CMMC Foundation exam-day guide
CMMC Foundation · Prepare for the day ahead.
Your checklist
Government-issued photo ID
Bring the exact ID type and name spelling the certification body requires. Most remote-proctored and test-center exams require a valid government photo ID whose name matches your registration; confirm the accepted ID list with the provider before exam day, since rules on expired IDs or secondary IDs vary.
Exam appointment confirmation
Have your confirmation email, registration or candidate ID number, and the exam code ready. You may need the candidate ID to log in or to check in with a proctor. Confirm the exact exam title and code (CMMC Foundation) matches your booking.
Confirmed testing mode and platform requirements
Confirm whether you are testing at a test center or online proctored, and which platform hosts the exam. For online proctoring, run the system or equipment check in advance and note any browser, webcam, microphone, or bandwidth requirements. needs_review: the specific platform and system requirements depend on the certification body and should be confirmed with the provider.
Quiet, private, well-lit room (remote exams)
If testing online, arrange a private room with a clear desk, reliable power, and stable internet. Remove phones, notes, second screens, and anything on the prohibited-items list. Proctors commonly require a 360-degree room scan and may ask you to show your desk surface.
Approved scratch materials only
Many providers supply an on-screen whiteboard or allow an erasable marker board, and prohibit paper and pen. Do not assume paper is allowed. Confirm the permitted note-taking method with the provider and clear any board before and after the exam if one is provided.
Know the exam logistics: length, question count, format, pass mark
Record the time limit, number of questions, question format (single-answer, multiple-response, scenario-based), and passing score from the official candidate handbook. Confirm these with the provider rather than relying on forum posts, since exam versions and scoring can change.
Review the CMMC model structure, not just facts
Be able to place the CMMC levels, the assessment scopes, and the role of the CMMC Accreditation Body versus the DoD in the model. Foundation-level questions often test whether you understand how the pieces relate, not just isolated definitions.
Know the assessment types and who performs them
Be able to distinguish self-assessment from third-party assessment and which CMMC level each applies to under the current program rules. Confirm the current level-to-assessment mapping with the provider or the official CMMC documentation, as program details have changed over time. needs_review: verify against the current published CMMC program rule.
Rehearse the 37 CFR Part 170 and NIST SP 800-171 relationship
Understand that CMMC builds on the protection requirements in NIST SP 800-171 for controlled unclassified information and that the assessment requirements are set out in the CMMC program rule. You do not need to memorize every control, but know what the documents are for and how they connect.
Plan arrival or login buffer time
Arrive at the test center or log in to the proctoring platform earlier than the appointment time, as the provider instructs. Check-in, ID verification, and the room scan can take a meaningful amount of time; a late start can cost you exam minutes.
Prepare for breaks and unscheduled interruptions
Confirm whether breaks are allowed, whether the clock stops during them, and what to do if you need to leave the camera view. For remote exams, leaving the view without proctor permission may end the session. Confirm the break policy with the provider before exam day.
Confirm scoring, results delivery, and retake policy
Know whether you receive a pass/fail result immediately, when the official score report arrives, and how many retakes are permitted and after what waiting period. Confirm these with the provider; do not rely on secondhand accounts.
Plan the day
Lock in logistics: confirm the appointment time and time zone, testing mode, platform, and ID requirements. Run any required system check for remote proctoring. Print or save the confirmation and candidate ID. Stop trying to learn new material and switch to review.
Do a structured review of the CMMC model: the levels and what each requires, the assessment scopes, the roles of the accreditation body and assessors, and the relationship to NIST SP 800-171 and the CMMC program rule. Use the official model documentation and your own summary sheet, not question-bank dumps.
Take one timed practice set under exam-like conditions to check pacing, then review only the explanations for questions you missed. Note recurring weak areas and give them one focused pass.
Re-read your one-page summary of levels, assessment types, key document names, and acronyms. Confirm the address and travel route or the remote setup, and check that your ID is valid and not expired.
Prepare the room or bag: ID, confirmation, approved materials, charger, and water. Remove prohibited items from the desk. Set two alarms. Avoid cramming new material late into the night; sleep is worth more than one more practice set.
Eat a normal meal, hydrate, and arrive or log in early as the provider instructs. Re-check the internet connection and camera if remote. Keep your ID and confirmation within reach for check-in.
Do a short, calm recall pass of your summary sheet only. Do not start a new practice exam or read new material; it raises anxiety without improving recall.
Read each question fully and identify what is being asked before looking at the options. Watch for qualifiers such as 'best', 'primary', 'not', and 'except'. For multiple-response items, count how many answers are required.
Answer in passes: do the straightforward items first, flag long scenario items, then return to them. Budget time against the question count so you leave a few minutes to review flagged items. If a question is unanswerable, eliminate options and move on rather than stalling.
Use only the approved scratch method, and only if permitted. If you finish early, review flagged items and check that every question is answered and every multiple-response item has the required number of selections.
Rules to check
Bring the exact ID type the provider requires, with a name matching your registration, and keep it visible for check-in and any proctor re-verification. Confirm the accepted ID list with the provider in advance; do not assume a student ID or expired document will be accepted.
Follow all proctor instructions. For remote exams, stay in the camera view, keep your face visible, and do not leave the room without explicit proctor permission. Unauthorized movement or a second person in the room can result in the session being terminated.
Do not bring or use unauthorized materials: phones, smart watches, notes, textbooks, or a second screen. If a device is required for check-in, follow the provider's instructions for putting it away once the exam begins.
Do not discuss, copy, or share exam content. Reproducing questions, whether from memory or otherwise, violates the candidate agreement that most certification bodies require you to accept. Confirm the specific confidentiality terms with the provider.
Confirm the break policy before exam day. Whether breaks are allowed, whether the clock runs during them, and what you must do before and after a break vary by provider and testing mode.
Understand how scoring works for your exam: whether it is pass/fail, whether unanswered questions count against you, and whether partial credit exists on multiple-response items. Guessing is usually preferable to leaving an item blank unless the provider states otherwise; confirm with the provider.
Confirm the retake policy, including any waiting period and any limit on attempts, before you sit the exam. Policies differ by certification body and can change, so verify with the provider rather than relying on older accounts.
If you hit a technical failure or a proctor issue, stop and follow the provider's escalation process rather than troubleshooting on your own. Note the time and what happened, as this may support a reschedule or score review; confirm the incident process with the provider.