CMMC CCI flashcards
CMMC CCI · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- CMMC-AB
- The accreditation body authorized by DoD to accredit C3PAOs, certify assessors and instructors, and oversee the CMMC ecosystem's integrity and quality.
- C3PAO
- A Certified Third-Party Assessment Organization authorized by the accreditation body to conduct Level 2 CMMC certification assessments for Organizations Seeking Certification.
- OSC
- Organization Seeking Certification: the defense contractor or subcontractor undergoing a CMMC assessment to obtain certification at a required level.
- Instructor scope limit
- Certified Instructors deliver authorized curriculum and administer practice assessments; they do not issue certifications, score official exams, or perform certification assessments.
- Level 1 practices
- Seventeen safeguarding practices derived from FAR 52.204-21 that protect Federal Contract Information, verified through annual self-assessment with senior official affirmation.
- Level 2 practices
- One hundred ten security requirements aligned with NIST SP 800-171 Rev 2, verified through a C3PAO assessment every three years for certification.
- Level 3 requirements
- Level 2 practices plus selected enhanced requirements from NIST SP 800-172, assessed by DoD's DIBCAC for programs designated as critical.
- Scoring scale
- Each Level 2 requirement is scored 0 for not met, 1 for met, or 3 for not applicable, with a maximum possible score of 110.
- POA&M
- Plan of Action and Milestones documenting remediation of unmet requirements; for conditional certification it must be closed within 180 days of the assessment.
- Andragogy
- Knowles' theory of adult learning holding that adults are self-directed, bring experience as a resource, and prefer problem-centered, immediately relevant instruction.
- Bloom's revised taxonomy
- A hierarchy of cognitive objectives ordered Remember, Understand, Apply, Analyze, Evaluate, Create; certification preparation should target Apply and higher levels.
- Kirkpatrick levels
- Four evaluation levels: Reaction, Learning, Behavior, and Results; instructor evaluation should address more than learner satisfaction alone.
- Formative assessment
- Assessment conducted during instruction to surface misconceptions and adjust teaching; it informs learning rather than certifying attainment at the end.
- Cognitive load theory
- Distinguishes intrinsic task complexity from extraneous load caused by poor design; chunking, worked examples, and signaling reduce extraneous load.
- Constructive alignment
- The principle that learning objectives, instructional activities, and assessments must address the same content at the same cognitive level.
- Exam content confidentiality
- Certified Instructors must protect exam items and proprietary curriculum, and must not distribute brain dumps or coach learners to specific live items.
- Conflict of interest
- A personal or financial relationship that could compromise objectivity; it must be disclosed and mitigated, and the instructor must recuse where independence is impaired.
- Senior official affirmation
- A company officer's attestation that self-assessment results are accurate; false affirmation carries legal and contractual consequences for the organization.
- SPRS
- Supplier Performance Risk System: the DoD repository where assessment results and affirmations are recorded and used by contracting officers to verify compliance.
- Assessment independence
- A C3PAO and its assessors must have no consulting relationship with the OSC within the defined look-back period to preserve objectivity.
- Evidence authenticity
- Assessment artifacts must be genuine and current; fabricated, backdated, or borrowed evidence constitutes fraud and can void certification.
- Conditional certification
- Certification granted when a POA&M is accepted for limited unmet requirements, provided the plan is closed within 180 days.
- DIBCAC
- The Defense Industrial Base Cybersecurity Assessment Center within DCMA, which conducts Level 3 CMMC assessments and quality reviews.
- Flow-down obligation
- Contract clauses require primes to flow CMMC requirements to subcontractors handling FCI or CUI at the applicable level.
- Certification validity period
- Level 2 CMMC certification remains valid for three years, after which reassessment is required unless an extension is granted.
- System security plan
- The document describing the assessment boundary, implemented controls, and responsibilities, used by assessors to validate scope and evidence.
- Scoping
- Identifying assets that process, store, or transmit CUI or FCI plus security-protection assets, and documenting any technically separated exclusions.
- Test blueprint
- A mapping of assessment items to domains and objectives by weight, used to verify content coverage before delivering a practice assessment.
- Item discrimination
- A statistic describing how well an item distinguishes higher-performing from lower-performing learners; low values suggest revision or removal.
- Assessment reliability
- The consistency of scores across administrations, raters, and item sets; it is necessary but not sufficient for valid assessment.
- Inter-rater agreement
- The degree to which multiple instructors assign consistent scores to the same performance using a shared rubric; it is checked through calibration.
- MFA requirement
- Level 2 Identification and Authentication practices require multifactor authentication for privileged and non-privileged network access, with limited documented exceptions.