Processing, Storing, or Transmitting.
Process: In this scenario, the sales representative is " entering FCI data into various fields. " The act of inputting, manipulating, or editing data within an application (the spreadsheet) is the definition of processing.
Store: Because the spreadsheet is on the laptop, the data resides on the laptop ' s hard drive or memory. This constitutes storing.
Transmit: While the prompt focuses on the data entry, a laptop is an endpoint designed to move data across a network (email, cloud uploads, or server saves). In the context of CMMC scoping, assets that handle protected information are categorized by their capability and role in the data lifecycle, which includes transmitting.
Why other options are incorrect:
Options B and D: These include the word " organize. " While organizing data is a task a human performs, it is not a formal technical term used in the CMMC or NIST SP 800-171/FAR 52.204-21 definitions to categorize asset functions.
Option A: This option omits " store. " Since the spreadsheet exists on the laptop, storage is a primary function being utilized.
Reference Documents:
CMMC Scoping Guidance, Level 1 (Version 2.0): Section 2.0, which defines FCI Assets as assets that " process, store, or transmit FCI. "
FAR 52.204-21 (Basic Safeguarding of Covered Contractor Information Systems): The regulatory source for Level 1, which applies to systems that " process, store, or transmit " federal contract information.
CMMC Assessment Guide, Level 1: Introduction and Scoping sections, reinforcing the triad of data handling functions.
What is the MINIMUM required marking for a document containing CUI?
" CUI " must be placed in the header and footer of the document
" WCUI " must be placed in the header and footer of the document
Portion marks must be placed on all sections, parts, paragraphs, etc. known to contain CUI
A cover page must be placed to obscure content with the acronym " CUI " prominently placed
Per DoDI 5200.48, Controlled Unclassified Information (CUI), the minimum marking requirement is that the word “CUI” must appear in the header and footer of each page of a document containing CUI. Additional markings such as portion markings or cover sheets may be applied depending on the situation, but the minimum baseline requirement is header and footer placement of " CUI " .
Reference Documents:
DoDI 5200.48,Controlled Unclassified Information (CUI)
Which term describes " the protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to. or modification of information " ?
Adopted security
Adaptive security
Adequate security
Advanced security
Understanding the Concept of Security in CMMC 2.0
CMMC 2.0 aligns with federal cybersecurity standards, particularlyFISMA (Federal Information Security Modernization Act), NIST SP 800-171, and FAR 52.204-21. One key principle in these frameworks is the implementation of security measures that are appropriate for the risk level associated with the data being protected.
The question describes security measures that are proportionate to therisk of loss, misuse, unauthorized access, or modificationof information. This matches the definition of " Adequate Security. "
Analyzing the Given Options
A. Adopted security→ Incorrect
The term " adopted security " is not officially recognized in CMMC, NIST, or FISMA. Organizations adopt security policies, but the concept does not directly align with the question’s definition.
B. Adaptive security→ Incorrect
Adaptive securityrefers to adynamic cybersecurity modelwhere security measures continuously evolve based on real-time threats. While important, it does not directly match the definition in the question.
C. Adequate security→Correct
The term " adequate security " is defined inNIST SP 800-171, DFARS 252.204-7012, and FISMAas the level of protection that isproportional to the consequences and likelihood of a security incident.
This aligns perfectly with the definition in the question.
D. Advanced security→ Incorrect
Advanced securitytypically refers tohighly sophisticated cybersecurity mechanisms, such as AI-driven threat detection. However, the term does not explicitly relate to the concept of risk-based proportional security.
Official References Supporting the Correct Answer
FISMA (44 U.S.C. § 3552(b)(3))
Definesadequate securityas " protective measures commensurate with the risk and potential impact of unauthorized access, use, disclosure, disruption, modification, or destruction of information. "
This directly matches the question ' s wording.
DFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting)
Mandates that contractors apply " adequate security " to protect Controlled Unclassified Information (CUI).
NIST SP 800-171 Rev. 2, Requirement 3.1.1
States that organizations must " limit system access to authorized users and implement adequate security protections to prevent unauthorized disclosure. "
CMMC 2.0 Documentation (Level 1 and Level 2 Requirements)
Requires that organizationsapply adequate security measures in accordance with NIST SP 800-171to meet compliance standards.
