Cmmc Expert

CMMC Expert

Deep, practitioner-grade expertise in the Cybersecurity Maturity Model Certification (CMMC) v2.0 for Department of Defense contractors. Built from the authoritative chain: NIST SP 800-171 Rev 2 (control text), NIST SP 800-171A Rev 2 (320 assessment objectives), 32 CFR Part 170 (CMMC program rule), and 48 CFR / DFARS Part 204.75 (acquisition rule).

1. Program Overview & Authority

Purpose: Standardize verification of NIST SP 800-171 cybersecurity controls across the Defense Industrial Base (DIB) protecting Controlled Unclassified Information (CUI) and Federal Contract Information (FCI).

Authority chain:

• 32 CFR Part 170 — CMMC program rule. Effective December 16, 2024.
• 48 CFR / DFARS Part 204.75 — Acquisition rule that puts CMMC into contracts. Effective November 10, 2025.
• DFARS 252.204-7012 — Pre-existing CUI safeguarding + 72-hour cyber incident reporting clause.
• DFARS 252.204-7019 — Solicitation provision requiring a current NIST 800-171 self-assessment score in SPRS.
• DFARS 252.204-7020 — Contract clause giving DoD/DIBCAC the right to verify SPRS assessments.
• DFARS 252.204-7021 — The primary CMMC certification requirement clause.
• DFARS 252.204-7025 — Solicitation provision identifying the required CMMC level for a given procurement.

Authoritative sources to cite in deliverables:

• NIST SP 800-171 Rev 2 — https://doi.org/10.6028/NIST.SP.800-171r2 (Final, including updates as of 01-28-2021; withdrawn May 14, 2024 but remains operative for CMMC).
• NIST SP 800-171A Rev 2 — assessment procedures, 320 objectives.
• CMMC Assessment Guide L2 (current version on dodcio.defense.gov).
• CMMC Scoping Guide L2.
• CMMC Scoring Methodology.
• 32 CFR Part 170 (89 FR 83214, Oct. 15, 2024).

Four-Phase Implementation Timeline

All dates keyed to November 10, 2025 (DFARS rule effective date).

Triennial re-assessment + annual affirmation throughout the certification cycle.

2. CMMC Levels (L1 / L2 / L3)

Acronyms used here (correctly):

• OSA — Organization Seeking Assessment.
• OSC — Organization Seeking Certification (used specifically in C3PAO context; OSA/OSC are largely interchangeable in practice).
• C3PAO — Certified Third-Party Assessor Organization. Accredited by the Cyber AB.
• CCA — Certified CMMC Assessor (must hold Tier 3 background investigation).
• CCP — Certified CMMC Professional (support role).
• DIBCAC — Defense Industrial Base Cybersecurity Assessment Center (DCMA's assessment arm; conducts L3 assessments and high-water-mark L2 verifications).
• DC3 — DoD Cyber Crime Center (recipient of malware samples under DFARS 7012).
• eMASS — Enterprise Mission Assurance Support Service (DoD system where C3PAO assessment results are posted).
• SPRS — Supplier Performance Risk System (where self-assessment scores and CMMC Status live).

Who needs what:

• Handles FCI only → L1.
• Handles CUI → L2 (Self) or L2 (C3PAO) per the contract.
• Sensitive national-security CUI → L3.

3. NIST 800-171 Rev 2 — 14 Families, 110 Controls

These are the only 14 families in Rev 2. Any reference to Asset Management (AM), Recovery (RE), Risk Management (RM), or Situational Awareness (SA) as 800-171 families is incorrect — those names belong to CMMC v1.0 or to other catalogs.

Numbering scheme: Chapter.Family.Requirement (e.g., 3.1.1 = Chapter 3, AC family, Requirement 1). Each requirement is either Basic (high-level) or Derived (technical implementation specifics) in Rev 2.

4. 320 Assessment Objectives (NIST SP 800-171A Rev 2)

Each 800-171 requirement decomposes into lettered assessment objectives (e.g., 3.1.1[a]–[f]). All objectives within a practice must be satisfied for the practice to be Met in a C3PAO assessment.

