CMMC Model and Assessment Requirements
Domain 2 - CMMC Model and Assessment Requirements
This domain tests the model's structure and the mechanics of an assessment: what evidence counts, how requirements are judged, and how results become a certification status. Expect questions on requirement counts, NIST SP 800-171A objectives, scope, and POA&M rules.
Model structure
- Level 1: 17 practices in six domains (AC, AT, CM, IA, IR, MP), aligned to FAR 52.204-21.
- Level 2: 110 requirements across 14 domains, aligned to NIST SP 800-171 Rev 2.
- Level 3: 134 requirements - the 110 plus 24 from NIST SP 800-172.
The 14 domains for Levels 2–3: AC, AT, AU, CM, IA, IR, MA, MP, PS, PE, RA, CA, SC, SI.
How a requirement is judged
Each Level 2 requirement has assessment objectives in NIST SP 800-171A. A requirement is MET only when every objective is satisfied; there is no partial credit in the certification decision. Assessors gather three evidence types: document review, interviews, and demonstration/observation. A policy alone rarely proves a practice is operating.
Process and scope
The CAP organizes the engagement into plan-and-prepare, conduct, and report phases. Scope is documented per the assessment scope guidance: CUI assets, security protection assets (for example domain controllers, SIEM, backup), contractor risk managed assets, and specialized assets. Only in-scope assets must meet requirements; scope decisions must be documented and justified.
POA&M and conditional status
A Level 2 certification may be issued as conditional when a limited POA&M remains open; items must be closed within 180 days, and only a defined subset of requirements may be deferred. Level 3 does not permit an open POA&M.
Worked example
During a Level 2 assessment, the team finds MFA on the VPN for all users and on domain admin accounts, but the local console login on two admin workstations accepts only a password. Requirement 3.5.3 has objectives covering local access to privileged accounts and network access to privileged and non-privileged accounts. Because one objective fails, 3.5.3 is NOT MET - even though most of the environment is compliant. It can go on a POA&M only if the requirement is eligible for deferral.
Traps
- Giving partial credit for a partially implemented requirement.
- Confusing the SPRS 0–5 scoring methodology with CMMC's MET/NOT MET determination.
- Assuming "the cloud provider is FedRAMP, so we're covered" - inherited controls must be documented and verified.