CMMC CCA cheat sheet

CMMC 2.0 has three levels: Level 1 Foundational (15 practices from FAR 52.204-21), Level 2 Advanced (all 110 practices of NIST SP 800-171 Rev 2), and Level 3 Expert (NIST SP 800-172 requirements).

32 CFR Part 170 is the CMMC Program rule; The Cyber AB (CMMC Accreditation Body) accredits C3PAOs and credentials individual assessors, while DoD owns the program and the contract requirements.

Level 1 and some Level 2 contracts allow self-assessment with annual senior-official affirmation; a C3PAO-led Level 2 certification assessment is required when DFARS 252.204-7021 is in the contract.

Level 3 assessments are conducted by DoD's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC); C3PAOs do not perform Level 3 assessments.

Assessment results and annual affirmations are recorded in SPRS (Supplier Performance Risk System); an issued Level 2 certification remains valid for three years.

Code of Professional Conduct core obligations: integrity, objectivity, confidentiality, technical competence, and compliance with CMMC rules; alleged violations are adjudicated by The Cyber AB.

Decision rule: an assessor must decline or divest an engagement where a consulting, employment, family, or financial relationship with the contractor impairs, or appears to impair, objectivity.

Assessors are authorized to receive CUI for assessment purposes but must safeguard it under applicable handling and non-disclosure requirements; unauthorized disclosure is a conduct violation.

CAP phases in order: assessment initiation, planning, scoping, assessment (evidence collection and objective validation), reporting, and post-assessment follow-up.

Level 2 scope boundary equals CUI assets plus security protection assets; specialized assets and out-of-scope assets must be explicitly identified, justified, and risk-managed.

Required scope artifacts: asset inventory, network or data-flow diagram, system security plan, and written justification for every asset placed outside the boundary.

CUI asset definition: any asset that stores, processes, or transmits CUI, or that can reach such an asset without crossing an in-scope boundary.

Security protection assets stay in scope even when they never handle CUI, because they provide security functions that protect assets that do.

Specialized asset examples: government property, IoT/OT devices, restricted information systems, and test equipment; exclusion requires documented rationale, not silence.

Sampling of people, facilities, and assets is permitted; the sample must be representative and may be expanded when anomalies or failures are observed.

Conflict-of-interest screening and a readiness review of scope artifacts are completed before the assessment plan and schedule are finalized.

Level 2 comprises 110 practices across 14 families, decomposed into 320 assessment objectives in NIST SP 800-171A.

A practice is scored Met only when every associated assessment objective is Met; a single Not Met objective makes the entire practice Not Met.

Not Applicable is not available for Level 2 practices: all 110 apply to the in-scope environment once the contractor handles CUI.

SPRS score = 110 minus the DoD-assigned weight (1, 3, or 5) of each unmet requirement; the lowest attainable score is -203.

Conditional certification requires an assessment score of at least 80 and closure of all POA&M items within 180 days; final certification requires zero open items.

The 14 families: AC, AT, AU, CM, IA, IR, MA, MP, PS, PE, RA, CA, SC, SI.

Each assessment objective is a separate determination statement; assessors evaluate and record evidence at the objective level, then roll results up to the practice.

The 15 Level 1 practices derive from FAR 52.204-21 basic safeguarding for FCI and are not a subset substitution for the 110 Level 2 practices.

Evidence must be relevant to the objective, competent (from a reliable source), and sufficient in quantity; an assertion or a policy statement alone never supports a Met determination.

Three evidence source types: document review, interviews, and system/configuration examination; corroborate across at least two source types before concluding.

Interview technique: ask open-ended questions, avoid leading questions, interview the person who actually performs the task, and follow up on inconsistencies between statements and artifacts.

Configuration checks confirm implementation directly (for example password length, account lockout threshold, audit log retention in days) instead of relying on documented intent.

Objective validation means testing each 800-171A determination statement against actual artifacts, demonstrations, and observed behavior.

Every artifact is logged with an identifier, date, source (system or person), and the specific objective it supports.

Decision rule: when policy and observed configuration conflict, the observed implementation governs and the objective is Not Met until remediated and re-evidenced.

Sampling of interviewees and systems must be documented; assessors may increase sample size when a failure is identified in the initial sample.

Report contents: scope and boundary, assessment methodology, per-practice results, objective-level evidence references, POA&M items, and the certification recommendation.

Findings are stated against a specific practice or objective, citing the observed condition and the evidence relied upon; unsupported opinion is not a finding.

Conditional certification path: score of at least 80, POA&M items remediated and validated within 180 days, after which final certification is issued.

Certification term is three years from issuance; a recertification assessment must be completed before the expiration date to avoid a lapse.

An annual affirmation by a senior official in SPRS is required regardless of the assessment cycle and does not substitute for the certification assessment.

A significant change to the environment, boundary, or CUI handling may require re-assessment before the three-year term expires.

POA&M entries must state the requirement, the corrective action, the responsible owner, and a milestone date so closure can be objectively validated.

Post-assessment channels: the contractor may dispute findings through defined review processes, and alleged assessor conduct violations are handled by The Cyber AB.