Cyber AB CMMC-CCP - Certified CMMC Professional (CCP) Exam

CCP (Certified CMMC Professional):

Entry-level certification in the CMMC ecosystem.

Supports assessment activities under the supervision of a CCA.

May assist in consulting roles outside of formal assessments.

CCA (Certified CMMC Assessor):

Certified tolead assessmentsunder the CMMC model.

Requiredfor conductingLevel 2 formal assessments.

Can be part of a C3PAO assessment team or lead it.

Step 1: Define Roles – CCP and CCASource: CMMC Assessment Process (CAP) v1.0, Section 2.3 – Assessment Team Composition

“Level 2 assessments must be led by a Certified CMMC Assessor (CCA), who may be supported by one or more CCPs.”

✅Step 2: Citizenship RequirementsCAP v1.0 – Appendix B: Team Composition and Clearance Requirements

“All team members performing Level 2 assessments must be U.S. citizens when handling CUI, regardless of role.”

But forsupporting team members who do not handle CUIor inFCI-only scoping, there is no automatic exclusion based on citizenship.

So:

TheCCA leadsthe team.

CCPs can be team membersregardless of citizenship,unless restricted by contract or CUI handling needs.

A. The CCP leads the Level 2 Assessment Team…✘ Incorrect. CCPscannot leadLevel 2 assessments.

B. The CCA leads… includes 3 CCP with US Citizenship.✘ Incorrect. Citizenship is requiredonly when handling CUI, not a universal requirement.

D. The CCP leads…✘ Again, CCPs donot have the authority to leadformal CMMC assessments.

❌Why the Other Options Are Incorrect

Only aCertified CMMC Assessor (CCA)may lead aLevel 2 Assessment Team, and theymay include CCPs, evennon-U.S. citizens, if citizenship is not a requirement based on contractual or data sensitivity scope.

Understanding Configuration Management (CM) in CMMC Level 2InCMMC Level 2, theConfiguration Management (CM) domainis critical for ensuring that systems aresecurely configured, maintained, and monitoredto prevent unauthorized changes. One key aspect of CM is managinguser-installed software, which can introducesecurity risksif not properly controlled.

The correct approach to managinguser-installed softwarealigns withCM.3.068fromNIST SP 800-171, which requires organizations to:

✅Establish and enforce configuration settingsto ensure security.

✅Monitor and control user-installed softwareto prevent unauthorized or insecure applications from running on organizational systems.

Why "Controlled and Monitored" is Correct?The CCP (Certified CMMC Professional) conducting theinterviewshould focus on whether theuser-installed softwareiscontrolled and monitoredto align withCMMC Level 2 requirements. This means verifying:

Approval processesfor user-installed software.

Monitoring mechanisms(e.g., system logs, audits) to track software changes.

Policies that restrict unauthorized installationsto prevent security risks.

Breakdown of Answer ChoicesOption

Description

Correct?

A. Controlled and monitored

✅Ensures compliance with CM.3.068, verifying that user-installed software ismanaged securely.

✅Correct

B. Removed from the system

Software isnot always removed—only unauthorized or risky software should be.

❌Incorrect

C. Scanned for malicious code

While scanning isimportant(covered in SI.3.218), it isnot the primary focusof Configuration Management.

❌Incorrect

D. Limited to mission-essential use only

While limiting software is useful,monitoring and controllingis the key security measure.

❌Incorrect

NIST SP 800-171, CM.3.068– "Control and monitor user-installed software."

CMMC 2.0 Level 2 Requirements– Directly aligned withNIST SP 800-171 security controls.

Official Reference from CMMC 2.0 DocumentationFinal Verification and ConclusionThe correct answer isA. Controlled and monitored, as perCM.3.068inNIST SP 800-171andCMMC 2.0documentation.

Planning and preparing for aCMMC assessmentinvolves collaboration between theassessorand theOrganization Seeking Certification (OSC)to determine scope, required evidence, and logistics. This planning process isdynamicand must adapt as new information emerges.

Assessment Scope and Requirements May Change

As assessors gather evidence and analyze the environment,new details about assets, networks, and security controlsmay require adjustments to the assessment plan.

TheCMMC Assessment Process (CAP) Guideemphasizes that assessmentrequirements and scope should be continuously reviewed and updatedto reflect real-time findings.

Assessors Follow an Adaptive Approach

DuringCMMC assessments, organizations may discover additionalFCI or CUI assets, which can change the required security practices to be evaluated.

Assessors shouldrevise the assessment approach accordinglyrather than strictly following an initial, unchangeable plan.

