I85PREP
⌘ K
CMMC CCP study materials
CMMC CCP study resources

CMMC CCP practice questions

One question at a time. Build your CMMC CCP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1CMMC Ecosystem, Roles, and Governance

How many certification levels are defined in the current CMMC framework?

  1. Five
  2. Four
  3. Three Correct answer.
  4. Two

Explanation

The current CMMC framework defines three levels: Level 1 (Foundational), Level 2 (Advanced), and Level 3 (Expert). Each level builds on the previous one and maps to a distinct set of safeguarding requirements.

Question 2CMMC Ecosystem, Roles, and Governance

The requirements for CMMC Level 1 are drawn from which baseline?

  1. NIST SP 800-171
  2. FAR 52.204-21 Correct answer.
  3. NIST SP 800-172
  4. ISO/IEC 27001

Explanation

Level 1 consists of the basic safeguarding requirements found in FAR 52.204-21, focused on protecting Federal Contract Information. It is the foundational tier and does not incorporate the more extensive controlled unclassified information safeguards.

Question 3CMMC Ecosystem, Roles, and Governance

CMMC Level 2 requirements correspond to which publication?

  1. FAR 52.204-21
  2. NIST SP 800-171 Correct answer.
  3. NIST SP 800-172
  4. CIS Controls v8

Explanation

Level 2 is built on the 110 security requirements of NIST SP 800-171, which protect controlled unclassified information in nonfederal systems. It is the level most commonly required in DoD contracts involving CUI.

Question 4CMMC Ecosystem, Roles, and Governance

Which organization is recognized by the Department of Defense as the sole accreditation body for the CMMC program?

  1. The CMMC Program Office
  2. NIST
  3. DIBCAC
  4. The Cyber AB Correct answer.

Explanation

The Cyber AB is the private, nonprofit accreditation body recognized by DoD to accredit C3PAOs, certify assessors, and administer the assessment ecosystem. DoD retains overall program authority but does not itself perform accreditation functions.

Question 5CMMC Ecosystem, Roles, and Governance

Which credential must an individual hold before pursuing certification as a Certified CMMC Assessor?

  1. ISO/IEC 17024 personnel certification
  2. Certified CMMC Professional (CCP) Correct answer.
  3. Registered Practitioner (RP)
  4. Lead Assessor certificate

Explanation

The CCP credential is the entry point of the assessor career path and is a prerequisite for the CCA credential. A CCP must also meet experience and training requirements before advancing.

Question 6CMMC Ecosystem, Roles, and Governance

Which type of entity performs CMMC Level 2 certification assessments?

  1. A Licensed Training Provider
  2. A C3PAO Correct answer.
  3. A Registered Practitioner Organization
  4. The CMMC Program Office

Explanation

Certified Third-Party Assessment Organizations are accredited by The Cyber AB to conduct Level 2 certification assessments and issue certificates. Their assessors must hold CCA credentials earned after the CCP.

Question 7CMMC Ecosystem, Roles, and Governance

In CMMC terminology, what is an OSA?

  1. An assessor who observes a team during an assessment
  2. A subcontractor that is exempt from CMMC requirements
  3. A DoD office that oversees assessment scheduling
  4. An organization seeking or undergoing assessment Correct answer.

Explanation

OSA stands for Organization Seeking Assessment, meaning the contractor or subcontractor whose environment is being evaluated against a CMMC level. The OSA is the client of the C3PAO or the entity performing a self-assessment.

Question 8CMMC Ecosystem, Roles, and Governance

Who enforces the code of professional conduct that applies to certified CMMC professionals and assessors?

  1. The CMMC Program Office
  2. NIST
  3. DIBCAC
  4. The Cyber AB Correct answer.

Explanation

The Cyber AB administers the professional code of conduct and adjudicates ethics complaints against certified individuals and accredited organizations. Sanctions can include suspension or revocation of credentials.

Question 9CMMC Ecosystem, Roles, and Governance

CMMC Level 3 adds enhanced requirements from which publication on top of the Level 2 baseline?

  1. NIST SP 800-172 Correct answer.
  2. NIST SP 800-53
  3. FAR 52.204-21
  4. NIST SP 800-171A

Explanation

Level 3 combines the Level 2 requirements with a selected subset of enhanced requirements from NIST SP 800-172. These address advanced persistent threats for programs involving the highest-value CUI.

