CCA CMMC Certification Levels & Requirements

Question 1

How many cybersecurity practices are required for CMMC Level 1 (Foundational)?

Accepted Answer

17

Answer

CMMC Level 1 requires 17 practices across 6 domains that align with FAR clause 52.204-21, covering basic cyber hygiene to protect Federal Contract Information (FCI).

Question 2

Which NIST publication serves as the primary framework for CMMC Level 2 (Advanced) requirements?

Accepted Answer

NIST SP 800-171

Answer

CMMC Level 2 maps directly to the 110 security requirements in NIST SP 800-171, which are designed to protect Controlled Unclassified Information (CUI) in non-federal systems.

Question 3

What type of assessment is required for a CMMC Level 1 certification?

Accepted Answer

Annual self-assessment affirmed by a senior official

Answer

CMMC Level 1 only requires an annual self-assessment affirmed by a senior company official, not a third-party or government-led assessment.

Question 4

Which organization conducts government-led assessments for CMMC Level 3 (Expert)?

Accepted Answer

Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)

Answer

CMMC Level 3 assessments are conducted by DIBCAC (Defense Industrial Base Cybersecurity Assessment Center), a government entity under the DoD, due to the sensitive nature of Level 3 programs.

Question 5

What type of sensitive information does CMMC Level 2 specifically aim to protect?

Accepted Answer

Controlled Unclassified Information (CUI)

Answer

CMMC Level 2 is designed to protect Controlled Unclassified Information (CUI) in the defense supply chain, requiring the full 110 NIST SP 800-171 practices.

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

CCA CMMC Certification Levels & Requirements