A. Scoping an assessment is easy and worry-free→Incorrect

Scoping is acritical and complex processthat requires careful evaluation of the OSC’s information systems and assets.

CMMC Scoping Guidestates thatidentifying in-scope assets is crucial and requires significant effort.

B. The initial plan cannot be changed once agreed upon→Incorrect

Theinitial assessment plan is a starting point, butit must be flexiblebased on real-time findings.

CMMC CAP Guideemphasizescontinuous refinementduring the assessment process.

C. There is a determined amount of time that the OSC's point of contact has to submit evidence and rough order-of-magnitude→Incorrect

While there aretimelines, the key focus is ensuring thatall necessary evidence is gathered accuratelyrather than rushing to meet a strict deadline.

CMMC Assessment Process (CAP) Guide– States that assessment requirements and planning should be updated as additional information is gathered.

CMMC Scoping Guide (Nov 2021)– Explains that assessors must continually refinein-scope assets and requirementsthroughout the process.

Why the Correct Answer is "D"?Why Not the Other Options?Relevant CMMC 2.0 References:Final Justification:Assessment planning is a dynamic process.Assessors must continuously review and update the requirements and planas new information emerges, makingDthe correct answer.

Step 1: Understand the Assessment Phases (CAP v1.0)TheCMMC Assessment Process (CAP)outlines a structured lifecycle for assessments, including:

Plan and Prepare Phase– Develop the assessment plan (before the assessment starts).

Conduct Assessment Phase– Execute the actual assessment activities.

Report Results Phase– Finalize and deliver the assessment outcomes.

CAP v1.0 – Section 3.5 (Conduct Assessment):

“The assessment team collects, examines, and evaluates evidence to determine if practices are MET or NOT MET.”

During the“Conduct Assessment” phase, the main activity is to:

Collect evidence(documentation, interviews, testing),

Validate adequacy and sufficiency,

Score practicesas MET/NOT MET.

✅Step 2: Why “Collect and Examine Evidence” Is the Primary ActivityThis is thecore responsibilityof assessorswhile conductingan assessment.

A. Develop assessment plan✘ This occurs in thePlan and Preparephasebeforeconducting the assessment.

C. Verify readiness to conduct assessment✘ Readiness verification is part ofpre-assessment activities, not during the assessment itself.

D. Deliver recommended assessment results✘ This is done during theReport Resultsphase after the assessment has been conducted.

❌Why the Other Options Are Incorrect

Theprimary activity performed during the actual executionof a CMMC assessment iscollecting and examining evidenceto determine compliance with practices.

AC3PAO (Certified Third-Party Assessment Organization)is responsible for conductingCMMC Level 2 assessments.

After completing theassessment, theC3PAO generates the Final Recommended Assessment Results, which include key documentation reviewed by theCMMC Quality Assurance Professional (CQAP)for quality control.

This question deals withasset categorizationduring aCMMC Level 1 Self-Assessment. The organization is manufacturingspecialized partsfor the DoD, butLevel 1of CMMC only concernsFederal Contract Information (FCI)—notControlled Unclassified Information (CUI). Therefore, asset categorization should follow theCMMC Scoping Guidance for Level 1.

✅Step 1: Understand CMMC Level 1 and FCI

Level 1 Objective:

Implement basic safeguarding requirements as perFAR 52.204-21.

Applies to systems thatstore, process, or transmit FCI.

Self-assessments are permitted and required annually.

Source Reference:

CMMC Scoping Guidance – Level 1 (v1.0)

https://dodcio.defense.gov/CMMC

✅Step 2: What is an “In-scope Asset”?

CMMC Scoping Guidance – Level 1definesIn-scope assetsas:

“Assets that process, store, or transmit FCI or provide security protection for such assets.”

In this scenario:

The machining company isperforming contract work(manufacturing DoD parts).

Thetesting is done internally, implying the systems and equipment used in testing and documentation aredirectly supporting the contract.

These systems likely handleFCIsuch as technical specifications, purchase orders, or test reports.

➡️Therefore, the equipment and systems used in testing are consideredIn-scope Assetsunder Level 1.

❌Why the Other Options Are Incorrect

A. CUI Asset

✘Incorrect forLevel 1:

CUI is only in scope atCMMC Level 2 and Level 3.

Level 1 is concerned withFCI, not CUI.

C. Specialized Asset

✘Incorrect definition:

Specialized assets(defined inCMMC Level 2 Scoping) include IoT, OT, ICS, GFE, and similar types of non-enterprise assets that may require alternative treatment.