High-Complexity Controls (5+ Objectives)

These drive the bulk of assessment effort and evidence burden:

5. Assessment Methods — Examine / Interview / Test

Per NIST SP 800-171A Rev 2, assessors use exactly three methods (not four). The verb "Determine" that opens each assessment objective is not a method — it's the assessor's overall judgment, supported by E/I/T evidence.

Assessment objects assessors examine or test:

• Specifications — policies, procedures, plans, SSP, designs, requirements.
• Mechanisms — hardware, software, firmware controls.
• Activities — operations, exercises, backup runs.
• Individuals — system owners, admins, security personnel, users.

Practitioner rule of thumb: For each AO, the OSC should be able to produce (1) the document/specification, (2) the technical artifact or screenshot showing the mechanism is configured, and (3) at least one person who can speak to operating the control.

6. CUI & FCI — Definitions, Marking, Boundary

FCI — Federal Contract Information

• Information provided by or generated for the Government under a contract.
• Not intended for public release.
• Not classified, not CUI.
• Triggers CMMC Level 1 safeguarding (FAR 52.204-21).
• Examples: pricing, delivery schedules, contract-related correspondence.

CUI — Controlled Unclassified Information

• Information requiring safeguarding or dissemination controls per law, regulation, or government-wide policy.
• Governed by 32 CFR Part 2002 and the CUI Registry at cui.archives.gov.
• The CUI Registry contains the authoritative list of CUI categories (organized under ~20 organizational index groupings), each with its own marking and handling rules.
• Triggers CMMC Level 2 (or L3 for sensitive programs).
• Practical rule: If DFARS 252.204-7012 is in your contract, you have CUI. Full stop.

Two flavors:

• CUI Basic — default safeguarding standard; 800-171 applies.
• CUI Specified — additional handling requirements per the CUI category (e.g., ITAR, EAR, Privacy, Critical Infrastructure).

Confidentiality impact value: No less than FIPS 199 moderate.

Boundary scope rule (key to scoping): 800-171 requirements apply only to components that process, store, or transmit CUI, or that provide protection for such components.

Marking expectations:

• Banner markings on the document.
• Category identification (e.g., CUI//SP-PRVCY).
• Dissemination controls if applicable.

7. CMMC Scoping Guide — Asset Categories

Per 32 CFR 170.19 and the CMMC L2 Scoping Guide, each asset falls into one of five categories. Proper categorization can dramatically reduce assessment burden and cost.

Scope-Reduction Plays

1. CMMC enclave — isolate CUI into a dedicated environment (separate network segment, separate AD tenant, separate cloud tenant). Only the enclave is in scope.
2. Remove CUI from systems that don't need it; document the removal; those systems exit scope.
3. FedRAMP-authorized CSP — offload controls to the CSP for the cloud portion.
4. Genuinely isolated systems — air-gapped test networks with no path to CUI.

CUI Identification — Required Before Scoping

1. Map every contract containing DFARS 252.204-7012 or 7021.
2. Identify what data Government provides or contractor generates that qualifies as CUI.
3. Trace CUI flow — email, file shares, cloud, mobile, backups, vendors.
4. Document in SSP, including data flow diagrams (C3PAOs expect these).

8. ESP / CSP Rules

The most commonly misunderstood area of CMMC. ESPs and CSPs follow different rules.

Cloud Service Provider (CSP)

A third-party providing cloud services (SaaS / PaaS / IaaS) where CUI is processed, stored, or transmitted.

• FedRAMP Moderate authorization required, per DFARS 252.204-7012 and 252.239-7010.
• Equivalency option exists ("equivalent to FedRAMP Moderate" via a DoD-approved process) but is complex and rarely used.
• The OSA's on-premises infrastructure connecting to the CSP is in scope. The CSP environment itself is verified via FedRAMP, not as part of the CMMC assessment.
• The CSP must provide a Customer Responsibility Matrix (CRM) showing which controls are the CSP's vs. the customer's. The OSC's SSP documents customer-side implementation of shared controls.

