CMMC Ecosystem and Instructor Role
The CMMC Ecosystem and Instructor Role domain tests whether you can place the Certified CMMC Instructor (CCI) credential correctly inside the CMMC 2.0 structure and act accordingly: a CCI teaches Cyber AB–authorized curriculum through a licensed training provider and does not assess, certify, or consult while acting as an instructor.
Who owns what
- DoD owns the program. 32 CFR Part 170 is the CMMC rule; DFARS 252.204-7012, 252.204-7019, 252.204-7020, and 252.204-7021 place CUI safeguarding, assessment, and flowdown obligations into contracts.
- The Cyber AB is the accreditation body recognized by DoD. It accredits C3PAOs, licenses training providers, publishes the CMMC Assessment Process (CAP), and administers individual credentials: CCP (professional), CCA (assessor), and CCI (instructor).
- C3PAOs employ certified assessors and perform Level 2 certification assessments. DIBCAC, DoD's assessment arm, leads Level 3 assessments.
- RPOs and Registered Practitioners advise and prepare organizations; they cannot certify anyone.
What the instructor role authorizes
Your authority comes from the training license, not from personal expertise. Deliver the approved objectives in the approved sequence, keep the exercises and assessments intact, and use only materials you are licensed to use. You are often the first point of contact for learners' process questions, so know the boundaries: training is not assessment, course completion is not certification, and a CCI does not confer CMMC status on anyone. Escalate content errors and suspected misconduct to your licensed training provider and the Cyber AB rather than improvising an answer.
Worked example
A learner asks, "Since you teach the model, can you certify my company at Level 2 by Friday?" Reasoning: a Level 2 result comes from a C3PAO assessment, or from a permitted self-assessment with senior-official affirmation, not from an instructor; agreeing would misrepresent the program. Correct response: explain the pathway, separate training from assessment, point to the Cyber AB's C3PAO listing, and decline to give a readiness opinion you cannot support.
Traps that cost marks
- Treating the Cyber AB and DoD as the same body, or saying a CCI "works for DoD."
- Confusing roles: the CCI teaches, the CCA assesses, the RPO advises.
- Claiming Level 1 requires a C3PAO, or that DIBCAC assesses Level 2.
- Implying your course completion or personal endorsement confers CMMC status.