CCA CCA Contractor & Supplier Requirements

Question 1

Which DFARS clause requires defense contractors to implement NIST SP 800-171 and report cyber incidents?

Accepted Answer

DFARS 252.204-7012

Answer

DFARS 252.204-7000

Answer

DFARS 252.239-7010

Answer

DFARS 252.204-7020

Question 2

Under CMMC rules, when must a prime contractor flow down CMMC requirements to its subcontractors?

Accepted Answer

When the subcontractor will process, store, or transmit CUI or FCI in support of the prime contract

Answer

Never — CMMC only applies to prime contractors

Answer

Only when the subcontract value exceeds $1 million

Answer

Only for subcontractors with prior CMMC assessments

Question 3

What is the purpose of the CMMC Model and how does it relate to NIST SP 800-171?

Accepted Answer

CMMC Level 2 is based on the 110 security requirements in NIST SP 800-171, adding a third-party assessment mandate

Answer

CMMC replaces NIST SP 800-171 entirely with new requirements

Answer

CMMC only applies to large contractors while NIST SP 800-171 applies to small businesses

Answer

CMMC is a voluntary framework while NIST SP 800-171 is mandatory

Question 4

What obligation does a defense contractor have when it discovers a cyber incident affecting CUI under DFARS 252.204-7012?

Accepted Answer

Report the incident to the DoD within 72 hours of discovery

Answer

Report the incident to CISA within 24 hours

Answer

Document the incident internally with no reporting required

Answer

Only report incidents that resulted in confirmed data exfiltration

Question 5

How does CMMC affect a defense contractor that only handles Federal Contract Information (FCI) but not CUI?

Accepted Answer

FCI-only contractors must meet CMMC Level 1, which requires implementation of basic safeguarding requirements from FAR 52.204-21

Answer

FCI-only contractors are exempt from all CMMC requirements

Answer

FCI-only contractors must meet CMMC Level 2 with third-party assessment

Answer

FCI is governed by a separate framework unrelated to CMMC

Question 6

Which entity is responsible for authorizing C3PAOs to conduct CMMC assessments?

Accepted Answer

The CMMC Accreditation Body (CMMC-AB), also known as The Cyber AB

Answer

The Department of Defense directly

Answer

NIST

Answer

The Cybersecurity and Infrastructure Security Agency (CISA)