The Outdated Deck and the Learner Who Wants a Prediction
You are a CMMC Certified Instructor (CCI) contracted by a Licensed Training Provider (LTP) to deliver a one-day 'CMMC Level 2 Implementation' course to 22 learners. Two days before delivery, the LTP sends the required slide deck. It still teaches five maturity levels, says Level 3 requires 130 practices, and states that POA&Ms are always permitted at every level. You know the current CMMC 2.0 model has three levels, that Level 2 aligns to the 110 practices in NIST SP 800-171, and that Level 3 draws on NIST SP 800-172. The LTP owner says, 'The government contract requires this exact deck-teach it as written.' The cohort includes a C3PAO lead assessor and two DoD program officials. After registration, a learner emails asking you to review their client's system security plan after class and tell them whether they will pass.
1. What should you do about the inaccurate slides before and during delivery? Explain the competing obligations and a defensible course of action.
Read the worked answer
The CCI's first obligation is accurate instruction. A contract clause cannot convert known false statements into acceptable content. Before class, send the LTP a written, specific correction list: CMMC 2.0 has three levels, not five; Level 2 aligns to 110 NIST SP 800-171 practices; Level 3 is based on a subset of NIST SP 800-172; and POA&M eligibility is not 'always'-it depends on program rules and assessment type. Ask for an approved corrected deck or written permission to use a supplemental correction sheet. Do not quietly teach the old model. If the LTP refuses, state that you cannot present the material as current; escalate through the LTP's quality or compliance channel and, if necessary, the certifying body. During class, if corrections are still needed, label them clearly as updates and explain why the slide is outdated. Do not embarrass the LTP, but do not leave learners with a false model. Document all communications.
2. How should you respond to the learner's request to review the SSP and predict pass or fail?
Read the worked answer
Decline. The request mixes instructor, consultant, and assessor roles. A CCI may explain how assessment scoping, evidence, and objectives work in general, but should not review a specific client's SSP, interpret their evidence, or predict pass or fail. Those conclusions belong to an authorized assessment team-typically a C3PAO or CCA for a Level 2 third-party assessment-or to the appropriate self-assessment process. Explain the boundary to the learner, offer general resources or a referral to an RPO or C3PAO, and document the exchange. If you also consult, do not use classroom access or learner information for that work, and disclose any conflict. The safe rule is teach the process, do not apply it to a client's certification decision.
3. Where is the line between explaining assessment concepts and providing assessment or consulting services?
Read the worked answer
The line is application to a specific organization's compliance status. Teaching may include what the model requires, what evidence types look like, how assessors sample, how scoping changes the boundary, and common failure modes. It becomes consulting or assessment when you evaluate the client's actual SSP, policies, configuration, or evidence; write or rewrite their artifacts; design remediation for them; or state whether they will pass. A CCI can use hypothetical examples and public checklists. If asked for client-specific help, refer out or switch roles under a separate engagement with proper independence. Never use the classroom to generate assessment business or to pre-judge a C3PAO outcome.