CMMC-RP flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

CMMC definition

Cybersecurity Maturity Model Certification is a DoD program that verifies a defense contractor's implementation of required cybersecurity practices through assessment and certification at one of three levels.

CMMC 2.0 levels

CMMC 2.0 has three levels: Level 1 Foundational, Level 2 Advanced, and Level 3 Expert, replacing the five maturity levels used in CMMC 1.0.

Level 1 requirement source

Level 1 aligns with the 15 basic safeguarding requirements in FAR 52.204-21 and applies to contractors handling Federal Contract Information but not CUI.

Level 2 requirement source

Level 2 aligns with the 110 security requirements of NIST SP 800-171 Rev 2 and applies to contractors that process, store, or transmit Controlled Unclassified Information.

Level 3 requirement source

Level 3 is based on a selected subset of NIST SP 800-172 enhanced security requirements and is assessed by government assessors rather than by a C3PAO.

Cyber AB role

The Cyber AB is the non-profit accreditation body that accredits C3PAOs and certified assessors, administers professional credentials, and oversees the CMMC assessment ecosystem.

DFARS 252.204-7021

This contract clause makes the required CMMC level a condition of contract award and requires the contractor to maintain the certification for the duration of the contract.

CMMC certificate validity

A Level 2 CMMC certificate issued after a C3PAO assessment remains valid for three years, subject to annual affirmations and reassessment if significant changes occur.

Level 1 assessment type

Level 1 requires an annual self-assessment conducted by the contractor, followed by an annual affirmation by a senior official, with results recorded in SPRS.

Level 2 assessment options

Level 2 may be assessed through an annual self-assessment with senior official affirmation or through a C3PAO certification assessment every three years, depending on contract requirements.

Level 3 assessor

Level 3 assessments are led by the Defense Industrial Base Cybersecurity Assessment Center, a government organization, rather than by an accredited third-party assessor organization.

C3PAO definition

A CMMC Third-Party Assessment Organization is an accredited entity authorized by the Cyber AB to conduct Level 2 certification assessments and issue CMMC certificates.

Level 2 passing score

A Level 2 assessment requires an overall score of at least 88 out of 110 points to achieve a MET status; lower scores may yield CONDITIONAL or NOT MET.

POA&M eligibility limits

A Plan of Action and Milestones may address only certain unmet requirements; designated critical requirements must be fully met at the time of the assessment and cannot be deferred.

Assessment scope assets

Scoping includes assets that process, store, or transmit CUI or FCI, plus security protection assets, specialized assets, and contractor risk managed assets as defined in CMMC scoping guidance.

CMMC Assessment Process

The CAP defines the pre-assessment, assessment, and post-assessment phases, including evidence review, interviews, configuration checks, and reporting of findings by the assessment team.

SPRS definition

The Supplier Performance Risk System is the DoD repository where contractors record their NIST SP 800-171 self-assessment score and where assessment summaries are maintained.

Senior official affirmation

An annual affirmation is a signed statement by a senior company official confirming that the self-assessment results reported in SPRS are accurate and current.

System Security Plan

An SSP documents the system boundary, environment of operation, how each security requirement is met, and relationships with external systems and service providers.

Gap analysis purpose

A gap analysis compares a contractor's current practices against NIST SP 800-171 requirements to identify unmet controls and prioritize remediation before an assessment.

DFARS 252.204-7012

This clause requires contractors to implement the 110 NIST SP 800-171 requirements, report cyber incidents to DoD within 72 hours, and support damage assessments.

CUI definition

Controlled Unclassified Information is unclassified information that requires safeguarding or dissemination controls under applicable law, regulation, or government-wide policy.

FCI definition

Federal Contract Information is information provided by or generated for the government under a contract that is not intended for public release.

Subcontractor flow-down

Primes must ensure subcontractors that handle CUI meet the applicable CMMC level and NIST SP 800-171 requirements, extending obligations down the supply chain.

NIST SP 800-171A

This publication provides assessment objectives and procedures for each NIST SP 800-171 requirement, used to determine whether a requirement is satisfied.

Consultant independence limit

An organization that provides consulting or implementation services to a client cannot also serve as the C3PAO that certifies that same client.

Evidence collection

Consultants help clients gather artifacts such as policies, configurations, logs, and interview evidence that demonstrate each requirement is met and can be sampled by assessors.

Code of Professional Conduct

The Cyber AB Code of Professional Conduct sets integrity, objectivity, confidentiality, competence, and independence obligations for certified individuals and accredited organizations in the CMMC ecosystem.

Assessor independence rule

An assessor or assessor organization may not assess an organization to which it provided consulting, implementation, or managed services within the defined look-back period.

Confidentiality obligation

Professionals must protect client CUI, assessment evidence, and proprietary information and may use such information only for the purpose of the engagement.

Conflict of interest disclosure

Any actual or potential conflict of interest must be disclosed promptly and managed; undisclosed conflicts can lead to suspension or revocation of certification.

Accurate reporting duty

Assessors must report findings truthfully and must not alter, omit, or misrepresent assessment results; falsifying evidence or outcomes violates the Code.

Credential misrepresentation

Professionals must not misrepresent their credentials, the scope of their services, or a client's certification status, nor claim official DoD affiliation beyond actual accreditation.