CCA CMMC Certification Levels & Requirements 2

Question 1

What is the maximum number of days allowed to close a Plan of Action & Milestones (POA&M) item to achieve a final CMMC Level 2 certification after receiving conditional status?

Accepted Answer

180 days

Answer

Under CMMC 2.0, contractors with conditional CMMC status must close all POA&M items within 180 days to achieve final certification and maintain contract eligibility.

Question 2

Which NIST publication provides the enhanced security requirements that underpin CMMC Level 3 (Expert)?

Accepted Answer

NIST SP 800-172

Answer

CMMC Level 3 builds on Level 2 (NIST SP 800-171) by adding requirements from NIST SP 800-172, which addresses enhanced security measures to counter Advanced Persistent Threats (APTs).

Question 3

How many domains are included in the CMMC 2.0 model?

Accepted Answer

14

Answer

CMMC 2.0 includes 14 domains (e.g., AC, AT, AU, CM, IA, IR, MA, MP, PE, PS, RA, CA, SC, SI) that map to the control families in NIST SP 800-171.

Question 4

What is the primary purpose of DFARS clause 252.204-7012 in relation to cybersecurity?

Accepted Answer

To establish adequate security safeguards and mandate 72-hour cyber incident reporting for CUI

Answer

DFARS 252.204-7012 requires contractors to implement adequate security to protect covered defense information (CUI) and mandates reporting of cyber incidents to DoD within 72 hours.

Question 5

Which CMMC level specifically addresses protecting CUI against Advanced Persistent Threats (APTs)?

Accepted Answer

Level 3

Answer

CMMC Level 3 (Expert) is specifically designed to protect CUI against APTs by adding practices from NIST SP 800-172 on top of the Level 2 baseline.

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

CCA CMMC Certification Levels & Requirements 2