CMMC CCI cheat sheet

The CMMC ecosystem comprises the Department of Defense, the CMMC Accreditation Body (CMMC-AB), Certified Third-Party Assessment Organizations (C3PAOs), Registered Practitioners, Registered Provider Organizations, and Certified Assessors and Instructors.

The CMMC-AB (operating as ISACA's Cyber Certification Alliance in later transitions) authorizes and oversees C3PAOs, Certified Assessors, and Certified Instructors; it does not itself assess Organizations Seeking Certification (OSCs).

A C3PAO is the only entity authorized to conduct Level 2 certification assessments; Level 1 self-assessments are performed by the OSC and affirmed by a senior official.

Certified CMMC Instructors deliver authorized training content; they must not modify learning objectives, assessment criteria, or exam content, and must not claim official DoD endorsement.

Instructor scope includes delivering approved curricula, administering practice assessments, and maintaining learner records; it excludes issuing certifications, scoring official exams, or performing certification assessments.

The CMMC model is published by DoD and is version-controlled; instructors must teach the current published version and note effective dates of any transition.

Level 1 applies to Federal Contract Information (FCI); Level 2 applies to Controlled Unclassified Information (CUI); Level 3 adds selected NIST SP 800-172 requirements for the highest-priority programs.

CMMC requirements flow down to subcontractors through contract clauses; an instructor must explain that flow-down obligations mirror the prime's level where CUI or FCI is handled.

The CMMC model is organized as domains, capabilities, practices, and processes; practices map to security requirements and processes map to institutionalization (maturity) requirements.

Level 1 contains 17 practices drawn from FAR 52.204-21 and requires an annual self-assessment with a senior official affirmation.

Level 2 contains 110 practices aligned with NIST SP 800-171 Rev 2 and requires a C3PAO assessment every three years for certification.

Level 3 contains 110-plus Level 2 practices plus selected NIST SP 800-172 requirements; assessment is conducted by DoD (DIBCAC), not a C3PAO.

Assessment scoring at Level 2 uses a 0-1-3 point scale per requirement: 0 = not met, 1 = met, 3 = not applicable; a score of 88 of 110 is the minimum passing threshold for a perfect-condition assessment.

Conditional certification applies when a POA&M is accepted for a limited set of unmet requirements; a POA&M must be closed within 180 days of the assessment.

Assessment evidence includes policy, procedure, implementation, and test artifacts; assessors sample evidence rather than reviewing every artifact exhaustively.

Scope definition determines which assets, people, and facilities handle CUI or FCI; out-of-scope assets must be documented and technically separated from the assessment boundary.

Knowles' andragogy contrasts adult learners (self-directed, experience-rich, problem-centered) with pedagogy (instructor-directed, subject-centered).

Bloom's revised taxonomy orders cognitive objectives: Remember, Understand, Apply, Analyze, Evaluate, Create; exam-prep content should target Apply and above.

Kirkpatrick's four levels are Reaction, Learning, Behavior, Results; instructor evaluation should be planned against all four, not just Reaction.

Gagné's nine events of instruction: gain attention, state objectives, recall prior knowledge, present content, guide learning, elicit performance, provide feedback, assess, enhance retention and transfer.

Formative assessment occurs during instruction and informs adjustment; summative assessment occurs at the end and measures attainment against objectives.

Cognitive load theory distinguishes intrinsic load (task complexity) from extraneous load (poor design); reduce extraneous load via chunking, worked examples, and signaling.

Learning objectives should be measurable and use observable action verbs; avoid unobservable verbs such as 'know' or 'understand' in objectives.

Instructor feedback should be specific, timely, and behavior-focused; feedback tied to observable performance improves transfer more than praise alone.

Certified Instructors must maintain confidentiality of exam content, learner records, and proprietary CMMC-AB materials; disclosure of exam items is a code violation.

Conflict of interest must be disclosed and mitigated; an instructor may not teach or assess where a personal or financial relationship compromises objectivity.