Conclusion
The term " adequate security " is the correct answer because it is explicitly defined in federal cybersecurity frameworks asprotection proportional to risk and potential consequences. Thus, the verified answer is:
During the review of information that was published to a publicly accessible site, an OSC correctly identifies that part of the information posted should have been restricted. Which item did the OSC MOST LIKELY identify?
FCI
Change of leadership in the organization
Launching of their new business service line
Public releases identifying major deals signed with commercial entities
Understanding Federal Contract Information (FCI) and Publicly Accessible Information
Federal Contract Information (FCI)isnon-public informationprovided by or generated for the U.S. governmentunder a contractthat isnot intended for public release.
Key Characteristics of FCI:
✔FCI includesdetails related togovernment contracts, project specifics, and performance data.
✔It must be protected under FAR 52.204-21, which requiresbasic safeguarding measuresto prevent unauthorized access.
✔Posting FCI on a public site is a security violationsince it ismeant to be restrictedfrom public disclosure.
Why is the Correct Answer " A. FCI (Federal Contract Information) " ?
A. FCI → Correct
FCI must be protected from unauthorized access, and if it wasincorrectly published online, it should have been restricted.
B. Change of leadership in the organization → Incorrect
Leadership changes are typically public informationand do not require restriction unless they involve sensitive government-related security clearances.
C. Launching of their new business service line → Incorrect
Marketing and business announcementsare generallypublicly availableandnot restricted information.
D. Public releases identifying major deals signed with commercial entities → Incorrect
Commercial contracts and business deals are not considered FCIunless they involvegovernment contracts.
CMMC 2.0 References Supporting This Answer:
FAR 52.204-21 (Basic Safeguarding of Covered Contractor Information Systems)
DefinesFCI as sensitive but unclassified informationthat must beprotected from public disclosure.
CMMC 2.0 Level 1 Requirements
Requires contractors toprotect FCI under basic cybersecurity standardsto prevent unauthorized exposure.
DoD Guidance on FCI Protection
States thatpublishing FCI on public websites violates federal cybersecurity requirements.
A company is about to conduct a press release. According to AC.L1-3.1.22: Control information posted or processed on publicly accessible systems, what is the MOST important factor to consider when addressing CMMC requirements?
That the information is correct
That the CEO approved the message
That the company has to safeguard the release of FCI
That so long as the information is only FCI, it can be released
Step 1: Understanding AC.L1-3.1.22
AC.L1-3.1.22states: " Control information posted or processed on publicly accessible systems. "
This control requires organizations toensure that FCI (Federal Contract Information) is not publicly postedor made accessible in an uncontrolled manner.
FCI must beprotected from unauthorized disclosure, even if it is not classified or CUI.
Who is the FedRAMP certification program for?
IT contractors risk management self-assessments
Cloud service providers for cloud products and services
IT contractors for cybersecurity self-assessments
Cloud service providers for on-premise products and services
The correct answer is B because FedRAMP is a federal authorization program for cloud services, not a self-assessment framework for ordinary IT contractors and not a program for on-premise products. In the CMMC context, FedRAMP becomes especially important when a contractor uses an external cloud service provider to store, process, or transmit covered defense information or CUI. DFARS 252.204-7012 requires the contractor to ensure that the cloud service provider meets security requirements equivalent to the FedRAMP Moderate baseline when covered defense information is handled in an external cloud service. FedRAMP itself also maintains a marketplace of certified cloud services, authorizing agencies, and recognized assessors. Therefore, the target participants are cloud service providers offering cloud products and services that need federal authorization or recognition. Options A and C incorrectly frame FedRAMP as a contractor self-assessment model. Option D is wrong because FedRAMP is focused on cloud service offerings, not traditional on-premise products or services. Reference/topics: FedRAMP, cloud service providers, DFARS 252.204-7012, external cloud services, FedRAMP Moderate baseline.
Which resource contains authoritative data classifications of CUI?
NARA
CMMC-AB
DoD Contractors FAQ
OSC ' s privacy policies
The National Archives and Records Administration (NARA) serves as the authoritative body overseeing the Controlled Unclassified Information (CUI) program within the United States federal government. NARA maintains the CUI Registry, which is the definitive resource for all categories, subcategories, and associated markings of CUI. This registry provides comprehensive guidance on the identification and handling of CUI, ensuring standardized practices across federal agencies and their contractors.