Question 10CMMC Ecosystem, Roles, and Governance

How are CMMC Level 3 assessments performed?

  1. By a government-led assessment team Correct answer.
  2. By self-assessment with annual affirmation
  3. By any accredited C3PAO
  4. By a Licensed Training Provider

Explanation

Level 3 assessments are conducted by a government assessment team rather than a third party, reflecting the higher sensitivity of the protected information involved. The results feed into the certification decision for that level.

Question 11CMMC Ecosystem, Roles, and Governance

A company wants help documenting its practices and closing gaps before a Level 2 assessment. Which type of entity should it engage?

  1. A C3PAO that would later certify the results
  2. A Registered Practitioner Organization Correct answer.
  3. DIBCAC
  4. The CMMC Program Office

Explanation

Registered Practitioner Organizations and their Registered Practitioners provide advisory, readiness, and consulting support to organizations preparing for assessment. Using them keeps the assessment function independent from the preparation function.

Question 12CMMC Ecosystem, Roles, and Governance

During a Level 2 assessment, a CCP learns that a close family member is a senior manager at the OSA. What does professional conduct require?

  1. Ask the OSA to reassign the family member
  2. Continue the assessment but note it in the final report
  3. Disclose the relationship and withdraw Correct answer.
  4. Continue because the CCP's role is limited

Explanation

Assessors must be free of conflicts of interest that could impair impartiality, and a close family relationship with OSA management is such a conflict. The conflict must be disclosed to the assessment team and the individual must be removed from the assessment.

Question 13CMMC Ecosystem, Roles, and Governance

Which statement best describes a CCP's authority on an assessment team?

  1. Observes only and may not interact with the OSA
  2. Performs assigned activities under a CCA's direction Correct answer.
  3. Leads the team and signs the certification
  4. Serves as the final approval authority for the certificate

Explanation

A CCP contributes to assessment activities as a team member while working under the direction of a Certified CMMC Assessor. The CCP does not lead the assessment or make certification decisions.

Question 14CMMC Ecosystem, Roles, and Governance

How is a CMMC Level 1 assessment performed?

  1. By a licensed third-party auditor each year
  2. By DIBCAC upon written request
  3. By annual self-assessment with affirmation Correct answer.
  4. By a C3PAO every three years

Explanation

Level 1 is met through an annual self-assessment conducted by the company itself, together with an affirmation of the results by a senior official. No third-party assessment is required at that level.

Question 15CMMC Ecosystem, Roles, and Governance

How long does a Level 2 CMMC certification remain valid before reassessment is required?

  1. Three years Correct answer.
  2. Five years
  3. Two years
  4. One year

Explanation

A Level 2 certification resulting from a C3PAO assessment is valid for three years, with annual affirmations in the interim. The three-year cycle aligns with reassessment timing rather than the annual affirmation obligation.

Question 16CMMC Ecosystem, Roles, and Governance

Which individual is required to affirm a company's CMMC assessment results each year?

  1. The contracting officer
  2. The C3PAO's lead assessor
  3. The CMMC Program Office director
  4. A senior official of the company Correct answer.

Explanation

Annual affirmation is a company responsibility, executed by a senior official such as an executive with authority over the environment. The affirmation attests that the results and practices remain accurate between assessments.

Question 17CMMC Ecosystem, Roles, and Governance

Within the Department of Defense, which office houses the CMMC Program Office?

  1. The National Security Agency
  2. The CMMC Program Office in OUSD(A&S) Correct answer.
  3. The Defense Information Systems Agency
  4. The Defense Contract Audit Agency (DCAA)

Explanation

The CMMC Program Office sits within the Office of the Under Secretary of Defense for Acquisition and Sustainment, which owns acquisition policy and therefore the program's policy development. It coordinates with the accreditation body but does not perform accreditation itself.

Question 18CMMC Ecosystem, Roles, and Governance

What is the role of a Licensed Training Provider in the CMMC ecosystem?

  1. Conducting Level 2 certification assessments
  2. Delivering authorized CMMC training Correct answer.
  3. Issuing CMMC certificates to assessed companies
  4. Accrediting C3PAOs on behalf of The Cyber AB

Explanation

Licensed Training Providers are authorized by The Cyber AB to deliver the official training that supports CCP and CCA certification. They are training organizations and hold no assessment or accreditation authority.

