CMMC-RP common mistakes
CMMC-RP · Understand the traps and how to avoid them.
Treating CMMC Level 2 as a self-assessment or self-certification path and advising a client they can attest to Level 2 compliance internally, when Level 2 requires a C3PAO-led certification assessment for most contracts.
Candidates conflate the phased rollout and the older self-assessment era with current requirements, and they carry over the Level 1 annual self-assessment model to Level 2 because both reference NIST SP 800-171.
What to do instead
Memorize the assessment-type matrix by level: Level 1 = annual self-assessment with affirmation; Level 2 = third-party C3PAO certification assessment (with limited self-assessment exceptions specified by DoD for certain contracts); Level 3 = government-led DIBCAC assessment. When a scenario asks who can attest, answer from the level first, not from the client's preference.
Describing CMMC Level 2 as 'NIST SP 800-171 plus extra controls' or claiming CMMC invented new technical requirements, rather than explaining that Level 2 scopes the 110 requirements of NIST SP 800-171 Rev 2 and adds assessment and affirmation obligations.
Marketing language around CMMC emphasizes 'new certification' and candidates absorb that framing without checking the model's mapping to the underlying NIST publication.
What to do instead
State the relationship precisely: Level 2 = the 110 security requirements of NIST SP 800-171 (Rev 2 as the assessment baseline for the current program), with CMMC adding assessment rigor, scoping rules, and the annual senior-official affirmation. Practice explaining the mapping in one sentence without adding or dropping requirement counts.
Confusing the roles of the CMMC Accreditation Body (the non-profit that owns the program and accredits assessors) with the C3PAO (a certified third-party assessment organization that performs assessments for contractors) and with DIBCAC (the DoD assessment arm).
The ecosystem has several organizations with overlapping-sounding names, and exam scenarios deliberately place the candidate in a situation where the wrong entity is asked to do the work.
What to do instead
Build a role table: accreditation body accredits and oversees; C3PAO conducts Level 2 certification assessments; DIBCAC conducts Level 3 and government-initiated assessments; the DoD program office sets policy. For each scenario, ask 'who is allowed to perform this action' and answer from that table.
Writing a system security plan or assessment scope that lists every corporate system, including out-of-scope IT, rather than defining the CMMC assessment scope through in-scope assets, the security protection assets, and the treatment of external service providers and cloud environments.
Candidates default to an 'everything in the company' view of compliance because that is how many security frameworks are taught, and they miss that scoping drives cost and feasibility.
What to do instead
Learn the scope categories (assets that process, store, or transmit CUI; security protection assets; specialized assets; contractor risk managed assets; out-of-scope assets) and apply them in every scoping question. Practice drafting a one-page scope statement that names each category and justifies inclusions and exclusions.
Advising a client that a POA&M can cover any unmet requirement, including a requirement scored as NOT MET at the time of assessment, without distinguishing requirements that may be closed via POA&M from those that must be fully implemented before the assessment.
POA&M is a familiar remediation tool from other frameworks, and candidates assume it is universally acceptable as a substitute for implementation.
What to do instead
Study the POA&M rules as stated in the assessment guidance: which requirements are POA&M-eligible, the limited conditions under which a POA&M may be used, and the requirement that the underlying practice be substantially implemented. In scenario questions, first classify the requirement's status, then decide whether a POA&M is permitted.
Skipping the annual affirmation requirement or attributing it to the assessor, instead of advising that a senior official of the contractor must affirm continuing compliance each year.
Affirmation is an administrative obligation that feels like paperwork next to technical controls, so candidates underweight it and misassign responsibility to the C3PAO.
What to do instead
Memorize that affirmation is a contractor senior-official obligation with annual cadence and that false affirmation carries legal exposure. In consulting scenarios, build affirmation into the client's compliance calendar alongside assessment milestones.
Recommending a control implementation that is technically sound but not traceable to a specific CMMC practice or NIST SP 800-171 requirement, leaving the client unable to produce evidence mapped to the assessment objective.
Consultants gravitate to familiar security tooling and describe it in vendor terms rather than in the language of assessment objectives, and candidates mirror that habit in scenario answers.
What to do instead
For every recommendation, require a written mapping to the practice identifier and the assessment objective, plus the artifact that will evidence it. Practice converting a tool description into an evidence statement: 'this log, retained this long, reviewed by this role, demonstrates this objective.'
Accepting an engagement to perform a C3PAO certification assessment, or advising a client on how to 'pass' an assessment while also acting as the assessor, without recognizing the conflict of interest between consulting and assessing.
The same skills serve both roles, and candidates blur the boundary because the exam's ethics domain tests independence rather than technical knowledge.
What to do instead
Apply a simple independence rule: an organization that provided significant consulting on the scope cannot later serve as the assessor for that assessment. In ethics scenarios, identify the conflict explicitly and recommend separation of roles, disclosure, or a different provider.
Overstating the status of a client's compliance in a report or affirmation context, for example describing 'substantially implemented' controls as 'certified' or implying a certification exists before the C3PAO issues it.
Candidates want to give clients encouraging answers, and commercial pressure in the defense market rewards confident-sounding compliance claims.
What to do instead
Use precise status vocabulary: implemented, partially implemented, not implemented, and certified only after an authorized assessment body issues the result. In any scenario involving client communications, choose the answer that preserves accuracy over reassurance and documents the basis for each claim.
Misapplying the phased contract rollout, for example telling a small contractor that a Level 2 certification is required immediately for every DoD contract, or assuming a subcontractor's flow-down obligations are identical to the prime's.
Rollout timing depends on contract type and solicitation language, and flow-down requirements vary, so candidates flatten a conditional rule into a universal one.
What to do instead
Learn that CMMC requirements are invoked through contract clauses and solicitations on a phased schedule, and that flow-down depends on the prime's clause and the subcontract's handling of CUI. In scenario questions, check the contract language and CUI exposure before stating any requirement as mandatory.