The other options are delineated as follows:
CMMC-AB:The Cybersecurity Maturity Model Certification Accreditation Body is responsible for overseeing the CMMC program but does not manage CUI classifications.
DoD Contractors FAQ:While it may offer guidance to Department of Defense contractors, it is not an authoritative source for CUI data classifications.
OSC ' s privacy policies:An Organization Seeking Certification ' s internal policies pertain to its own data handling practices and are not authoritative for CUI classifications.
Therefore, for authoritative information on CUI data classifications, the NARA ' s CUI Registry is the appropriate resource.
A CCP is part of a CMMC Assessment Team interviewing a subject-matter expert on Access Control (AC) within an OSC. During the interview process, what will the CCP ensure about the information exchanged during the interview?
Performed in groups for more efficient use of resources
Recorded for inclusion in the Final Recommended Findings report
Confidential and non-attributable so interviewees can speak without fear of reprisal
Mapped to specific CMMC practices to clearly delineate which practice is being evaluated
Understanding the Role of a CCP in CMMC Assessments
ACertified CMMC Professional (CCP)is responsible for assistingCertified CMMC Assessors (CCA)in evaluating anOrganization Seeking Certification (OSC)during a CMMC assessment. One key aspect of this process isconducting interviewswith Subject Matter Experts (SMEs) to verify security practices.
Ensuring that interviewees canspeak freely without fear of retaliationiscriticalto obtainingaccurate and unbiased informationabout the implementation of security controls.
Step-by-Step Breakdown:
CMMC Assessment Process and the Role of Interviews
TheCMMC Assessment Guide (Level 2)outlines that interviews are conducted to confirm that security practices are effectively implemented.
Interviewees mustfeel comfortable sharing candid responseswithout concern that their statements will lead tonegative consequenceswithin the organization.
Ensuring Confidentiality and Non-Attribution
DoD Assessment Methodologyspecifies that interviews should be conductedconfidentiallytoprotect the identity of interviewees.
TheCMMC Code of Professional Conduct (CoPC)for assessors and professionals reinforces the requirement to maintain theconfidentialityof assessment participants.
Non-attributionensures that responses are used for evaluation purposeswithout linking statements to specific individuals.
Why the Other Answer Choices Are Incorrect:
(A) Performed in groups for more efficient use of resources:
Group interviews may prevent individuals from speaking openly.
Employees might be hesitant to contradict leadership or peers.
(B) Recorded for inclusion in the Final Recommended Findings report:
Interviews arenot directly recorded or attributedin assessment reports.
Instead, findings are documentedwithout identifying specific individuals.
(D) Mapped to specific CMMC practices to clearly delineate which practice is being evaluated:
While responsesinformwhich practices are being assessed, theprimary goalof an interview is to ensure accurate,unbiased information gathering.
Final Validation from CMMC Documentation:
According to theCMMC Assessment Guide and DoD Assessment Methodology, interview confidentiality iscrucialto gatheringaccurateandunbiasedresponses. This makesconfidentiality and non-attributionthe correct answer.
Thus, the correct answer is:
C. Confidential and non-attributable so interviewees can speak without fear of reprisal.
During the planning phase of a CMMC Level 2 Assessment, the Lead Assessor is considering what would constitute the right evidence for each practice. What is the Assessor attempting to verify?
Adequacy
Sufficiency
Process mapping
Assessment scope
Understanding Evidence Sufficiency in CMMC Level 2 Assessments
During aCMMC Level 2 Assessment, theLead Assessormust determine whether the evidence collected for each practice issufficientto support an assessment finding. This aligns with theCMMC Assessment Process (CAP) Guide, which requires assessors to evaluate:
Examinations– Reviewing documents, configurations, and system records.
Interviews– Speaking with personnel to confirm implementation and understanding.
Testing– Observing security controls in action to validate effectiveness.
To determine whether evidence issufficient, the assessor ensures that it:
Directly supports the assessment objective.
Demonstrates that the practice is consistently implemented.
Can be independently verified.
Why Option B (Sufficiency) is Correct
Sufficiencyrefers to whetherenoughevidence has been collected to make an accurate determination about compliance.