Instructors must not provide exam answers, coach to specific exam items, or use unauthorized brain dumps; using or distributing such material violates program integrity.

Continuing education and recertification requirements must be met on schedule; lapse results in loss of certification and eligibility to deliver authorized training.

Instructors must present the CMMC model accurately and must not overstate DoD endorsement, guarantee certification outcomes, or misstate assessment costs.

Reporting obligations require disclosing known violations of the code by oneself or others to the certifying body; retaliation against reporters is prohibited.

Data handling: learner PII and assessment results must be stored securely and retained only as long as required by the certifying body's policy.

Professional conduct extends to marketing; claims of 'official' affiliation, pass-rate guarantees, or CMMC-AB endorsement in advertising are prohibited.

Assessment independence requires that a C3PAO and its assessors have no consulting relationship with the OSC within the preceding period defined by the CMMC-AB conflict-of-interest policy.

Evidence must be authentic and current; fabricated, backdated, or borrowed artifacts constitute fraud and can void a certification.

An OSC senior official must affirm the accuracy of self-assessment results; false affirmation carries legal and contractual consequences.

Assessors must document findings objectively against the requirement text, not against vendor marketing claims or personal preference.

Instructor and assessor roles are separate; an individual certified as an assessor may not use instructor access to influence assessment outcomes.

Any suspected integrity violation, including bribery or coercion of an assessor, must be reported to the CMMC-AB and may be referred to DoD.

Certification bodies conduct quality reviews and can audit instructors, C3PAOs, and OSCs; records supporting delivery and assessment must be retained.

Appeals of assessment results follow the certifying body's defined dispute process; public disparagement of the process is permitted but misrepresentation of outcomes is not.

CMMC certification at Level 2 is valid for three years; a reassessment is required at renewal unless an extension is granted under defined conditions.

Level 1 self-assessments are annual and require affirmation by a senior official; results are entered into the Supplier Performance Risk System (SPRS).

Affirmation and assessment results are recorded in SPRS, which contracting officers use to verify compliance before award.

A POA&M submitted for conditional certification must be closed within 180 days; failure to close results in loss of certification status.

The CMMC-AB authorizes C3PAOs through a formal approval process, including assessor certification, quality management, and conflict-of-interest controls.

DoD may conduct DIBCAC assessments at Level 3 and may audit Level 1 and Level 2 results for quality assurance.

Changes to the CMMC model are published with effective dates; contracts incorporate the version in effect at solicitation, and instructors must track revisions.

Subcontractor flow-down requires the prime to verify subcontractor compliance at the applicable level; failure to do so is a prime contract risk.

Constructive alignment requires that learning objectives, instructional activities, and assessments measure the same cognitive level and content.

A test blueprint maps exam items to domains and objectives by weight; use it to verify coverage before delivery.

Item quality rules: one correct answer, plausible distractors, no double negatives, no 'all of the above', and no clues in the stem.

Item difficulty and discrimination indices inform revision; items answered correctly by nearly all learners provide little information.

Practice assessments must be original and must not reproduce live exam items; reuse of protected content violates program integrity.

Reliability refers to consistency of scores across administrations; validity refers to whether the assessment measures the intended objective.

Rubrics for performance tasks should state observable criteria and rating levels; inter-rater agreement should be checked when multiple instructors score.

Accessibility and accommodation requests should be handled per the certifying body's policy without altering the assessed objective.

Level 2 practices are grouped into 14 domains, including Access Control, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, and Risk Assessment.

Access Control (AC) practices limit information flow and enforce least privilege; a common failure is undocumented flow-control enforcement.

Audit and Accountability (AU) requires review and analysis of audit records, not merely log generation; review evidence is frequently missing.

Configuration Management (CM) requires baseline configuration, change control, and security impact analysis for changes.

Identification and Authentication (IA) requires multifactor authentication for privileged and non-privileged network access, with limited exceptions.

Incident Response (IR) requires testing the response capability, tracking incidents, and reporting to designated authorities within required timeframes.

