CMMC Ecosystem and Governance
Domain 1 - CMMC Ecosystem and Governance
This domain tests whether you know who owns, runs, and enforces the CMMC program, and how the pieces fit together: DoD policy, the 32 CFR Part 170 rule, the accreditation body, and the credentialed workforce. Items here are usually "who does what" and "which document governs."
The policy layer
CMMC is a Department of Defense program, not a NIST publication and not a private certification scheme. It is codified in 32 CFR Part 170, effective December 16, 2024, and reaches contractors through DFARS clause 252.204-7021. The rule provides phased implementation: CMMC requirements began appearing in new contracts on December 16, 2024, and expand through 2027. DoD's CMMC Program Management Office sets policy; DoD owns the model and changes it through rulemaking, not through the accreditation body.
The accreditation layer
The Cyber AB is the sole accreditation body recognized by DoD. It does not write the model. It accredits C3PAOs (Certified Third-Party Assessment Organizations) and Licensed Training Providers, administers the credentialing program (RP, CCP, CCA, Lead Assessor), publishes the CMMC Assessment Process (CAP), and enforces the Code of Professional Conduct.
The three levels
Level 1 (Foundational): 17 practices drawn from FAR 52.204-21, six domains, annual self-assessment. Level 2 (Advanced): 110 requirements from NIST SP 800-171 Rev 2, 14 domains, either self-assessment or C3PAO certification depending on whether the acquisition is prioritized. Level 3 (Expert): 134 requirements (the 110 plus 24 from NIST SP 800-172), government-led assessment.
Worked example
A 60-person fabricator receives a new contract with DFARS 252.204-7021 requiring Level 2, and the contracting office marks the effort as prioritized. The owner asks whether he can self-assess. Answer: no. Prioritized Level 2 requires a C3PAO certification assessment; self-assessment is available only for non-prioritized Level 2 work. He must also designate a senior official to affirm compliance.
Traps
- Confusing the Cyber AB (accreditation, credentials, CAP) with DoD (model, rule, contract requirements).
- Treating an SPRS score or a self-assessment as a "certification."
- Assuming every Level 2 contract needs a C3PAO.
- Assuming CMMC applies only to primes; it flows to subcontractors through the clause.