Question 19CMMC Ecosystem, Roles, and Governance

C3PAOs are accredited against which international standard?

  1. ISO/IEC 17011
  2. ISO/IEC 17020 Correct answer.
  3. ISO/IEC 27001
  4. ISO/IEC 17024

Explanation

ISO/IEC 17020 is the standard for bodies performing inspection, which is the category into which third-party assessment organizations fall. Accreditation against it demonstrates competence, consistency, and impartiality in conducting assessments.

Question 20CMMC Ecosystem, Roles, and Governance

Which standard applies to the certification of individual CMMC assessors?

  1. ISO/IEC 17020
  2. ISO/IEC 17024 Correct answer.
  3. ISO/IEC 17011
  4. ISO/IEC 17021

Explanation

ISO/IEC 17024 sets the requirements for bodies that certify persons, which is the model used for the CCP and CCA credentials. It addresses exam integrity, recertification, and competence of the certifying body.

Question 21CMMC Ecosystem, Roles, and Governance

Which standard governs the operations of The Cyber AB in its accreditation role?

  1. ISO/IEC 17011 Correct answer.
  2. ISO/IEC 17024
  3. ISO/IEC 17065
  4. ISO/IEC 17020

Explanation

ISO/IEC 17011 defines requirements for accreditation bodies that assess conformity assessment bodies. Because The Cyber AB accredits C3PAOs, it operates under this standard.

Question 22CMMC Ecosystem, Roles, and Governance

Which change did the current version of the CMMC framework introduce compared with the original draft model?

  1. Added a new Level 4 for critical programs
  2. Eliminated separate maturity processes Correct answer.
  3. Replaced NIST SP 800-171 with ISO 27001
  4. Required third-party assessment at every level

Explanation

The restructured framework removed the separate maturity process requirements and made Level 2 a direct adoption of the NIST SP 800-171 requirements. This simplified how organizations demonstrate compliance at each level.

Question 23CMMC Ecosystem, Roles, and Governance

Through what mechanism does DoD impose a required CMMC level on a contractor?

  1. A Cyber AB memorandum of agreement
  2. An ISO accreditation certificate
  3. A NIST special publication
  4. A DFARS contract clause Correct answer.

Explanation

The required CMMC level is specified in the solicitation and flowed into the contract through the applicable DFARS clause. The clause obligates the contractor to achieve and maintain the stated level, and it flows down to subcontractors.

Question 24CMMC Ecosystem, Roles, and Governance

Which CMMC levels may be satisfied through self-assessment rather than third-party certification in some circumstances?

  1. Level 1 only
  2. Levels 1 and 2 Correct answer.
  3. All three levels
  4. Levels 2 and 3

Explanation

Level 1 is always met through annual self-assessment, and Level 2 may be met through self-assessment for non-prioritized acquisitions while prioritized acquisitions require a C3PAO assessment. Level 3 always requires a government-led assessment.

Question 25CMMC Ecosystem, Roles, and Governance

Which statement best describes how authority is divided between DoD and The Cyber AB?

  1. The Cyber AB writes the requirements and DoD accredits C3PAOs
  2. The two organizations share assessment authority equally
  3. DoD retains program authority; The Cyber AB accredits Correct answer.
  4. The Cyber AB is a DoD field activity staffed by military personnel

Explanation

DoD owns the CMMC program, sets policy through the CMMC Program Office, and retains ultimate authority, while The Cyber AB administers accreditation of C3PAOs and certification of assessors. The model deliberately separates government program ownership from private-sector accreditation administration.

Question 26CMMC Ecosystem, Roles, and Governance

How many progressive levels does the current CMMC model define, and what do they represent?

  1. Five levels, carried over from the original draft model, each requiring third-party assessment
  2. Four levels, ranging from basic cyber hygiene to continuous monitoring
  3. Two levels, one satisfied by self-assessment and one requiring third-party certification
  4. Three levels, representing increasingly rigorous security and assessment requirements Correct answer.

Explanation

The current model has three levels: Level 1 Foundational, Level 2 Advanced, and Level 3 Expert, each adding requirements and assessment rigor over the previous one. The five-level structure belonged to an earlier draft model and was replaced when the program was restructured.