Common CSP options for CUI:

ITAR/EAR caution: A CSP can be FedRAMP-authorized and technically eligible — but still ineligible to process specific CUI categories due to export-control restrictions on foreign-national access. Evaluate CUI category restrictions independently of FedRAMP authorization.

External Service Provider (ESP)

A third-party that is not cloud-based but whose services implement 800-171 controls or that processes/stores/transmits CUI on the OSA's behalf.

Common ESPs: MSSPs (SOC, SIEM), MSPs (patching, endpoint management), outsourced IT/AD admins, physical security monitoring vendors.

Rules (32 CFR 170.19 / 170.16):

1. ESP services are not exempt from assessment. If an ESP implements CMMC controls for the OSA, those services are within the assessment scope.
2. The ESP's role and services must be documented in the OSC's SSP along with a CRM.
3. ESP CMMC certification (optional, strongly recommended): if the ESP holds a valid CMMC certification covering the services provided, those services may be accepted without separate re-assessment. If the ESP is not CMMC-certified, the C3PAO must assess them as part of the OSC's assessment — significantly expanding scope and cost.

Decision tree:

Is the third-party service cloud-based?
├── YES → CSP → FedRAMP Moderate (or higher) authorization required
└── NO  → ESP → Include in scope OR get ESP CMMC-certified

9. Subcontractor Flow-Down (32 CFR 170.23)

Per the regulation (unless DoD specifies otherwise), the prime contractor determines the CMMC level required for each subcontractor based on the data the sub will handle.

Prime obligations:

• Verify subcontractor CMMC compliance at time of award, not just at solicitation response.
• Verify via SPRS (sub's CMMC Status should be visible — access mechanics still maturing).
• Include DFARS 252.204-7021 flow-down clause in subcontracts.

Practical advisory: Primes should build supplier cybersecurity verification into procurement processes now. Waiting until Phase 2/4 to verify subs will create supply chain disruptions.

10. SPRS Scoring Mechanics

Score vs. Status — Two Different Things

During Phase 1, a current SPRS score from a valid self-assessment is the CMMC L2 (Self) status.

DoD Assessment Methodology — Three Tiers

Under DFARS 252.204-7019/7020:

Scoring Formula

SPRS = 110 − Σ (deductions for not-implemented or partially-implemented controls)

• Starting score: 110.
• Point weights per practice: 5 (High criticality), 3 (Medium), 1 (Low) — set by the CMMC Scoring Methodology.
• Deduction: full point value if Not Met; partial credit at assessor discretion for partially implemented controls.
• Conditional pass threshold: ≥ 88 (i.e., ≥ 80% of 110).
• Final status: 110/110 with all practices Met (no open POA&Ms).
• Score can go negative (theoretical floor around −203).

High-Impact (5-Point) Practices

A single Not-Implemented finding on any of these costs 5 points and — for most of them — is not POA&M-eligible. Verify against the current CMMC Scoring Methodology before client-facing work.

• AC.L2-3.1.1 — System access authorization
• IA.L2-3.5.3 — Multifactor authentication
• IA.L2-3.5.10 — Cryptographic password storage
• IR.L2-3.6.1 — Incident response capability
• IR.L2-3.6.2 — Incident tracking/reporting
• MA.L2-3.7.5 — Remote maintenance MFA
• RA.L2-3.11.2 — Vulnerability scanning
• SC.L2-3.13.8 — CUI encryption in transit
• SC.L2-3.13.10 — Cryptographic key management
• SC.L2-3.13.11 — FIPS-validated cryptography (special POA&M exception — see §11)
• SC.L2-3.13.16 — CUI encryption at rest
• SI.L2-3.14.1 — Flaw remediation
• SI.L2-3.14.2 — Malicious code protection
• SI.L2-3.14.6 — System monitoring for attacks
• CA.L2-3.12.4 — System Security Plan

11. POA&M Rules — Critical Section

A Plan of Action & Milestones is a time-bound documented plan to remediate identified deficiencies. Under CMMC, POA&Ms are not a general remediation tool — they are tightly restricted.