This classification isnot used in Level 1 Scoping.

D. Contractor Risk Managed Asset

✘Incorrect:

Also defined underCMMC Level 2 Scopingonly.

These are assets that are not security-protected but are managed via risk-based decisions.

This term isnot applicableforCMMC Level 1 assessments.

✅Step 3: Alignment with Official Documentation

According to theCMMC Scoping Guidance for Level 1:

“The assets within the self-assessment scope are those that process, store, or transmit FCI. These assets are considered ‘in-scope.’”

No other asset categorization (such as CUI asset, specialized asset, or contractor risk managed asset) is used atLevel 1.

BLUF (Bottom Line Up Front):

For aCMMC Level 1 Self-Assessment, theonlyasset category officially recognized is theIn-scope Asset— any asset that handles or protects FCI. Since the company's internal testing operations are part of fulfilling the DoD contract, the systems and staff involved arein scope.

TheCybersecurity Maturity Model Certification (CMMC) Assessment Process (CAP)outlines strict guidelines regardingconflicts of interest (COI)to ensure the integrity and impartiality of assessments conducted byCertified Third-Party Assessment Organizations (C3PAOs)andCertified Assessors (CAs).

The scenario presented involves apotential conflict of interestdue to a prior relationship (former college roommate) between thecertified assessorand an individual at theOrganization Seeking Certification (OSC). While this prior relationship does not automatically disqualify the assessor, it must bedisclosed, documented, and mitigated appropriately.

Inform the OSC and C3PAO of the Potential Conflict of Interest

TheCMMC Code of Professional Conduct (CoPC)requires assessors to disclose any potential conflicts of interest.

Transparency ensures that all parties, including theOSC and C3PAO, are aware of the situation.

Document the Conflict and Mitigation Actions in the Assessment Plan

PerCMMC CAP documentation, potential conflicts should be assessed based on their material impact on the objectivity of the assessment.

The conflict and proposed mitigation strategies must beformally recorded in the assessment planto provide an audit trail.

Determine If the Mitigation Actions Are Acceptable

If theOSC and C3PAOdetermine that the mitigation actions adequatelyeliminate or reduce the risk of bias, the assessment may proceed.

Common mitigation strategies include:

Assigning another assessor forinterviews with the conflicted individual.

Ensuring thatdecisions regarding the OSC’s compliance are reviewed independently.

Proceed with the Assessment If Mitigation Is Acceptable

If the mitigation actions sufficiently address the conflict, the assessment may continue understrict adherence to documented procedures.

CMMC Conflict of Interest Handling Process

A. Do not inform the OSC and the C3PAO of the possible conflict of interest, and continue as planned.❌Incorrect. This violates CMMC’s integrity requirements and could result indisciplinary actions against the assessor or invalidation of the assessment. Transparency is mandatory.

B. Inform the OSC and the C3PAO of the possible conflict of interest, and start the entire process over without the conflicted team member.❌Incorrect. The CAP doesnotmandate immediate reassignment unless the conflict isunresolvable. Instead, mitigation strategies should be considered first.

C. Inform the OSC and the C3PAO of the possible conflict of interest but since it has been an acceptable amount of time since college, no conflict of interest exists, and continue as planned.❌Incorrect.The passage of time alone does not automatically eliminate a conflict of interest. Proper documentation and mitigation are still required.

Why the Other Answers Are Incorrect

CMMC Assessment Process (CAP) Document– Defines COI requirements and mitigation actions.

CMMC Code of Professional Conduct (CoPC)– Outlines ethical responsibilities of assessors.

CMMC Accreditation Body (Cyber-AB) Guidance– Provides rules on conflict resolution.

CMMC Official ReferencesThus,option D is the most correct choice, as it aligns with the official CMMC conflict of interest procedures.

In the context of CMMC 2.0 assessments, thesufficiency criteriaare used to determine whether the assessment team has gathered enough evidence to support their conclusions about compliance with a given requirement.

Definition of Sufficiency Criteria:

Sufficiency refers to thequantityandcompletenessof the evidence collected during an assessment.

This ensures that the evidence collected isenough to support an objective and valid determinationof compliance.

Why Sufficiency Matters in CMMC 2.0:

Assessors must ensure that the amount of evidence collected isadequate to substantiate findingswithout doubt or gaps.

This prevents situations where an organization might claim compliance but lacks thenecessary documentation, technical evidence, or procedural validationto prove it.

Official CMMC 2.0 References:

TheCMMC Assessment Process (CAP) Guidedefines sufficiency as a key factor in validating assessment findings.

