CMMC CCI common mistakes
CMMC CCI · Understand the traps and how to avoid them.
Answering CMMC model questions by recalling the older 5-level CMMC 1.0 structure (levels 1–5, with 'process maturity' and 'capability maturity' axes) instead of the current 3-level model where Level 1 covers the 17 practices of FAR 52.204-21 and Level 2 covers the 110 practices aligned to NIST SP 800-171 Rev 2.
Candidates study from outdated blog posts, slide decks, and vendor marketing that predate the November 2021 internal review and the 2023–2024 program updates, so the memorized level count and practice totals are wrong even though the reasoning sounds confident.
What to do instead
Rebuild a one-page model map from the current CMMC Program rule and the CMMC Model document: three levels, the practice counts per level, the assessment scope per level, and the phased implementation dates. Before every practice exam, recite that map from memory and correct any answer that references a level 4 or 5.
Treating Level 2 as 'NIST SP 800-171 compliance' in general rather than as the 110 specific CMMC Level 2 practices scoped to the assessment boundary, and then mis-answering questions about which assets and which requirements are in scope.
The shorthand 'Level 2 equals 800-171' is repeated so often that candidates stop distinguishing the CMMC practice set, the CUI asset scoping rules, and the underlying NIST publication, which produces wrong answers on scope and on practice-count questions.
What to do instead
Practice scoping drills: given a short scenario listing systems, cloud services, and specialized assets, write the assessment boundary, classify each asset as CUI asset, security protection asset, or out of scope, and cite the scoping rule applied. Do ten of these until the boundary logic is automatic.
Confusing the roles in the ecosystem - describing the CMMC Accreditation Body (Cyber AB) as the certifying entity for organizations, or describing a C3PAO as a government assessor, or claiming an instructor can certify an organization's compliance.
Role names overlap (authorized C3PAO, certified assessor, registered practitioner, certified instructor, provisional instructor) and candidates collapse them into a simple 'assessor versus organization' story that feels tidy but is wrong.
What to do instead
Build a role matrix with columns for who accredits, who authorizes, who assesses, who certifies, and who trains, and fill it in for Cyber AB, the CMMC PMO/DoD, the C3PAO, the certified assessor, the registered practitioner, and the instructor. Quiz yourself by covering columns.
Describing the instructor's scope of authority as including attestation, certification, or assessment outcomes - for example telling a class that completing the course 'certifies' them or that the instructor can sign off on Level 2 readiness.
Instructor candidates come from consulting and audit backgrounds where training and assessment are often bundled, and the exam tests the boundary between education and assessment explicitly, so habit overrides the standard.
What to do instead
Memorize the boundary statement: the instructor delivers authorized curriculum content, assesses learner understanding, and reports program-integrity issues; the instructor does not certify organizations, issue CMMC status, or substitute for a C3PAO assessment. Write a two-sentence 'what I can and cannot do' statement and use it as a self-check on every scenario question.
Applying pedagogy-first delivery - lecturing to slides for the full session, then asking 'any questions?' - when scenario questions describe adult learners with existing DoD contracting experience who need application and problem-solving time.
Candidates default to how they were taught, and many have never studied adult learning principles such as andragogy, prior-experience leverage, problem-centered design, and the need for relevance and self-direction.
What to do instead
Convert each major topic into a 10-minute application task (scope an assessment boundary, classify a practice, resolve an ethics dilemma) and plan the session as short input followed by practice and debrief. Be able to name and justify at least four adult learning principles and match each to a specific design choice.
Writing learning objectives as topic labels ('cover the CMMC levels') rather than observable, measurable outcomes with a condition and a criterion, and then failing questions that ask which objective is well formed.
Topic labels are faster to write and are common in internal slide decks, so candidates do not notice the missing behavior verb, condition, and standard.
What to do instead
Use a verb-from-Bloom template: 'Given [condition], the learner will [observable action verb] to [criterion].' Draft five objectives for a Level 1 and Level 2 module and check each against the template before moving on.
Selecting assessment methods and evaluation levels incorrectly - for example using a Level 3 (behavior) evaluation to judge whether learners enjoyed the course, or relying on a post-course smile sheet as evidence that learning occurred.
Evaluation frameworks such as Kirkpatrick's four levels are easy to memorize in order but easy to misapply, and candidates match the label to the wrong evidence type under time pressure.
What to do instead
Anchor each level to its evidence: reaction equals perception surveys, learning equals knowledge or skills checks, behavior equals on-the-job application observation, results equals organizational outcomes. For each scenario, ask 'what evidence would I actually collect?' before choosing the level.
Handling an ethics scenario by choosing the option that protects the client or employer relationship (staying quiet, deferring to the sponsor, softening a finding) instead of the option that preserves integrity of the credential and the program.
Candidates import a client-service mindset from consulting, and the exam deliberately tests conflicts of interest, confidentiality limits, and reporting obligations where loyalty to a sponsor conflicts with program integrity.
What to do instead
Apply a fixed decision order to every ethics item: identify the obligation (law, code of conduct, program requirement), identify the conflict, then choose the action that discloses or escalates through the proper channel. Practice with scenarios involving suspected exam-content sharing, misrepresented credentials, and pressure to inflate learner results.
Treating exam content and proprietary curriculum as ordinary study material - discussing specific exam items, reproducing protected courseware, or sharing assessment artifacts in study groups or online forums.
Candidates are used to collaborative study and to reusing slides from prior employers, and they underestimate how strictly the code of conduct treats exam security and intellectual property.
What to do instead
Learn the specific prohibitions: no disclosure or discussion of exam items, no reproduction of protected curriculum without authorization, no misrepresentation of credentials. For any scenario, ask whether the behavior would compromise the integrity or security of the assessment, and choose the option that refuses and reports.
Ignoring continuing-education and recertification obligations, or assuming an instructor credential is permanent once earned, and therefore missing questions about maintaining status, reporting changes, and handling lapses.
Candidates focus on passing the initial exam and treat maintenance requirements as administrative trivia, so they cannot reason about scenarios involving expired credentials, unreported conflicts, or lapsed instructor status.
What to do instead
Build a maintenance checklist: recertification cycle, required continuing education or professional development units, reporting obligations for changes in employment or conflicts, and the correct action when a requirement lapses (disclose, remediate, refrain from instructing until restored). Review it before the exam and apply it to at least three lapse scenarios.