CMMC CCA common mistakes
CMMC CCA · Understand the traps and how to avoid them.
When asked who issues a CMMC Level 2 certificate, the candidate answers 'the C3PAO that conducted the assessment,' or confuses the Cyber AB accreditation role with the DoD/PMO program-ownership role in a scenario question.
The candidate memorized a list of organizations but never built a role map, so assessor, assessment organization, accreditation body, and authorizing program office collapse into one actor under exam pressure.
What to do instead
Build a one-page role map and rehearse it: who accredits C3PAOs, who certifies individual assessors, who performs the assessment, who issues the Level 2 certificate, and who owns the overall program. For every named role, state (a) what it authorizes, (b) what it receives, (c) what it must never do.
In a scenario where the assessor's firm previously performed consulting or remediation work for the organization being assessed, the candidate proceeds with the assessment because the prior work 'was years ago' or 'was a different team,' without disclosure or recusal.
The Code of Professional Conduct is studied as abstract ethics language rather than as an operational decision rule, so the candidate evaluates the situation on intent ('I can be objective') instead of on the prohibited-relationship test.
What to do instead
Convert the code into decision gates. Before any engagement, run a conflict screen covering prior consulting, remediation support, employment relationships, and financial interest; when a conflict exists, the answer is disclose and decline/withdraw, not mitigate and proceed. Practice by classifying written scenarios as 'acceptable,' 'disclose and proceed,' or 'must decline.'
The candidate accepts the organization's own scope statement, SSP boundary diagram, or asset list as the assessment scope and moves straight to practice validation, without independently reconciling it against data flows, cloud/ESP services, and contractor-operated assets.
Scoping is treated as paperwork the customer supplies rather than a validation activity the assessor owns; the candidate also forgets that externally provided services and security protection assets can fall inside the boundary even when they are not owned by the organization.
What to do instead
Always drive scoping from a three-way reconciliation: SSP narrative, boundary/network diagram, and asset inventory plus data-flow documentation, with interview confirmation. Explicitly classify each asset as CUI asset, security protection asset, contractor risk managed asset, or specialized asset, and document the include/exclude rationale for every exclusion before any practice is assessed.
The candidate jumps into collecting artifacts and validating practices before the planning-phase outputs are complete and agreed, or answers sequencing questions by describing evidence collection as the first step of the assessment.
Candidates with hands-on security backgrounds default to the technical work they know; the CAP phases blur together, so sequence, prerequisites, and phase deliverables become interchangeable in their mental model.
What to do instead
Memorize the CAP as an ordered set of phases with named inputs and outputs, and for each phase be able to state the entry condition, the artifacts produced, and the exit condition. When you see a sequencing question, first ask which phase the scenario is actually in, then pick the answer that respects the dependency order.
The candidate marks a practice MET because a policy, procedure, or screenshot exists, even though one of the practice's assessment objectives is not satisfied, or marks it NOT MET because a single artifact was unavailable without considering other evidence methods.
The candidate reasons from the NIST SP 800-171 requirement text as a single obligation instead of decomposing it into the discrete assessment objectives in the companion assessment-procedures material, and treats documentation as the strongest form of evidence.
What to do instead
For every practice, recite all of its assessment objectives first and assign a determination to each objective, then roll up to the practice-level determination. Only when every objective is satisfied is the practice MET. Treat policy as one evidence method among examination, interview, and demonstration, not as the conclusion itself.
The candidate proposes a POA&M for every unmet practice encountered during a Level 2 certification assessment, or states that open items can remain unresolved indefinitely as long as a remediation plan exists.
The candidate generalizes from self-assessment or from generic corrective-action habits and never learns the certification-specific POA&M boundaries: limited eligibility of items and a fixed closeout window.
What to do instead
Learn the POA&M rules as hard constraints: which items are eligible, the maximum time allowed to close a POA&M item, what happens if it is not closed, and which findings must be resolved before a certificate can be issued. Answer POA&M questions by first applying the eligibility test, then the timeline test.
During interviews the candidate asks closed or leading questions ('You do rotate passwords quarterly, correct?') and then records the practice as met on the strength of the affirmative verbal answer alone.
The candidate is optimizing for schedule and rapport, and unconsciously treats the interviewee as a witness who confirms conclusions already drafted rather than as one evidence source to be corroborated.
What to do instead
Prepare interview guides per practice with open-ended prompts ('Walk me through how a new hire receives access to the CUI enclave') and never accept an assertion as stand-alone evidence: corroborate each material claim with examination of artifacts or a demonstration, and record who said what, when, and how it was verified.
The candidate lets the organization nominate the users, systems, or sites to be sampled, or selects a convenience sample of one, and then generalizes the result across the population.
Sampling feels administrative rather than evidential, so the candidate does not guard the independence of the selection or document the method.
What to do instead
Select samples yourself from the validated population, size the sample to the population and the required confidence, randomize or stratify where appropriate, document method and rationale, and treat any unreachable or substituted sample item as an exception to be resolved rather than replaced.
Findings are written as general impressions ('access control is weak', 'MFA is partially implemented') without naming the practice, the unmet assessment objective, the specific evidence examined, and the objective condition observed.
The candidate drafts the finding from memory of the interview narrative rather than from the evidence log, and uses soft language to avoid appearing harsh or to hedge uncertainty.
What to do instead
Use a fixed finding template: practice identifier, assessment objective, requirement statement, evidence examined (with artifact name and date), objective evidence of the deficiency, and the determination. Strip hedging verbs; if the evidence does not support a determination, the correct action is to collect more evidence, not to soften the sentence.
After the assessment the candidate mishandles post-assessment mechanics in scenario questions, such as assuming the assessor organization is the one that files results into the government repository, or assuming the assessor personally closes out the POA&M on the organization's behalf.
The candidate learned the technical validation content well but treated reporting and closeout as clerical detail, so the ownership of post-assessment actions was never allocated to a role.
What to do instead
Build an actor-to-action table for post-assessment: who drafts the report, who reviews and approves it, who submits it, who records the status in the government system, who owns POA&M remediation and closeout evidence, and who performs any follow-up or re-assessment. Also confirm the handling rules for the report itself before answering any distribution question.