Question 27CMMC Ecosystem, Roles, and Governance

In CMMC usage, what does Federal Contract Information (FCI) mean?

  1. Information provided by or generated for the Government under a contract, not intended for public release Correct answer.
  2. Any information a contractor creates that is later designated as classified by a DoD component
  3. Information a contractor voluntarily shares with the Government while preparing a proposal
  4. Unclassified information that requires safeguarding or dissemination controls under a government-wide registry

Explanation

FCI is information provided by or generated for the Government under a contract that is not intended for public release, and it is the category protected at CMMC Level 1. CUI is a separate, more sensitive category that carries additional safeguarding requirements.

Question 28CMMC Ecosystem, Roles, and Governance

Which set of requirements forms the basis of CMMC Level 1?

  1. The 110 security requirements of NIST SP 800-171
  2. The CIS Critical Security Controls
  3. The 15 basic safeguarding requirements of FAR 52.204-21 Correct answer.
  4. The enhanced requirements of NIST SP 800-172

Explanation

Level 1 maps to the 15 basic safeguarding requirements drawn from FAR 52.204-21. The NIST SP 800-171 requirements underpin Level 2, and the SP 800-172 enhancements underpin Level 3.

Question 29CMMC Ecosystem, Roles, and Governance

Which credential must an individual hold before pursuing the Certified CMMC Assessor (CCA) credential?

  1. ISO/IEC 17020 lead auditor certification
  2. Registered Practitioner (RP) designation
  3. Certified Information Systems Security Professional (CISSP)
  4. Certified CMMC Professional (CCP) Correct answer.

Explanation

The CCP is the entry-level individual assessor credential and is a required stepping stone to the CCA. Other certifications, however well regarded, do not substitute for the CCP in the CMMC credential path.

Question 30CMMC Ecosystem, Roles, and Governance

Where does an organization record the results of its CMMC Level 1 self-assessment so that DoD can view them?

  1. In the Supplier Performance Risk System (SPRS) Correct answer.
  2. In SAM, under the representations and certifications section
  3. In the CMMC Marketplace, as a public certificate
  4. In eMASS, by uploading the full assessment report

Explanation

Self-assessment results and the accompanying affirmation are entered into SPRS, the DoD system used to record supplier security posture. Other systems serve different functions and do not hold self-assessment scores.

Question 31CMMC Ecosystem, Roles, and Governance

Which document prescribes the standardized process that a C3PAO follows when conducting a CMMC Level 2 certification assessment?

  1. ISO/IEC 17020, the standard for inspection bodies
  2. 32 CFR Part 170, the CMMC Program rule
  3. The CMMC Assessment Process (CAP) published by The Cyber AB Correct answer.
  4. NIST SP 800-171A, which defines the assessment procedures for every requirement

Explanation

The Cyber AB publishes the CMMC Assessment Process, which governs how C3PAOs plan, execute, and report Level 2 assessments. NIST SP 800-171A supplies the procedures for examining individual requirements, but the CAP governs the overall assessment process.

Question 32CMMC Ecosystem, Roles, and Governance

In which part of the Code of Federal Regulations is the CMMC Program codified?

  1. 32 CFR Part 170 Correct answer.
  2. 32 CFR Part 117
  3. 48 CFR Part 252
  4. 48 CFR Part 9904

Explanation

DoD codified the CMMC Program in 32 CFR Part 170. Acquisition clauses elsewhere in Title 48 are used to flow the requirement into contracts, but the program itself lives in Title 32.

Question 33CMMC Ecosystem, Roles, and Governance

Under the CMMC Program, how long does an organization have to close a POA&M item stemming from a Level 2 certification assessment?

  1. 180 days Correct answer.
  2. One year
  3. 30 days
  4. 90 days

Explanation

POA&M items from a Level 2 certification assessment must be closed within 180 days, and the certification remains conditional during that window. Failing to close them within the window affects the organization's certification status.

Question 34CMMC Ecosystem, Roles, and Governance

Which statement best describes The Cyber AB?

  1. An independent non-profit accreditation body recognized by DoD Correct answer.
  2. A federally funded research center that maintains the NIST publications
  3. A DoD program office that writes CMMC requirements and issues certificates
  4. A trade association of defense contractors that advocates on acquisition policy

Explanation

The Cyber AB is an independent non-profit organization recognized by DoD as the accreditation body that administers the CMMC ecosystem, including accrediting C3PAOs and certifying assessors. It does not set the CMMC requirements, which remain a DoD responsibility.

