CMMC Foundation flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CMMC 2.0 levels

Three levels: Level 1 Foundational (15 FAR requirements), Level 2 Advanced (110 NIST SP 800-171 requirements), Level 3 Expert (NIST SP 800-172 subset). Replaced the original five-level CMMC 1.0 model.

32 CFR Part 170

The CMMC Program final rule published 15 October 2024, effective 10 December 2024, codifying CMMC requirements, assessment processes, and phased contract inclusion for DoD contractors.

FCI definition

Federal Contract Information: information not intended for public release that is provided by or generated for the Government under a contract to develop or deliver a product or service.

CUI definition

Controlled Unclassified Information: unclassified information that requires safeguarding or dissemination controls pursuant to law, regulation, or Government-wide policy.

FAR 52.204-21

The Federal Acquisition Regulation clause listing 15 basic safeguarding requirements for FCI; the technical basis for CMMC Level 1.

DFARS 252.204-7012

The Defense FAR Supplement clause requiring contractors to safeguard CUI per NIST SP 800-171 and report cyber incidents to DoD within 72 hours.

Cyber AB

The CMMC Accreditation Body, the sole DoD-recognized authority that accredits C3PAOs and credentials individuals (assessors, professionals, practitioners, instructors) in the CMMC ecosystem.

DIBCAC

Defense Industrial Base Cybersecurity Assessment Center, the DoD organization that conducts Level 3 assessments and performs oversight and enforcement of CMMC assessments.

Level 1 assessment type

Annual self-assessment conducted by the contractor against the 15 FAR 52.204-21 requirements, accompanied by an annual senior official affirmation of compliance.

Level 2 assessment types

Either a self-assessment with senior official affirmation or a C3PAO-led third-party certification assessment, depending on whether the DoD designates the contract as CUI-critical.

Level 3 assessment

Conducted only by the DoD (DIBCAC), covering all Level 2 requirements plus selected NIST SP 800-172 enhanced requirements; no C3PAO may perform this assessment.

NIST SP 800-171 Rev 2

The publication containing 110 security requirements across 14 control families that form the technical basis for CMMC Level 2.

NIST SP 800-172

The publication of enhanced security requirements for protecting CUI in critical programs; a DoD-selected subset forms the basis for CMMC Level 3.

Assessment scoring weights

Under NIST SP 800-171A, requirements score MET (1.0), NOT MET (0 for most, 5 for specified requirements), or NOT APPLICABLE; the total determines the assessment outcome.

Certification validity period

A Level 2 C3PAO certification is valid for three years; annual affirmations by a senior official are still required during the certification period.

POA&M rules

Plans of Action and Milestones are allowed for limited requirements at Level 2 and 3, with a maximum 180-day remediation window and exclusions for certain high-weight requirements.

NIST SP 800-171A

The assessment guide providing assessment objectives and evidence criteria for each NIST SP 800-171 requirement; the basis for CMMC Level 2 assessment scoring.

Senior official affirmation

A signed statement by a contractor's senior official attesting that the self-assessment results are accurate and the required practices are implemented.

C3PAO

Certified Third-Party Assessment Organization: an accredited firm authorized by the Cyber AB to conduct CMMC Level 2 certification assessments using Certified Assessors.

Certified Assessor

An individual credentialed by the Cyber AB to lead or participate in C3PAO certification assessments after meeting experience, training, and exam requirements.

Certified Professional

An individual who passed the Cyber AB Certified Professional exam and may advise contractors on CMMC readiness, but cannot conduct certification assessments.

Registered Practitioner

An entry-level Cyber AB credential requiring CMMC training and adherence to a code of conduct; does not authorize leading assessments or certifying compliance.

Authorized Instructor

An individual credentialed by the Cyber AB to deliver official CMMC training curricula; only Authorized Instructors may teach Cyber AB-approved courses.

Conflict of interest rule

C3PAOs must be independent of the assessed contractor; prior consulting or managed-service relationships with the client disqualify the organization from performing that assessment.

Cyber AB public registry

A publicly accessible list of accredited C3PAOs and credentialed individuals that contractors and primes can use to verify assessor and practitioner credentials.

Assessment vs consulting separation

Certified Assessors perform certification assessments; Certified Professionals and Registered Practitioners provide readiness support. The same firm generally cannot do both for one client.

SPRS

Supplier Performance Risk System, the DoD repository where contractors post NIST SP 800-171 self-assessment scores that primes may use to evaluate subcontractor risk.

Prime contractor flow-down

Primes must include applicable CMMC clauses in subcontracts involving FCI or CUI and verify that subcontractors meet the required CMMC level.

FCI/CUI data mapping

Contractors must identify where FCI and CUI are stored, processed, and transmitted, because the applicable CMMC level depends on the data type and contract designation.

Phased contract inclusion

CMMC requirements are added to DoD solicitations in phases, beginning with Level 1 and Level 2 self-assessments, then Level 2 C3PAO certification and Level 3.

MSP/MSSP role

Managed service providers and managed security service providers help contractors implement and maintain CMMC controls, but cannot perform certification assessments for their clients.

Small business readiness

DoD-funded and APEX accelerator programs (e.g., Project Spectrum) offer no-cost or low-cost CMMC readiness support to small defense contractors facing compliance costs.