CMMC CCA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CMMC Level 1

Foundational level requiring the 15 basic safeguarding practices from FAR 52.204-21, applicable to contractors handling Federal Contract Information, verified through self-assessment and annual senior-official affirmation.

CMMC Level 2

Advanced level requiring all 110 practices of NIST SP 800-171 Rev 2, assessed by an accredited third-party organization when the contract includes the DFARS 252.204-7021 clause.

CMMC Level 3

Expert level built on NIST SP 800-172 requirements and assessed by the Defense Industrial Base Cybersecurity Assessment Center, a government organization, rather than a commercial assessor.

C3PAO

Certified Third-Party Assessment Organization: an entity accredited by The Cyber AB to conduct CMMC Level 2 certification assessments using individually credentialed assessors.

CMMC Certified Assessor

An individual credentialed by The Cyber AB to plan and conduct CMMC assessments, bound by the Code of Professional Conduct including objectivity and conflict-of-interest obligations.

SPRS

Supplier Performance Risk System: the DoD repository where contractors post annual affirmations of compliance and where assessment scores are visible to contracting officers.

Conflict of interest rule

An assessor may not assess an organization it consulted for, and must disclose any relationship that could impair objectivity before accepting the engagement.

CMMC assessment scope

The documented set of assets and boundaries included in an assessment, consisting of CUI assets and security protection assets plus justified specialized and out-of-scope assets.

CUI asset

An asset that stores, processes, or transmits controlled unclassified information, or that can reach such an asset without crossing an assessed boundary.

Security protection asset

An asset providing security functions that protect CUI assets, such as firewalls, authentication servers, or log management systems; it remains in scope even without handling CUI directly.

Specialized asset

Government property, Internet-of-Things, operational technology, or test equipment that may be excluded from the assessment scope when documented and risk-managed by the contractor.

CMMC Assessment Process

The Cyber AB-published methodology governing how assessments are initiated, planned, scoped, conducted, reported, and closed out for CMMC certifications.

Sampling in scoping

Selecting a representative subset of people, facilities, or assets to test; sample results are not definitive and the sample may be expanded when problems appear.

Readiness review

Pre-assessment activity confirming that the system security plan, asset inventory, network diagram, and plan of action exist and agree with the declared scope.

110 practices

The total set of security requirements in NIST SP 800-171 Rev 2 that constitutes CMMC Level 2, organized into 14 control families from Access Control through System and Information Integrity.

Assessment objective

A determination statement derived from NIST SP 800-171A that an assessor evaluates as met or not met; 320 such objectives support the 110 Level 2 practices.

Met determination

A practice is scored Met only when every associated assessment objective is met and corroborated by evidence; one unmet objective makes the whole practice Not Met.

Not Applicable prohibition

Not Applicable determinations are not permitted for the 110 Level 2 practices; every practice applies once the in-scope environment handles controlled unclassified information.

SPRS score calculation

Begin at 110 and subtract the DoD-assigned weight of each unmet requirement, where weights are 1, 3, or 5 points; the lowest possible score is negative 203.

Conditional certification

A Level 2 status granted when the assessment score is at least 80 and all plan-of-action items are closed and validated within 180 days, after which final certification follows.

14 control families

Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, System and Information Integrity.

Evidence sufficiency

Evidence must be relevant to the objective, competent in that it comes from a reliable source, and sufficient in quantity for a conclusion without relying on assertion.

Three evidence sources

Document review, personnel interviews, and examination of systems or configurations; assessors corroborate across multiple source types before recording a determination.

Open-ended interview question

A question inviting narrative description rather than yes or no, used to reveal how a practice is actually performed rather than how it is documented.

Objective validation

Testing each NIST SP 800-171A determination statement directly against artifacts, demonstrations, and observed behavior instead of accepting a policy statement as proof.

Configuration check

Direct inspection of an implemented system setting, such as minimum password length or audit log retention, to confirm the configuration matches the documented requirement.

Evidence retention

Assessment artifacts, interview notes, and supporting records must be identified, dated, sourced, and retained so a reported determination can be substantiated later.

Assessment report contents

A report documents scope and boundary, methodology, results for each practice and objective, evidence references, plan-of-action items, and the overall certification recommendation.

POA&M closeout

The contractor remediates open items, submits supporting evidence, and the assessor validates closure within the 180-day window before final certification is issued.

Certification validity period

A CMMC Level 2 certification remains valid for three years from the date of issuance, subject to required annual affirmations of continued compliance.

Annual affirmation

A senior official attests in SPRS each year that the contractor continues to meet its required CMMC level; it is separate from and does not replace the certification assessment.

Finding

A documented gap between a requirement and the contractor's implemented practice, stated objectively with the observed condition and the evidence relied upon.