CMMC CCA case studies
CMMC CCA · Put your knowledge to work in context.
The CMMC Certified Assessor (CCA) is a professional credential within the Cybersecurity Maturity Model Certification (CMMC) ecosystem, which is coordinated by The Cyber AB, the accreditation body that lists Assessors among the CMMC professions it recognizes. A CCA is the individual who evaluates whether a Defense Industrial Base (DIB) organization has actually implemented the practices it claims - work that depends less on memorization than on disciplined scoping, impartial evidence collection, and defensible judgment. The CMMC CCA case studies are 5 cases and about 2,290 words.
1The Readiness Reviewer Who Wants to Sign Off
You are a CCA employed by a C3PAO. Four weeks before a Level 2 certification assessment of a 150-person defense contractor, the assessment lead assigns you to the team.
480 words, about 2 min2The Laptops and Badge System the OSA Wants to Exclude
An OSA is preparing for a CMMC Level 2 assessment. Its CUI is processed in a bounded enclave: 35 Windows endpoints, two file servers, and a SIEM, all on a dedicated VLAN.
488 words, about 2 min3Service Accounts, SMB, and the MFA Practice
During a Level 2 certification assessment, you are validating practice 3.5.3, multifactor authentication. All 210 employees authenticate to Windows and the VPN with smart cards.
469 words, about 2 min4The Audit Log Evidence That Does Not Add Up
While assessing practice 3.3.1, audit logging, the OSA provides: a 12-month-old policy stating logs are retained for one year; a screenshot of a Windows event log setting showing 'Overwrite events as needed' with a 20 MB maximum; and a SIEM dashboard showing 30 days of retention. In an interview, the system administrator says logs are kept 'at least 90 days' and that the SIEM forwards everything.
426 words, about 2 min5The Post-Dated Approval Memos
Two weeks after the closeout meeting, the OSA VP of compliance emails the C3PAO a dispute: your draft report marks practice 3.4.7, deny-by-exception, 'not met' because 14 firewall rules allow any-to-any traffic between the enclave and the corporate network. The OSA attaches approval memos signed by the CIO and dated three days after the assessment ended, plus a network diagram showing the rules are 'temporary for a migration.' Your field notes show that during the assessment, the network engineer said the rules had been in place for 11 months and no one could find an approval.
427 words, about 2 min