CMMC CCP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

The Cyber AB

The sole DoD-recognized CMMC accreditation body; it accredits C3PAOs, issues the CCP and CCA credentials, and operates the CMMC Marketplace.

C3PAO

Certified Third-Party Assessment Organization: a Cyber AB-accredited commercial firm authorized to conduct CMMC Level 2 certification assessments for organizations seeking certification.

CCP credential

Certified CMMC Professional: the entry-level CMMC assessor certification issued through The Cyber AB; CCPs serve on assessment teams under a lead assessor.

CCA credential

Certified CMMC Assessor: the advanced credential required to serve as lead assessor on CMMC Level 2 certification assessments conducted by a C3PAO.

DIBCAC

Defense Industrial Base Cybersecurity Assessment Center within DCMA; it conducts government-led CMMC Level 3 assessments and reviews Level 2 self-assessment results.

Organization Seeking Certification

The defense contractor whose environment is being assessed against CMMC requirements in order to obtain a CMMC certification or self-assessment result.

Level 1 Foundational

Seventeen practices derived from FAR 52.204-21, verified through an annual self-assessment and senior official affirmation; applies where contracts involve federal contract information.

Level 2 Advanced

One hundred ten practices aligned with NIST SP 800-171 Rev 2, verified by a triennial C3PAO certification assessment or an annual self-assessment depending on the contract.

Level 3 Expert

Builds on Level 2 with selected NIST SP 800-172 enhanced requirements and is assessed every three years by a government team led by DIBCAC.

Cumulative level structure

Higher CMMC levels include all lower-level requirements: Level 2 contains the 17 Level 1 practices, and Level 3 contains all 110 Level 2 practices.

Level 2 passing score

A minimum score of 88 out of 110 points is required for Level 2 certification; any unmet requirements must be placed on a POA&M and closed within 180 days.

Assessment objectives source

CMMC Level 2 assessment objectives come from NIST SP 800-171A, which defines the examine, interview, and test methods for each of the 110 requirements.

Certification validity period

A Level 2 CMMC certification remains valid for three years, provided the organization seeking certification submits annual senior official affirmations during that period.

CUI asset

An asset that processes, stores, or transmits controlled unclassified information; it falls within the assessment scope and is assessed against all applicable practices.

Security protection asset

An asset that provides security protection to CUI assets, such as a firewall, SIEM, or authentication server, even if it does not itself process, store, or transmit CUI.

Contractor risk managed asset

An asset that can but is not intended to handle CUI and is protected by risk-based policies; it is documented in the SSP but not assessed against CMMC practices.

Specialized asset

Operational technology, test equipment, medical devices, or human-machine interfaces that may be unable to meet requirements; documented in scope but not counted as CUI assets.

CUI boundary

A logically or physically separated portion of a network where CUI is handled; assets inside the boundary are scoped and the demarcation appears on the network diagram.

Out-of-scope asset

An asset that neither handles CUI nor protects CUI assets, such as a guest network, which is excluded from the CMMC assessment scope and documented as such.

SSP and network diagram

Required scoping documentation describing the CUI boundary, asset categories, and data flows; an assessor uses it to validate the declared assessment scope.

CMMC Assessment Process

The Cyber AB-published process that governs how C3PAOs plan, conduct, and report CMMC Level 2 certification assessments, organized into three phases.

CAP Phase 1

Plan and Prepare: confirm the assessment scope, execute rules of engagement, build the assessment plan and agenda, and request objective evidence from the organization seeking certification.

CAP Phase 2

Conduct Assessment: assessors examine documentation, interview personnel, and test systems to determine and record a rating of MET or NOT MET for each requirement.

CAP Phase 3

Report Results: the team drafts the assessment report and POA&M, submits them for Cyber AB quality review, and the certification decision is issued.

Examine, interview, test

The three assessment methods defined in NIST SP 800-171A that assessors use to collect objective evidence supporting the rating of each CMMC requirement.

Objective evidence

Verifiable records, observations, or test results gathered during an assessment that directly support the rating assigned to a specific CMMC requirement.

Senior official affirmation

An annual signed statement by an organization's senior official attesting that assessment results and continued compliance are accurate, subject to federal false-statement penalties.

Assessor independence

Assessors and their C3PAO must not provide consulting, implementation, or remediation services to an organization they assess, preserving objectivity and freedom from conflicts of interest.

Confidentiality obligation

Assessors must protect CUI and assessment artifacts belonging to the organization seeking certification, disclosing them only to authorized parties such as The Cyber AB and DoD.

POA&M

Plan of Action and Milestones: a document listing unmet requirements with planned remediation actions, assigned resources, and closeout dates, required within 180 days for conditional certification.

Assessment report contents

Documented scope, requirement-by-requirement ratings, references to objective evidence, and POA&M items; it must be sufficient for another assessor to reproduce the conclusions.

18 U.S.C. 1001

The federal false statements statute; knowingly submitting false CMMC affirmations, assessment evidence, or certification claims can constitute a criminal offense.