Risk Assessment (RA) requires periodic assessment and vulnerability scanning; scanning without remediation tracking is a common gap.

System and Information Integrity (SI) covers flaw remediation, malicious code protection, and monitoring; patch timelines must be defined and evidenced.

Lesson pacing should allocate time proportional to objective weight and difficulty; reserve time for practice and feedback.

Questioning technique: use wait time after posing a question, then redirect or probe before supplying the answer.

Demonstration followed by guided practice then independent practice (I-do, we-do, you-do) supports skill acquisition.

Formative checks every 10-15 minutes of lecture maintain attention and surface misconceptions early.

Learner records must capture attendance, assessment results, and completion status per certifying body requirements.

Remediation plans should identify the specific objective not met and provide targeted practice, then reassess.

Instructor evaluation should include peer observation and learner feedback aligned to Kirkpatrick Levels 1 and 2 at minimum.

Delivery modality (in-person, virtual, hybrid) must preserve interaction and assessment integrity; proctoring rules apply to any graded assessment.

Organizations Seeking Certification (OSCs) own their compliance evidence and remediation; consultants may advise but cannot attest.

Registered Practitioner Organizations and Registered Practitioners provide consulting and preparation services; they do not issue certifications.

Certified Assessors are individuals authorized to conduct assessments on behalf of a C3PAO; they must maintain independence.

Certified Instructors deliver authorized training; they are not authorized to assess or certify learners for CMMC.

The CMMC-AB maintains the registry of authorized C3PAOs, assessors, and instructors; verification of status is a program-integrity control.

DoD's DIBCAC performs Level 3 assessments and quality reviews; it does not deliver commercial training.

Contracting officers rely on SPRS records; instructors should teach that SPRS entry is a contractual, not optional, step.

Role confusion (instructor acting as assessor or consultant) is a code-of-conduct risk and must be disclosed and avoided.

Each Level 2 requirement is scored 0 (not met), 1 (met), or 3 (not applicable); the maximum achievable score is 110.

A score of 88 or higher with no unmet requirements in specified critical areas supports certification; conditional status applies with an accepted POA&M.

Not-applicable determinations require justification tied to scope; assessors validate N/A claims rather than accepting them.

Evidence types: policy (documented intent), procedure (how), implementation (configuration or records), and test (verification results).

Sampling risk means a single artifact may not demonstrate enterprise-wide implementation; assessors request population lists and sample from them.

Findings must cite the specific requirement and the observed evidence gap; vague findings are not actionable and are rejected in quality review.

POA&M entries require the requirement, the planned remediation, a milestone schedule, and a responsible owner.

Assessment reports and supporting evidence are retained per contract and certifying body requirements; retention periods apply to instructors' learner records too.

Assessment items must be free of cultural, linguistic, and gender bias unrelated to the construct being measured.

Accommodations must not alter the measured objective; extended time is generally acceptable, revealing answers is not.

Instructors must not disclose individual learner results to third parties without consent, except where required by the certifying body.

Scores must be based only on observed performance against published criteria; favoritism and prior relationship are prohibited.

Learner appeals of assessment results require a documented review by someone not involved in the original scoring.

Instructors must avoid conflicts between selling products and teaching; product promotion during authorized training is prohibited.

Honest reporting of pass rates and outcomes is required; selective reporting or misleading statistics violates program integrity.

Suspected cheating must be handled per policy with documentation and due process, not public accusation.

Scoping identifies assets that process, store, or transmit CUI or FCI, plus security-protection assets that protect them.

Assets that do not meet scoping criteria may be excluded only if they are technically separated and documented.

The assessment boundary must be described in the system security plan and reflected in the network diagram.

Cloud and external service providers are in scope when they handle CUI; their responsibilities must be documented and inherited controls verified.

The CMMC model's practices are cumulative across levels; Level 2 assumes Level 1 practices are implemented.

Process maturity requirements at Level 2 and above address institutionalization: documented, managed, reviewed, and optimized processes.

Requirement identifiers (e.g., AC.L2-3.1.1) combine domain, level, and source control mapping; instructors should teach the mapping convention.

