CMMC-RP cheat sheet

CMMC is administered by the Department of Defense; the CMMC Program Office sits within the Office of the Under Secretary of Defense for Acquisition and Sustainment, while the CMMC Accreditation Body (branded "The Cyber AB") is a separate non-profit that accredits assessors and assessor organizations.

Governance roles are split by function: DoD sets policy and contract requirements, The Cyber AB accredits and oversees the assessment ecosystem and administers the Certified CMMC Professional (CCP) and Certified CMMC Assessor (CCA) credentials, and the CMMC Program Management Office publishes model and scoping artifacts.

CMMC 2.0 replaced CMMC 1.0 in November 2021 and reduced five maturity levels to three: Level 1 Foundational, Level 2 Advanced, and Level 3 Expert.

Level 1 aligns to the 15 FAR 52.204-21 basic safeguarding requirements; Level 2 aligns to the 110 security requirements of NIST SP 800-171 Rev 2; Level 3 is based on a subset of NIST SP 800-172 requirements.

Contract eligibility flows from the clause: a DoD solicitation that includes DFARS 252.204-7021 makes the stated CMMC level a condition of contract award, and the level is specified in the solicitation and contract.

Phased rollout is tied to contract value and level: Level 1 and Level 2 self-assessment requirements phase in first, Level 2 C3PAO certification follows, and Level 3 certification phases in later; the phase-in dates are set by DoD policy, not by the contractor.

The Cyber AB maintains the CMMC Assessors and Instructors Certification Organization (CAICO) to administer credentialing exams and continuing professional education requirements.

CMMC assessment findings and the resulting status are recorded in the CMMC Enterprise Mission Assurance Support Service (eMASS) module maintained by DoD; the CMMC certificate is valid for three years unless a significant change triggers reassessment.

Level 1 assessment is an annual self-assessment with an annual affirmation by a senior official, and the results are submitted into SPRS; it applies to the 15 FAR 52.204-21 requirements.

Level 2 permits either a self-assessment (annual, with senior official affirmation) or a certification assessment by a C3PAO every three years with annual affirmations, depending on the contract requirement.

Level 3 requires a government-led assessment conducted by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) and is based on a selected subset of NIST SP 800-172 enhanced requirements.

The CMMC scoring methodology is point-based: each requirement is worth 1 point, 5 points, or 3 points depending on the weight assigned in the assessment guide, and conditional status results when a score falls below the threshold for the level.

An overall assessment score of 88 out of 110 on the Level 2 scoring model is the minimum for a MET status; scores below that yield CONDITIONAL or NOT MET status depending on the number of unmet weighted requirements.

Assessment scope for Level 2 includes all assets that process, store, or transmit FCI or CUI, plus security protection assets, specialized assets, and contractor risk managed assets as defined in the CMMC scoping guidance.

A Plan of Action and Milestones (POA&M) may close out unmet requirements only when the requirements are not among the POA&M-eligible exclusions; certain critical requirements must be met at the time of assessment and cannot be deferred.

The CMMC Assessment Process (CAP) defines the phases: pre-assessment, assessment, and post-assessment, including evidence review, interviews, and configuration checks by the assessment team.

Consultants support readiness by conducting gap analyses against NIST SP 800-171, drafting System Security Plans (SSPs), developing POA&Ms, and preparing clients for C3PAO or DIBCAC assessments; they do not issue certifications.

A System Security Plan must describe the system boundary, the environment of operation, how each requirement is met, and the relationship with any external systems or service providers, consistent with NIST SP 800-171A assessment objectives.

Scoping decisions drive cost and effort: identifying CUI assets, security protection assets, specialized assets, and contractor risk managed assets determines which requirements apply and what evidence the assessor will sample.

The SPRS (Supplier Performance Risk System) score is a self-entered summary score based on the NIST SP 800-171 DoD Assessment Methodology; a basic self-assessment score can be entered by the contractor, while a medium or high assessment requires government or third-party validation.

DFARS 252.204-7012 requires contractors to implement the 110 NIST SP 800-171 requirements, report cyber incidents to DoD within 72 hours, and support DoD damage assessments; DFARS 252.204-7019 and -7020 govern the SPRS score and assessment requirements.

Flow-down obligations extend to subcontractors: primes must ensure subcontractors handling CUI meet the applicable CMMC level and NIST SP 800-171 requirements, so consultants must map the supply chain and identify which subcontractors are in scope.

Implementation support commonly includes policy and procedure development, technical configuration of access control, audit logging, encryption, and incident response, and evidence collection aligned to assessment objectives.

Consultants must avoid conflicts of interest: an organization that provides consulting or implementation services to a client cannot also serve as the C3PAO that certifies that client, and the Cyber AB Code of Professional Conduct prohibits such arrangements.

The Cyber AB Code of Professional Conduct applies to all certified individuals and accredited organizations in the CMMC ecosystem, including CCPs, CCAs, C3PAOs, and licensed training providers.

Core ethical obligations include integrity, objectivity, confidentiality, competence, and compliance with applicable laws and the CMMC assessment requirements.

Independence rules prohibit an assessor or assessor organization from assessing an organization for which it provided consulting, implementation, or managed services within the defined look-back period.

Confidentiality obligations require protecting client CUI, assessment evidence, and proprietary information, and using such information only for the purpose of the engagement.

Conflicts of interest must be disclosed promptly and managed; undisclosed conflicts can result in disciplinary action, including suspension or revocation of certification by the Cyber AB.

Assessors must report findings accurately and must not alter, omit, or misrepresent assessment results; falsifying evidence or assessment outcomes is a violation of the Code.

Continuing professional education and adherence to the Code are conditions of maintaining certification; violations are adjudicated through the Cyber AB's ethics and professional conduct process.

Professionals must not misrepresent their credentials, the scope of their services, or an organization's certification status, and must not claim official DoD or Cyber AB affiliation beyond their actual accreditation.