CMMC Foundation study guide
CMMC Foundation · Work through your exam, one topic at a time.
The CMMC Foundation credential is an entry-level certificate about the Cybersecurity Maturity Model Certification ecosystem, the framework used to manage digital risk across the defense industrial base (DIB). This independent study page is for candidates who want a plain-language orientation before committing to a deeper CMMC role, such as assessor, practitioner, or instructor. The exam is organized around four equally weighted domains: CMMC Ecosystem Overview; CMMC Model and Assessment Levels; Ecosystem Roles (Assessors, Practitioners, Instructors); and Defense Contractors and the Marketplace. Expect questions that test whether you can place organizations and people in the right part of the ecosystem, distinguish the model's levels and assessment types, and explain how DIB companies (often called OSCs) fit into the marketplace. The CMMC Foundation study guide has 4 sections and about 1,684 words.
01CMMC Ecosystem Overview
The CMMC Ecosystem Overview domain tests why the program exists, which documents give it legal force, and who is allowed to do what. Expect items on the path from CMMC 1.0 to CMMC 2.0, on the 2024 final rule, and on the line between DoD, the accreditation body, and assessors.
461 words, about 2 min02CMMC Model and Assessment Levels
The Model and Assessment Levels domain tests the three levels, what each one requires, how each is assessed, and how long results last. Most items ask you to match a scenario to the correct level and the correct assessment method.
428 words, about 2 min03Ecosystem Roles: Assessors, Practitioners, Instructors
The Ecosystem Roles domain tests who is credentialed to do what, and where the independence lines fall. Items typically present a person or firm and ask which activities are permitted.
402 words, about 2 min04Defense Contractors and the Marketplace
This domain tests how CMMC reaches contractors through contracts and subcontracts, and how the requirement reshapes the defense market. Items tend to be scenario-based: a company of a given size, tier, and contract type must reach a given level by a given point.
393 words, about 2 min