Changes in scope (new systems, mergers) trigger reassessment of the boundary and may require reassessment of requirements.

The certifying body maintains a complaints and ethics reporting channel; reports may be confidential and retaliation is prohibited.

Quality audits of instructors and C3PAOs review records, delivery fidelity, and independence; findings can lead to suspension or revocation.

Certification suspension or revocation follows defined due process, including notice and opportunity to respond.

Misrepresentation of certification status in proposals or marketing is a contractual and legal risk, not only an ethics issue.

Records of training delivery and assessment must be accurate and retained; falsifying records is grounds for permanent revocation.

Instructors must verify learner identity for graded assessments per policy; proxy testing undermines certification integrity.

Sharing of proprietary curriculum or exam content outside authorized channels violates agreements and may be unlawful.

Continuous improvement requires tracking integrity incidents and updating controls; instructors participate by reporting issues promptly.

Experiential learning (Kolb) cycles through concrete experience, reflective observation, abstract conceptualization, and active experimentation.

Problem-based learning uses realistic scenarios (e.g., scoping a CUI boundary) to build transferable skills.

Spaced practice improves retention over massed practice; distribute review of domains across sessions.

Retrieval practice (low-stakes quizzing) strengthens memory more than rereading; use frequent short quizzes.

Interleaving domains during practice improves discrimination among similar requirements.

Feedback timing: immediate feedback aids skill acquisition; delayed feedback can aid transfer, depending on task.

Motivation in adult learners is supported by relevance to job role and clear applicability to certification outcomes.

Prior experience is a resource but can carry misconceptions; diagnose prior knowledge before building new content.

Certified Instructors must meet continuing professional education requirements defined by the certifying body within each renewal cycle.

Renewal requires evidence of training delivery, adherence to the code, and payment of applicable fees.

Instructors must use only current, authorized curriculum versions; teaching retired content without disclosure misleads learners.

Instructors must disclose any lapse in certification and cease representing themselves as certified until restored.

Substitute instructors must be certified for the content they deliver; unauthorized substitution violates program requirements.

Instructor evaluations and learner feedback should be retained as evidence for quality audits.

Public statements about the CMMC program must distinguish personal opinion from official program requirements.

Referral of learners to C3PAOs must avoid conflicts of interest or undisclosed compensation.

Assessment planning includes scope validation, evidence requests, interview scheduling, and sampling strategy.

Evidence requests should be issued in advance; assessors review artifacts before interviews to target questions.

Interviews should be conducted with personnel who perform the work, not only management.

On-site versus remote assessment affects evidence collection; both require verified identity and secure evidence transfer.

Assessment duration scales with scope; a narrow scope with strong evidence reduces time and cost.

The OSC must designate a point of contact and provide access to systems and records during the assessment.

Assessors document objective evidence contemporaneously to support findings and quality review.

Post-assessment, the OSC receives findings and may submit a POA&M for conditional certification where permitted.

CUI: information the government creates or possesses, or that an entity creates or possesses for the government, requiring safeguarding per law, regulation, or policy.

FCI: information not classified but related to a federal contract that requires safeguarding under contract terms.

OSC: the organization undergoing CMMC assessment and certification.

C3PAO: a certified third-party assessment organization authorized to conduct Level 2 assessments.

POA&M: plan of action and milestones documenting remediation of unmet requirements.

SPRS: the DoD system where assessment results and affirmations are recorded.

DIBCAC: the Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center, which conducts Level 3 assessments.

Senior official affirmation: a company officer's attestation that self-assessment results are accurate.

Learning management systems must protect learner data and restrict access to authorized personnel.

Assessment platforms should log access and attempts to support integrity investigations.

Content versioning prevents learners from receiving outdated requirements; maintain a change log.

Backup and retention policies apply to learner records and assessment results.

Virtual delivery requires secure meeting controls (waiting rooms, authenticated access) for graded sessions.

Recording of sessions requires consent and secure storage per privacy policy.