The Three Golden Rules

Rule 1 — Level 1 = NO POA&Ms ever. Per 32 CFR 170.21(a)(1). All 15 FAR 52.204-21 practices must be fully implemented at time of self-assessment submission. No exceptions.

Rule 2 — Level 2 POA&Ms require a passing score of ≥ 80%. Per 32 CFR 170.21(a)(2)(i). Assessment score ÷ 110 must be ≥ 0.8 → ≥ 88 of 110 practices must be MET before any POA&M is allowed.

Rule 3 — Only 1-point practices on POA&M, with one exception. Per 32 CFR 170.21(a)(2)(ii). No practice on a POA&M may have a point value greater than 1. The single exception: SC.L2-3.13.11 (FIPS-validated cryptography) may be on a POA&M at its 3-point value only if encryption is in use but not yet FIPS-validated. If encryption is not employed at all, 3.13.11 carries its full 5-point weight and is not POA&M-eligible.

The FIPS Exception — Three Scenarios

Practitioner play: Before assessment, get clients to implement encryption (even if not yet FIPS-validated) — converts a disqualifying 5-point hit into a POA&M-eligible 3-point hit.

Controls That CANNOT Be on a POA&M

Per 32 CFR 170.21(a)(2)(iii), the following are explicitly ineligible regardless of point value:

• AC.L2-3.1.1 — Account management
• AC.L2-3.1.2 — Access enforcement
• AC.L2-3.1.20 — External system connections
• AC.L2-3.1.22 — CUI on publicly accessible systems
• All 5-point practices (effectively, by Rule 3)
• Verify the full list against current 32 CFR 170.21 before client deliverables.

Valid POA&M Entry — Required Fields

1. Description of the deficiency (specific practice + why not met).
2. Responsible party (named individual, not "IT department").
3. Resource requirements (budget, personnel, tooling).
4. Specific milestone dates (not "TBD" or "within 6 months").
5. Estimated completion date within the 180-day conditional window.
6. Current status, updated as remediation progresses.

Closeout Process

1. Remediate within 180 days.
2. Conduct closeout assessment (self or C3PAO — matching original assessment type).
3. Post updated results: SPRS for Self, eMASS for C3PAO.
4. Status upgrades Conditional → Final.

If POA&M Not Closed in 180 Days

• Conditional CMMC Status expires.
• Contractor is immediately ineligible for new awards requiring that level.
• Mid-performance contracts: standard contractual remedies apply.
• New assessment from scratch required to regain status.
• No extension — the 180 days is firm per regulation.

Operational POA&M vs. CMMC POA&M

Operational POA&Ms (continuous improvement tracking under normal NIST practice) are separate from CMMC assessment POA&Ms (formal regulatory constructs with 180-day clocks). Don't conflate them.

12. Findings Language

At the assessment objective level, each AO produces one of:

• Satisfied — the objective is met based on evidence collected.
• Other Than Satisfied (OTS) — the objective is not met.

At the practice level, the rollup is:

• MET — all AOs within the practice are Satisfied.
• NOT MET — one or more AOs are Other Than Satisfied (and the practice is not eligible for partial credit).
• PARTIAL — some AOs Satisfied, others not, where partial credit applies under the Scoring Methodology.
• NOT APPLICABLE — control does not apply to the assessed scope (must be justified and documented in the SSP).

Findings language convention in deliverables:

• State the AO citation (e.g., 3.1.1[a]).
• State the method that produced the finding (Examine / Interview / Test).
• State the artifact or response that demonstrates the gap.
• Map to the SPRS point impact (1 / 3 / 5).
• Identify POA&M eligibility status.

13. C3PAO Assessment Lifecycle

Pre-Assessment

1. OSC selects C3PAO from the Cyber AB marketplace.
2. Scope determination under 32 CFR 170.19 — asset categorization, CUI boundary.
3. Documentation review — C3PAO reviews SSP, policies, procedures before going on-site.
4. Readiness/gap assessment (optional but strongly recommended). A C3PAO cannot both consult and certify the same OSC — readiness reviews must come from a different C3PAO or independent consultant.
5. Artifact preparation — evidence packages mapped to 800-171A objectives.

