CMMC-RP study plan

Map the CMMC ecosystem's key bodies and their distinct roles, then state in your own words what each one does and does not control

Trace how a DoD contract clause invoking CMMC flows from solicitation to the contractor's assessment obligation

Distinguish the levels of the CMMC model at a high level and identify which level applies to which contract type

Explain the difference between a self-assessment, a third-party certification assessment, and a government-led assessment, including who performs each

Describe the CMMC Level 2 requirement structure, including how the practices are organized into domains and capability areas

Compare the Level 2 practice set to the underlying NIST SP 800-171 requirements and explain the mapping relationship

Identify the Level 1 practice set and articulate why it is scoped to safeguarding Federal Contract Information

Explain the role of the assessment guide and scoping guidance in defining what gets assessed

Draft plain-language definitions of FCI and CUI with two contractor examples of each

Walk through the phases of a Level 2 certification assessment from pre-assessment readiness through final affirmation

Explain what a Plan of Action and Milestones is, when it is permitted, and how conditional status is determined

Identify the evidence types an assessor expects for a practice and how objective evidence differs from an assertion

Describe how scoping decisions change the assessment boundary and the evidence an assessor will sample

Practice scoring a set of practice-level findings as MET or NOT MET using only the stated evidence

Convert a sample contract scope into an asset inventory that separates in-scope from out-of-scope components

Draft a gap analysis against the Level 2 practices for a hypothetical small defense contractor

Sequence remediation activities by risk and by effort, and justify the ordering

Identify the documentation a contractor must maintain to support an affirmation of compliance

Explain how a managed service provider or external service provider affects the assessment scope

Design a readiness engagement timeline working backward from a certification target date

Write scoping questions a consultant should ask before quoting an engagement, and explain why each matters

Distinguish advisory activities from activities that would compromise independence or create a conflict of interest

Explain how to communicate a NOT MET finding to a client without overstating or softening the risk

Draft a client-facing summary that translates technical findings into business and contract-award consequences

Apply the professional conduct expectations to three realistic scenarios involving client pressure, conflicting instructions, and incomplete evidence

Identify situations requiring a consultant to decline or withdraw from an engagement and state the reasoning

Explain confidentiality and data-handling obligations when a consultant holds client CUI or assessment evidence

Describe how to maintain accurate records and avoid misrepresenting a client's compliance posture

Draft an internal escalation procedure for an ethical concern arising mid-engagement

Revisit governance rules on assessor qualifications, conflicts of interest, and independence and restate them precisely

Explain what happens to a certification when a contractor's scope or environment changes materially

Practice answering ethics questions in the exam's format under time pressure

Review any domain-1 governance details you missed on the week-1 summary and correct them

Identify the three weakest topics across all domains and rank them by exam weight

Complete two full-length timed practice exams and record per-domain accuracy

Re-study only the topics scoring below your target threshold, weighting by domain percentage

Recite the assessment phases, POA&M rules, and conduct principles from memory without notes

Rehearse explaining scoping and evidence decisions aloud as you would to a client

Finalize a one-page exam-day reference of facts you repeatedly miss