CMMC Model and Assessment Fundamentals
The Model and Assessment Fundamentals domain tests whether you can teach the model accurately: the three levels and where their practices come from, how scope is drawn, what counts as evidence, and how an assessment reaches a result.
The three levels
- Level 1 (Foundational) protects Federal Contract Information with 17 practices drawn from FAR 52.204-21; it requires an annual self-assessment and a senior-official affirmation.
- Level 2 (Advanced) protects CUI with the 110 practices of NIST SP 800-171 Rev 2 across 14 families; prioritized acquisitions require a C3PAO assessment, others permit self-assessment; certification runs on a three-year cycle with annual affirmation.
- Level 3 (Expert) adds selected NIST SP 800-172 requirements on top of Level 2 and is assessed by government assessors.
Scope, assets, and evidence
The scoping guidance separates CUI assets, security protection assets, contractor risk managed assets, and specialized assets such as government property, IoT, OT, restricted information systems, and test equipment. Specialized assets can sit outside the assessment boundary when documented, but the organization still has to manage their risk. Evidence falls into policy, procedure, implementation, and interview or observation categories - a policy alone never proves implementation.
How a result is reached
Assessors record MET or NOT MET against each requirement. A POA&M can support conditional certification, with items generally closed within 180 days; a defined subset of requirements is not eligible for a POA&M, so a miss there is disqualifying. Do not confuse this with SPRS scoring (1/3/5 weights), which is a separate DoD methodology used for 800-171 self-assessment scores.
Worked example
An organization finishes a Level 2 assessment with 104 of 110 practices MET, four NOT MET that qualify for a POA&M, and two NOT MET on requirements that cannot go on a POA&M. Reasoning: the two ineligible deficiencies block certification regardless of the 104 MET, because eligibility rules rather than the MET total decide the outcome. The teaching point is that counting practices is not the same as evaluating deficiencies.
Traps that cost marks
- Assuming CMMC automatically tracks the newest 800-171 revision.
- Treating a POA&M as a universal cure for any deficiency.
- Saying a certificate never expires (three years, with annual affirmation).
- Equating self-assessment with no accountability; affirmation is required.
- Teaching that no CUI means no obligations, when contract clauses and information types drive scope.