Option A (Adequacy)is incorrect because adequacy relates tothe qualityof evidence, while sufficiency focuses on whetherenoughevidence exists.
Option C (Process Mapping)is incorrect because process mapping is used for understanding workflows but is not an assessment verification method.
Option D (Assessment Scope)is incorrect because defining the scope happensbeforeevidence collection, during the planning phase.
Official CMMC Documentation References
CMMC Assessment Process (CAP) Guide – Section 3.6 (Determining Sufficiency of Evidence)
CMMC Level 2 Assessment Guide – Evidence Collection and Evaluation
Final Verification
Since theLead Assessor is ensuring enough evidence is available to verify compliance, the correct answer isOption B: Sufficiency.
While conducting a CMMC Level 2 Assessment, a CCP is reviewing an OSC ' s personnel security process. They have a policy that describes screening individuals prior to authorizing access to CUI, but it does not mention what organizations should be looking for in an individual. There is no link to a process or procedural document. What should the OSC evaluate when screening individuals prior to accessing CUI?
They are trusted and well liked
They are a hard and loyal worker
Their conduct, integrity, and loyalty
Their functionality, reliability, and ability to adapt
Under NIST SP 800-171, Personnel Security (PS) family, requirement PS.L2-3.9.1, organizations must screen individuals prior to granting access to CUI. The screening is intended to evaluate conduct, integrity, and loyalty to ensure that individuals can be trusted with sensitive information.
Supporting Extracts from Official Content:
NIST SP 800-171 Rev. 2, PS.L2-3.9.1: “Screen individuals prior to authorizing access to organizational systems containing CUI… Screening is intended to assess an individual’s conduct, integrity, judgment, loyalty, and reliability.”
CMMC Level 2 Assessment Guide (Personnel Security practices): confirms that screening covers conduct, integrity, and loyalty.
Why Option C is Correct:
The key attributes explicitly listed are conduct, integrity, and loyalty.
Options A and B describe subjective or informal measures, not compliance criteria.
Option D uses terms not aligned with the official requirement.
References (Official CMMC v2.0 Content):
NIST SP 800-171 Rev. 2, Personnel Security controls.
CMMC Assessment Guide, Level 2 – PS.L2-3.9.1.
===========
A company has a government services division and a commercial services division. The government services division interacts exclusively with federal clients and regularly receives FCI. The commercial services division interacts exclusively with non-federal clients and processes only publicly available information. For this company ' s CMMC Level 1 Self-Assessment, how should the assets supporting the commercial services division be categorized?
FCI Assets
Specialized Assets
Out-of-Scope Assets
Operational Technology Assets
Understanding CMMC Asset Categorization
TheCMMC 2.0 Scoping Guidedefines how assets are categorized based on their involvement withFederal Contract Information (FCI)andControlled Unclassified Information (CUI).
In this scenario:
Thegovernment services divisioninteracts withfederal clientsandreceives FCI, making its assetsin-scopefor CMMC Level 1.
Thecommercial services divisioninteractsonly with non-federal clientsanddoes not handle FCI—this means its assets arenot subject to CMMC Level 1 requirementsand should be classified asOut-of-Scope Assets.
CMMC 2.0 Definition of Out-of-Scope Assets
As per theCMMC Scoping Guide, assets that:
✅Do not store, process, or transmit FCI/CUI
✅Do not directly impact the security of in-scope assets
✅Are completely segregated from the FCI/CUI environment
are classified asOut-of-Scope Assets.
Since thecommercial services divisiononly processespublicly available information and has no interaction with FCI, its assets areout-of-scopefor CMMC Level 1 assessment.
Why the Other Answers Are Incorrect
A. FCI Assets
❌Incorrect. FCI assets areonly those that store, process, or transmit FCI. The commercial services division doesnothandle FCI, so its assets donotqualify.
B. Specialized Assets
❌Incorrect. Specialized assets refer toInternet of Things (IoT), Operational Technology (OT), and test equipment. These donot applyto a general commercial services division.
D. Operational Technology Assets
❌Incorrect.Operational Technology (OT) Assetsinvolveindustrial control systems, SCADA, and manufacturing equipment—which are not relevant to this scenario.
CMMC Official References
CMMC 2.0 Scoping Guide – Level 1 & Level 2
CMMC Assessment Process (CAP) Document
Thus,option C (Out-of-Scope Assets) is the correct answerbased on official CMMC scoping guidance.