Question 35CMMC Ecosystem, Roles, and Governance

A training company wants to deliver the official CCP training course. Which organization must accredit it?

  1. The Cyber AB, which accredits Licensed Training Providers Correct answer.
  2. The DoD CMMC Program Office, which approves all CMMC training curricula
  3. The C3PAO that employs the company's instructors
  4. NIST, under its cybersecurity education and outreach program

Explanation

The Cyber AB accredits Licensed Training Providers, which are the organizations authorized to deliver official CMMC training such as the CCP course. Neither DoD nor NIST accredits training providers in this ecosystem.

Question 36CMMC Ecosystem, Roles, and Governance

A C3PAO has been engaged to perform a Level 2 certification assessment. Which activity would conflict with the independence requirements of its accreditation?

  1. Reviewing the organization's system security plan during scoping
  2. Scheduling assessment activities in phases across several weeks
  3. Interviewing the organization's administrators and reviewing configuration evidence
  4. Advising the organization on how to implement its security controls Correct answer.

Explanation

An accredited C3PAO must remain independent of the organization it assesses, so advising on control design or implementation creates an impermissible conflict of interest. Scoping reviews, interviews, and evidence collection are normal assessment activities that do not impair independence.

Question 37CMMC Ecosystem, Roles, and Governance

A DoD contract will require a company to store and process controlled unclassified information on its corporate network. What is the minimum CMMC level DoD would specify for that contract?

  1. Level 1
  2. Level 2 Correct answer.
  3. Level 3
  4. No CMMC level, because the company is a subcontractor rather than the prime

Explanation

Contracts involving CUI require at least CMMC Level 2, because Level 2 applies the NIST SP 800-171 requirements to the protection of CUI. The same requirement flows down to subcontractors that handle CUI.

Question 38CMMC Ecosystem, Roles, and Governance

Following a Level 2 C3PAO assessment, an organization has a small number of eligible open POA&M items. What certification status results, and what must the organization do?

  1. A conditional certification, which becomes final once the POA&M items are closed within the required window Correct answer.
  2. A provisional self-assessment status that DoD converts to a certification after review
  3. No certification at all until every item is closed, after which a new full assessment is required
  4. A final certification, provided the open items are listed as exceptions on the certificate

Explanation

When a C3PAO assessment ends with eligible open POA&M items, the organization receives a conditional certification, and closing those items within the allowed window converts it to a final certification. Items cannot simply be listed as permanent exceptions.

Question 39CMMC Ecosystem, Roles, and Governance

Which statement best characterizes how CMMC Level 2 relates to NIST SP 800-171?

  1. Level 2 replaces NIST SP 800-171 with CMMC-specific requirements written by The Cyber AB
  2. Level 2 selects only a subset of NIST SP 800-171 requirements that are most relevant to CUI
  3. Level 2 is equivalent to NIST SP 800-171 but allows organizations to substitute other frameworks of their choosing
  4. Level 2 adopts the full set of NIST SP 800-171 security requirements and surrounds them with CMMC assessment, affirmation, and POA&M rules Correct answer.

Explanation

Level 2 uses the complete NIST SP 800-171 security requirement set as its control baseline, and the CMMC program adds its own assessment, affirmation, and POA&M rules around it. The Cyber AB administers accreditation but does not author the underlying requirements.

Question 40CMMC Ecosystem, Roles, and Governance

An individual holds an active CCA credential. Which statement best describes how that credential may be used to conduct Level 2 certification assessments?

  1. The CCA may contract directly with any organization seeking assessment and issue CMMC certificates independently
  2. The CCA may lead assessments for any organization that consents, provided the organization signs a waiver
  3. The CCA must work through an accredited C3PAO with which the CCA is affiliated Correct answer.
  4. The CCA may conduct assessments only after DoD issues a separate government assessor badge

Explanation

Individual assessor credentials are exercised only through an accredited C3PAO, so a CCA must be affiliated with a C3PAO to take part in certification assessments. The credential alone does not authorize independent assessment work or certificate issuance.

Question 41CMMC Model, Levels, and Practice Requirements

How many levels does the CMMC 2.0 model contain?

