CMMC CCP cheat sheet

CMMC is codified at 32 CFR Part 170 and administered by the DoD CMMC Program Management Office within OUSD(A&S).

The Cyber AB is the sole DoD-recognized CMMC accreditation body: it accredits C3PAOs, issues CCP and CCA credentials, and operates the CMMC Marketplace.

A C3PAO (Certified Third-Party Assessment Organization) is the only entity authorized to conduct a CMMC Level 2 certification assessment.

CCP (Certified CMMC Professional) is the entry-level assessor credential; CCA (Certified CMMC Assessor) is required for a lead assessor on a C3PAO assessment team.

DIBCAC, part of DCMA, conducts government-led CMMC Level 3 assessments and performs reviews of Level 2 self-assessment results submitted by OSCs.

OSC = Organization Seeking Certification; OSA = Organization Seeking Assessment; the OSC senior official is the executive who signs required affirmations.

Registered Practitioners (RPs) and Registered Practitioner Organizations provide advisory and consulting support and cannot perform certification assessments.

Governance flow: DoD CMMC PMO → The Cyber AB → accredited C3PAOs → assessment teams led by a CCA.

Level 1 and Level 2 self-assessments are performed by the OSC itself; no C3PAO or Cyber AB assessor is involved in a self-assessment.

Level 1 (Foundational) consists of 17 practices derived from FAR 52.204-21, verified by annual self-assessment plus senior official affirmation.

Level 2 (Advanced) consists of 110 practices aligned to NIST SP 800-171 Rev 2, verified by a triennial C3PAO certification assessment or an annual self-assessment, depending on the contract.

Level 3 (Expert) adds selected NIST SP 800-172 enhanced requirements above Level 2 and is assessed by a government team through DIBCAC every three years.

Levels are cumulative: Level 2 includes all 17 Level 1 practices, and Level 3 includes all 110 Level 2 practices.

Level 2 assessment objectives are drawn from NIST SP 800-171A, which specifies the examine, interview, and test methods for each requirement.

The 14 Level 2 domains are AC, AT, AU, CM, IA, IR, MA, MP, PS, PE, RA, CA, SC, and SI.

Level 2 scoring totals 110 points (one per requirement); a minimum score of 88 is required for certification, with unmet requirements placed on a POA&M and closed within 180 days.

At Level 1, all 17 practices must be rated MET; a POA&M is not permitted at Level 1.

A Level 2 certification remains valid for three years, with annual senior official affirmations during the certification period.

The assessment scope consists of CUI assets and security protection assets inside the defined CUI boundary, plus documented specialized assets.

CMMC scoping uses five categories: CUI assets, security protection assets (SPA), contractor risk managed assets (CRMA), specialized assets (SA), and out-of-scope assets.

A CUI asset processes, stores, or transmits CUI and is assessed against all practices applicable to the required level.

An SPA provides security protection to CUI assets (for example a firewall, SIEM, or authentication server) even if it does not handle CUI, and is assessed against the practices it supports.

A CRMA can but is not intended to handle CUI and is protected by risk-based policies; it is documented in the SSP but not assessed against CMMC practices.

Specialized assets include OT, test equipment, medical devices, and HMIs; they are documented even when incapable of meeting requirements and are not counted as CUI assets.

Out-of-scope assets neither handle CUI nor provide security protection to CUI assets, and are excluded from the assessment.

Boundary and asset-category decisions must be recorded in the System Security Plan, supported by a network diagram showing CUI data flows and enclave demarcation.

The CMMC Assessment Process (CAP) is published by The Cyber AB and governs how C3PAOs plan, conduct, and report Level 2 certification assessments.

The CAP has three phases: Phase 1 Plan and Prepare, Phase 2 Conduct Assessment, and Phase 3 Report Results.

Assessment methods derive from NIST SP 800-171A: examine documentation, interview personnel, and test systems.

Every requirement receives a rating (MET or NOT MET) supported by recorded objective evidence cited in the assessment report.

Each C3PAO assessment team is led by a CCA and staffed with CCPs; team size and assessment duration scale with the size and complexity of the scope.

Pre-assessment activities include scope confirmation, rules of engagement, evidence requests, and an approved assessment plan and agenda.

Post-assessment activities include drafting the assessment report and POA&M, Cyber AB quality review, and issuance of the certification with a three-year validity period.

Level 3 assessments are government-led through DIBCAC and are not performed by C3PAOs.

Core ethical principles for CMMC professionals are integrity, objectivity, confidentiality, competence, due professional care, and compliance with laws and regulations.

Independence rule: a C3PAO and its assessors may not provide consulting, implementation, or remediation services to an OSC they assess; conflicts of interest must be disclosed and mitigated.

Confidentiality rule: OSC CUI and assessment artifacts are shared only with authorized parties such as the OSC, The Cyber AB, and DoD.

Prohibited conduct includes accepting gifts or hospitality that could influence judgment and negotiating or altering ratings to satisfy the client.

Required assessment documentation includes the assessment report, objective evidence records, the POA&M, and the senior official affirmation.

The C3PAO must retain assessment records for the retention period specified in 32 CFR Part 170 and Cyber AB accreditation requirements.

The senior official affirmation is signed annually and attests to the accuracy of results and continued compliance; false statements are punishable under 18 U.S.C. 1001.

Documentation must be complete enough for an independent assessor to reproduce each rating from the cited objective evidence.