What service is the MOST comprehensive that the RPO provides?
Training services
Education services
Consulting services
Assessment services
Understanding the Role of a Registered Provider Organization (RPO)
ARegistered Provider Organization (RPO)is an entity recognized by theCMMC Accreditation Body (CMMC-AB)to provideconsulting servicesto organizations seekingCMMC certification.
Key Functions of an RPO
✅Consulting servicesto help companies prepare for CMMC assessments.
✅Guidance on security controlsrequired for compliance.
✅Assistance with documentation, policy development, and gap analysis.
✅Preparation for third-party CMMC assessmentsbutdoes not conduct official CMMC assessments(this is the role of a C3PAO).
Why " Consulting Services " is the Correct Answer?
Consulting servicesare thebroadest and most comprehensivefunction of an RPO.
RPOs do not conduct assessments(eliminating option D).
Training and educationmay be part of consulting but arenot the primary function(eliminating A and B).
Consulting includes training, guidance, documentation assistance, and security readiness, making it themost comprehensive service offered.
Breakdown of Answer Choices
Option
Description
Correct?
A. Training services
❌Incorrect–RPOs may provide training, but this isnot their primary function.
B. Education services
❌Incorrect–Similar to training, butnot the most comprehensive service.
C. Consulting services
✅Correct – The core function of an RPO is consulting, which includes various readiness services.
D. Assessment services
❌Incorrect–Only aC3PAO (Certified Third-Party Assessment Organization)can conductofficial CMMC assessments.
Official References from CMMC 2.0 Documentation
TheCMMC-AB RPO Programdefines an RPO as aconsulting organization that assists companies in preparing for CMMC certificationbutdoes not perform assessments.
Final Verification and Conclusion
The correct answer isC. Consulting services, asRPOs primarily provide advisory and readiness supportto organizations preparing forCMMC compliance.
An Assessment Team is reviewing a practice that is documented and being checked monthly. When reviewing the logs, the practice is only being completed quarterly. During the interviews, the team members say they perform the practice monthly but only document quarterly. Is this sufficient to pass the practice?
No, the work is not being done as stated.
Yes, the practice is being done as documented.
No, all three assessment methods must be met to pass.
Yes. the interview process is enough to pass a practice.
In a CMMC Level 2 Assessment, an assessor must achieve a high level of confidence that a practice is both implemented and institutionalized. This is determined through the Examine, Interview, and Test (E-I-T) methods as outlined in NIST SP 800-171A and the CMMC Assessment Process (CAP).
Conflict of Evidence: The scenario presents a direct conflict between the three pillars of evidence. The Policy/Documentation (Examine) states the practice occurs monthly. The Logs/Artifacts (Examine/Test) show it occurs quarterly. The Interviews claim it happens monthly but is only recorded quarterly.
The " Not Met " Determination: Under the CAP, if the evidence collected does not consistently support the assessment objective, the practice cannot be marked as " Met. " Specifically:
Adequacy and Sufficiency: The logs (the primary proof of performance) are insufficient to prove the monthly requirement stated in the documentation.
Inconsistency: Assessors look for " corroboration. " When interviews contradict the physical artifacts (the logs), the objective evidence (the logs) carries significant weight. If a practice is required monthly but only recorded quarterly, the assessor cannot verify that it was actually performed during the missing months.
Why other options are incorrect:
Option B: The practice isnotbeing done as documented because the documentation says " monthly " and the logs only show " quarterly. "
Option C: This is a common misconception. Not all three methods (E, I, and T) are required foreverysingle practice (the Assessment Guide specifies which are required), but allusedmethods must yield consistent " Met " results.
Option D: Interviews alone are almost never sufficient to pass a practice that requires technical or administrative artifacts (logs).
Reference Documents:
CMMC Assessment Process (CAP) v1.0: Section 3.4 (Collect and Verify Evidence) and Section 3.5 (Determine Findings).
CMMC Level 2 Assessment Guide: Introduction to Assessment Methods, emphasizing that findings must be supported by the " preponderance of evidence. "
NIST SP 800-171A: Chapter 2, " Assessment Procedures, " regarding the necessity of artifacts to prove implementation over time.
What is a conflict of interest?