According toCMMC 2.0 Level 2 Scoping Guidance, assessors must apply sufficiency criteria when reviewingartifacts, documentation, interviews, and system configurations.

TheDoD CMMC Assessment Guide(aligned with NIST SP 800-171A) emphasizes that compliance decisions must besupported by a sufficient amount of verifiable evidence.

Comparison with Other Criteria:

Adequacy Criteria→ Focuses onqualityof the evidence, not the quantity.

Objectivity Criteria→ Ensures evidence isunbiased and impartial, not necessarily complete.

Subjectivity Criteria→ Not applicable in CMMC since assessments must beobjective and based on factual evidence.

Step-by-Step Breakdown:Conclusion:To verify compliance in CMMC 2.0 assessments, the assessment team must ensuresufficientevidence is available to support a determination. This makes"Sufficiency Criteria" (Option C)the correct answer.

Federal Contract Information (FCI)is any informationnot intended for public releasethat is provided or generated under aU.S. Government contracttodevelop or deliver a product or service.

Enhanced Security Personnel (ESP)refers to employees, contractors, or third parties whohave access to FCIwithin anOrganization Seeking Certification (OSC).

UnderCMMC 2.0 Scoping Guidance, anypersonnel, system, or asset with access to FCI is considered in scopefor a CMMC Level 1 assessment.

Since theESP employee has access to FCI, theymustbe included in the assessment scope.

Option B (Out of scope)is incorrect because anyone with access to FCI is automatically considered part of theCMMC Level 1 boundary.

Option C (OSC point of contact)is incorrect because thepoint of contactis typically an administrative or compliance representative, not necessarily someone with FCI access.

Option D (Assessment Team Member)is incorrect because anESP employee is not part of the assessment team but rather a subject of the assessment.

CMMC Level 1 Scoping Guide, Section 2 – Defining Scope for FCI

CMMC Assessment Process (CAP) Guide – Roles and Responsibilities

Federal Acquisition Regulation (FAR) 52.204-21(Basic Safeguarding of FCI)

Understanding Scoping in CMMC Level 1 Self-AssessmentsWhy Option A (In scope) is CorrectOfficial CMMC Documentation ReferencesFinal VerificationSince theESP employee has access to FCI, they are consideredin scopefor the CMMC Level 1 self-assessment, makingOption A the correct answer.

Key References for a Lead Assessor in a CMMC AssessmentALead Assessorconducting aCMMC assessmentmust rely onofficial CMMC guidance documentsto evaluate whether anOrganization Seeking Certification (OSC)meets the required cybersecurity practices.

TheCMMC Assessment Guideprovidesdetailed descriptionsof eachpractice and processat the specificCMMC level being assessed.

It defines:✔Theassessment objectivesfor each practice.✔Therequired evidencefor compliance.✔Thescoring criteriato determine if a practice isMET or NOT MET.

Most Relevant Reference: CMMC Assessment Guide

A. DoD adequate security checklist for covered defense information → Incorrect

TheDoD adequate security checklistis related toDFARS 252.204-7012 compliance, butCMMC assessmentsfollow theCMMC Assessment Guide.

B. CMMC Model Overview as it provides assessment methods and objects → Incorrect

TheCMMC Model Overviewprovideshigh-level guidance, butdoes not contain specific assessment criteria.

C. Safeguarding requirements from FAR Clause 52.204-21 for a Level 2 Assessment → Incorrect

FAR 52.204-21is relevant toCMMC Level 1 (FCI protection), butCMMC Level 2 follows NIST SP 800-171and requiresCMMC Assessment Guidesfor validation.

D. Published CMMC Assessment Guide practice descriptions for the desired certification level → Correct

TheCMMC Assessment Guideis theofficial documentused to determine if anOSC meets the required security practices for certification.

Why is the Correct Answer "D. Published CMMC Assessment Guide practice descriptions for the desired certification level"?

CMMC Assessment Process (CAP) Document

Specifies thatLead Assessors must use the CMMC Assessment Guidefor official scoring.

CMMC Assessment Guide for Level 1 & Level 2

Providesdetailed descriptions, assessment methods, and scoring criteriafor each practice.

CMMC-AB Guidance for Certified Third-Party Assessment Organizations (C3PAOs)

Confirms thatCMMC assessments must follow the Assessment Guide, not general DoD security policies.

CMMC 2.0 References Supporting This Answer:

Final Answer:✔D. Published CMMC Assessment Guide practice descriptions for the desired certification level.