Analytics should be used to identify objectives with low mastery and trigger content revision.

Accessibility features should be enabled in delivery platforms to support accommodations.

Collect only the learner data necessary for certification and delivery (data minimization).

Store learner PII securely with access controls and encryption in transit and at rest.

Retain records only as long as required; dispose of them securely afterward.

Do not use learner data for marketing without explicit consent.

Breach notification must follow applicable law and certifying body policy.

Instructors must not share learner results with employers without consent unless required by contract or policy.

Third-party vendors handling learner data must be bound by confidentiality and security terms.

Audit access to learner records periodically to detect misuse.

Level 1: 17 practices, FCI protection, annual self-assessment, senior official affirmation, SPRS entry.

Level 2: 110 practices aligned to NIST SP 800-171 Rev 2, triennial C3PAO assessment, POA&M allowed for conditional status.

Level 3: Level 2 plus selected NIST SP 800-172 requirements, assessed by DIBCAC, requires government-conducted assessment.

Level 2 process maturity requires documented and managed processes; Level 3 requires optimizing processes.

Level 1 does not require a C3PAO; self-assessment is the only path.

Level 2 certification can be conditional with an accepted POA&M closed within 180 days.

Level 3 is limited to programs designated by DoD as critical; not all contractors are eligible.

Flow-down requires subcontractors handling CUI to meet Level 2 requirements.

Use open-ended questions to probe reasoning; closed questions verify recall.

Think-pair-share increases participation and surfaces misconceptions before whole-group discussion.

Case-based discussion ties requirements to realistic OSC scenarios and supports application-level learning.

Modeling expert reasoning (think-aloud) helps learners internalize assessment logic.

Summarizing key points at the end of each segment improves retention.

Managing dominant learners and drawing out quiet ones maintains equitable participation.

Checking for understanding with targeted questions to specific learners is more reliable than asking 'any questions?'.

Debriefing after practice assessments focuses on reasoning errors, not just correct answers.

Delivery fidelity means teaching the approved objectives and content without unauthorized deviation.

Peer observation uses a structured rubric covering content accuracy, pacing, interaction, and assessment alignment.

Learner feedback surveys should be tied to specific behaviors and objectives, not general satisfaction only.

Continuous improvement uses data from assessments, feedback, and audits to revise delivery.

Instructor calibration sessions align scoring of performance tasks across instructors.

Content accuracy reviews should occur when the CMMC model is revised.

Documented corrective actions are required when quality reviews identify deficiencies.

Audit readiness requires organized records of delivery, attendance, and assessment results.

Phase 1: pre-assessment planning, scope validation, and evidence request.

Phase 2: evidence review and interviews to verify implementation.

Phase 3: scoring each requirement 0, 1, or 3 and documenting findings.

Phase 4: quality review of the assessment report by the C3PAO before release.

Phase 5: issuance of certification or conditional certification with POA&M.

POA&M closeout verification occurs within 180 days for conditional certification.

Results are entered into SPRS by the OSC or as directed by the process.

Reassessment occurs at the three-year mark or upon significant scope change.

Misconception: CMMC certification is issued by DoD for Level 2. Fact: a C3PAO issues Level 2 certification; DoD assesses Level 3.

Misconception: a POA&M can cover any number of requirements. Fact: POA&M use is limited and must be accepted; certain requirements cannot be deferred.

Misconception: Level 1 requires a C3PAO. Fact: Level 1 is a self-assessment with senior official affirmation.

Misconception: NIST SP 800-171 certification equals CMMC certification. Fact: CMMC certification requires an authorized assessment process.

Misconception: out-of-scope assets need no documentation. Fact: scope exclusions must be documented and technically justified.

Misconception: instructors can certify learners. Fact: instructors deliver training; certification is issued through the authorized process.

Misconception: SPRS entry is optional. Fact: contracting officers rely on SPRS records for award decisions.

Misconception: MFA is required only for privileged accounts. Fact: Level 2 IA practices require MFA for privileged and non-privileged network access with limited exceptions.