Lack of transparency.
Any violation of the law.
A perceived or actual conflict.
Any inadvertent disclosure.
The correct answer is C because the CMMC ecosystem treats conflicts of interest as both actual and perceived conflicts. The CMMC Code of Professional Conduct requires CMMC ecosystem members to avoid participating in any activity, practice, or transaction that could result in an actual or perceived conflict of interest. It also requires compliance with conflict-of-interest prohibitions and restricts CMMC ecosystem members from participating in a Level 2 certification process where their prior role or relationship could compromise objectivity.
A conflict of interest exists when professional judgment, independence, or impartiality could be affected, or reasonably appear to be affected, by another interest, relationship, duty, or prior activity. In CMMC, this is especially important because assessment credibility depends on independence between consulting and certification assessment functions. For example, an assessor or C3PAO that previously helped design, implement, or remediate the OSC’s cybersecurity program may have an actual or perceived conflict when later assessing that same OSC. Option A is incorrect because lack of transparency may contribute to a conflict issue, but it is not the definition. Option B is too broad because not every legal violation is a conflict of interest. Option D describes a disclosure problem, not a conflict of interest. Therefore, the best answer is C , a perceived or actual conflict.
===========
During a POA & M closeout assessment , the Lead Assessor and team members verified all evidence provided by the OSC and passed those that satisfied the requirements. Who MUST verify that every failed practice from the initial original assessment has been adequately addressed?
OSC
CCA
OSC sponsor
Lead Assessor
In CMMC v2.0, the closeout activity for remediating previously unmet requirements is handled through the POA & M closeout process described in the CMMC Assessment Process (CAP) v2.0 . CAP v2.0 makes clear that the C3PAO must follow DoD’s POA & M closeout procedures and that the Assessment Team performs the closeout work, with the assessment results then undergoing a required quality assurance (QA) review .
Operationally, the person who must ensure that each previously failed requirement is adequately addressed during the closeout assessment is the Lead Assessor (Lead CCA) , because the Lead CCA is the individual designated to oversee and manage the Assessment Team on behalf of the C3PAO for the conduct of the certification assessment. In other words, while team members may test controls and collect evidence, the Lead CCA is accountable for directing the assessment effort and ensuring that remediation evidence supports updated determinations.
CAP v2.0 also states that a QA individual performs a quality assurance review of the POA & M closeout “upon completion by the Assessment Team,” including checks on the accuracy and completeness of evaluation of POA & M security requirements before upload to eMASS. This reinforces that verification occurs through the assessment team’s work, led by the Lead Assessor , and then independently quality-checked by QA.
===========
CMMC scoping covers the CUI environment encompassing the systems, applications, and services that focus on where CUI is:
received and transferred.
stored, processed, and transmitted.
entered, edited, manipulated, printed, and viewed.
located on electronic media, on system component memory, and on paper.
TheCMMC Scoping Guide for Level 2outlines thatCUI assetsinclude systems, applications, and services thatstore, process, or transmitControlled Unclassified Information (CUI). These are the three core functions that defineCUI handlingwithin anOrganization Seeking Certification (OSC).
Step-by-Step Breakdown:
✅1. CUI Assets Defined in CMMC
Stored:CUI is saved on hard drives, cloud storage, or databases.
Processed:CUI is actively used, modified, or analyzed by applications and users.
Transmitted:CUI is sent between systems via email, file transfers, or network communication.
✅2. Why the Other Answer Choices Are Incorrect:
(A) Received and transferred❌
Whilereceiving and transferring CUIis part of handling CUI, it does not fully cover all CUI asset responsibilities.
(C) Entered, edited, manipulated, printed, and viewed❌
These arespecific actionswithinprocessingbut do not coverstorage or transmission, which are also required for CMMC scoping.
(D) Located on electronic media, on system component memory, and on paper❌
While CUI can exist inelectronic and physical forms, CMMC scoping focuses onhow CUI is actively managed (stored, processed, transmitted)rather than where it physically resides.
Final Validation from CMMC Documentation:
TheCMMC Level 2 Scoping Guideconfirms thatCUI Assets are categorized based on their role in storing, processing, or transmitting CUI.
NIST SP 800-171also defines these three functions as key components of CUI protection.
Copyright © 2014-2026 Certensure. All Rights Reserved