  1. Two
  2. Four
  3. Three Correct answer.
  4. Five

Explanation

CMMC 2.0 streamlined the model to three levels: Foundational, Advanced, and Expert. This replaced the five-level structure used in CMMC 1.0.

Question 42CMMC Model, Levels, and Practice Requirements

Which NIST publication forms the basis for CMMC Level 2 practices?

  1. NIST SP 800-171 Correct answer.
  2. NIST SP 800-172
  3. NIST SP 800-37
  4. NIST SP 800-53

Explanation

Level 2 consists of 110 practices drawn directly from NIST SP 800-171 Rev 2, which protects controlled unclassified information in nonfederal systems. NIST SP 800-172 supplies enhanced requirements for Level 3, while 800-53 and 800-37 serve broader federal purposes.

Question 43CMMC Model, Levels, and Practice Requirements

CMMC Level 1 is intended to protect which category of information?

  1. Federal contract information Correct answer.
  2. Personally identifiable information
  3. Controlled unclassified information
  4. Classified military intelligence

Explanation

Level 1 Foundational safeguards federal contract information, which is information not public that is provided by or generated for the government under contract. Controlled unclassified information begins at Level 2, and classified information is outside CMMC's scope.

Question 44CMMC Model, Levels, and Practice Requirements

Which CMMC 2.0 level is based on selected requirements from NIST SP 800-172?

  1. Level 2
  2. Level 3 Correct answer.
  3. Level 1
  4. Level 4

Explanation

Level 3 Expert adds a selected subset of NIST SP 800-172 enhanced requirements on top of Level 2. CMMC 2.0 has no Level 4.

Question 45CMMC Model, Levels, and Practice Requirements

The 17 practices at CMMC Level 1 correspond to requirements in which document?

  1. DFARS 252.204-7012
  2. NIST SP 800-171
  3. FAR 52.204-21 Correct answer.
  4. 32 CFR Part 170

Explanation

Level 1 practices implement the basic safeguarding requirements found in FAR 52.204-21. DFARS 252.204-7012 addresses CUI and NIST SP 800-171, while 32 CFR Part 170 establishes the CMMC program rule.

Question 46CMMC Model, Levels, and Practice Requirements

Which organization accredits Certified Third-Party Assessment Organizations (C3PAOs)?

  1. The Cyber AB Correct answer.
  2. The Defense Contract Management Agency
  3. The Department of Defense CIO
  4. NIST

Explanation

The Cyber AB is the CMMC accreditation body that accredits C3PAOs and individual assessors. DoD sets program policy and uses assessment results, but it does not accredit C3PAOs.

Question 47CMMC Model, Levels, and Practice Requirements

How many practices does CMMC Level 2 contain?

  1. 171
  2. 17
  3. 110 Correct answer.
  4. 72

Explanation

Level 2 consists of 110 practices that match NIST SP 800-171 Rev 2. Level 1 contains 17 practices, and 171 was the total across all five levels in CMMC 1.0.

Question 48CMMC Model, Levels, and Practice Requirements

Which assessment method is used for a CMMC Level 1 certification?

  1. A C3PAO assessment
  2. A joint DoD-industry audit
  3. A government-led assessment
  4. A self-assessment Correct answer.

Explanation

Level 1 uses an annual self-assessment with a senior-official affirmation. C3PAO assessments apply to Level 2 prioritized acquisitions, and government-led assessments apply to Level 3.

Question 49CMMC Model, Levels, and Practice Requirements

A company completes a C3PAO Level 2 assessment. How long is the resulting certification valid before a new assessment is required?

  1. 24 months
  2. 60 months
  3. 36 months Correct answer.
  4. 12 months

Explanation

A Level 2 C3PAO certification remains valid for three years, with annual affirmation in between. The annual cycle is for affirmation, not for a full reassessment.

Question 50CMMC Model, Levels, and Practice Requirements

What action is required annually to maintain an active CMMC certification?

  1. Hire a Certified CMMC Professional
  2. Resubmit the entire assessment scope
  3. Affirm compliance annually Correct answer.
  4. Complete a new C3PAO assessment

Explanation

Certified contractors must affirm annually that they continue to meet the applicable requirements. The full reassessment occurs on the three-year cycle, not every year.