When a learner asks for exam answers, the instructor must decline and redirect to authorized practice material.

When an employer requests individual learner scores, the instructor must follow consent and policy requirements before disclosure.

When a conflict of interest arises (e.g., consulting for an OSC while teaching), disclose and recuse where objectivity is compromised.

When curriculum errors are found, report them to the certifying body rather than silently correcting authorized content.

When a learner discloses cheating, follow policy: document, report, and preserve due process.

When marketing training, avoid claims of official endorsement or guaranteed pass rates.

When asked to assess an organization the instructor advised, decline due to independence requirements.

When handling proprietary curriculum, share only through authorized channels.

CMMC is codified through DFARS clauses, including 252.204-7012 (safeguarding CUI) and 252.204-7021 (CMMC requirement).

NIST SP 800-171 Rev 2 provides the 110 security requirements underlying Level 2.

NIST SP 800-172 provides enhanced requirements for Level 3.

FAR 52.204-21 provides the 15 basic safeguarding requirements underlying Level 1 (17 practices in the CMMC model).

DFARS 252.204-7019 and 7020 address self-assessment and SPRS reporting requirements.

The CMMC-AB operates under authorization from DoD to accredit assessors and C3PAOs.

Contract clauses determine the required CMMC level; instructors should teach clause identification.

Policy changes are published in the Federal Register and DoD guidance; instructors must track effective dates.

Align each practice question to a specific CMMC requirement identifier and cognitive level.

Use scenario-based items to test application of scoping, scoring, and evidence evaluation.

Distractors should reflect common misconceptions (e.g., POA&M covering unlimited requirements).

Avoid item flaws: grammatical clues, length cues, and absolute terms that signal the answer.

Pilot new items and review statistics before use in graded assessments.

Set a defensible cut score based on the consequences of error and the objectives assessed.

Provide feedback that explains why each distractor is wrong to reinforce correct reasoning.

Review items after each model revision to ensure alignment with current requirements.

Stay current with CMMC model revisions, NIST publications, and DFARS clause updates.

Participate in calibration and peer review to maintain scoring consistency.

Pursue continuing education aligned to adult learning and cybersecurity content.

Maintain records of professional development for renewal.

Engage with the certifying body's updates and authorized curriculum revisions.

Reflect on learner feedback and assessment data to improve delivery.

Avoid practicing outside the scope of certification (e.g., assessing without authorization).

Model ethical behavior, including accurate representation of credentials.

Communicate assessment scope and evidence needs clearly to OSC technical and executive stakeholders.

Explain scoring and POA&M implications accurately; avoid guaranteeing outcomes.

Distinguish advisory (consulting) from attestation (assessment) in all communications.

Document decisions and rationale to support audits and continuity.

Escalate integrity concerns through defined channels rather than informal resolution.

Tailor communication to audience: executives need risk and contract impact; practitioners need requirement detail.

Confirm understanding of contractual flow-down obligations with subcontractors.

Maintain confidentiality of sensitive assessment findings until authorized release.

Independence requires no consulting relationship with the OSC within the defined look-back period.

Assessors must not accept gifts or favors that could influence findings.

Findings must be based on objective evidence, not on the OSC's assurances.

Assessors must not disclose findings outside authorized channels.

Quality review by the C3PAO verifies consistency and objectivity before release.

Any pressure to alter findings must be reported to the certifying body.

Assessors must recuse when a personal relationship compromises objectivity.

Documentation must be contemporaneous and accurate to withstand audit.

Only a C3PAO can issue Level 2 CMMC certification; claims otherwise are misrepresentation.

Certification status must be accurately represented in proposals and marketing.

SPRS records are the authoritative source contracting officers use to verify status.

Conditional certification must be disclosed as conditional, not as full certification.

Lapsed or revoked certifications must not be represented as current.

Instructors must not imply that completing training confers certification.

False claims can lead to contract termination, suspension, or debarment.

Report suspected misrepresentation to the certifying body and contracting officer.