Assessment

1. Initiation — CMMC UID assigned (10-character identifier).
2. Team composition — minimum 3 CCAs on the assessment team.
3. Assessment activities — Examine / Interview / Test against every applicable AO.
4. Scoring — each practice MET or NOT MET per its AOs.
5. POA&M determination — which gaps qualify for POA&M.

Post-Assessment

1. C3PAO posts results to CMMC-eMASS; CMMC Status (Conditional or Final) appears in SPRS.
2. Certificate of CMMC Status issued.
3. Evidence retention: artifacts hashed (NIST-approved algorithm) and retained for 6 years from CMMC Status Date.
4. C3PAO uploads artifact names, hash values, and algorithm identifiers to eMASS.

C3PAO Rules (32 CFR 170.10 / 170.11)

• Accredited by the Cyber AB.
• CCAs must hold a Tier 3 background investigation (national security eligibility, not a clearance).
• Must use only their own accredited IT for assessments.
• Prohibited from providing consulting/implementation services to OSCs they certify.
• Assessment information is strictly confidential.

L2 (Self) — Non-C3PAO Process

1. Self-assess against 800-171A objectives.
2. Apply 32 CFR 170.19 scoping.
3. Score per 32 CFR 170.24.
4. Upload to SPRS.
5. Senior official affirms per 32 CFR 170.22.
6. CMMC Status posted in SPRS.

14. Annual Affirmation & False Claims Act Risk

Annual Affirmation (32 CFR 170.22)

After initial CMMC Status, a senior company official must affirm in SPRS/eMASS each year that:

• The organization continues to implement all required practices.
• No material changes have occurred that affect CMMC compliance.
• All information-system changes are reflected in the SSP.

Frequency: within one year of initial CMMC Status Date, then annually for the 3-year cycle. Material changes may trigger re-assessment.

False Claims Act Exposure

CMMC creates real FCA exposure — context every client conversation should include:

• FCA liability: Up to 3× government damages + per-claim penalties for knowingly false certifications.
• DOJ Cyber-Fraud Initiative has been pursuing cybersecurity false certifications since 2019.
• Recent precedent: Multiple multi-million-dollar settlements against defense contractors that falsely certified cybersecurity compliance.
• Personal liability: The signing senior official is personally certifying.

What creates exposure:

1. Submitting an inflated SPRS score.
2. Knowingly false annual affirmation.
3. Certifying a bid as CMMC-compliant when the OSC knows it isn't.
4. Prime contractor knowingly ignoring sub's false claims.

Safe-harbor posture: an honest, low SPRS score plus a credible POA&M is defensible. An inflated score is not. Accurate reporting + credible remediation = manageable risk; inflated reporting = potential criminal exposure.

15. Rev 2 → Rev 3 Crosswalk + ODPs

CMMC is currently based on 800-171 Rev 2 only. Rev 3 (May 2024) is the forward horizon — not operative for CMMC until DoD adopts it (no announced date).

Structural Changes

Key Consolidations

• 3.1.12 + 3.1.14 + 3.1.15 → 03.01.12 (Remote Access)
• 3.1.16 + 3.1.17 → 03.01.16 (Wireless)
• 3.1.18 + 3.1.19 → 03.01.18 (Mobile Devices)
• 3.1.20 + 3.1.21 → 03.01.20 (External Systems)
• 3.2.1 + 3.2.3 → 03.02.01 (Literacy Training)
• 3.5.4 + 3.5.6 + 3.5.8 + 3.5.9 + 3.5.10 + 3.5.11 → 03.05.03 / 03.05.07 (MFA, Password Mgmt)
• 3.1.13 + 3.8.6 + 3.13.8 → 03.13.08 (Cryptographic Protection)
• 3.12.4 (SSP) → 03.15.02 (relocated to new PL family)

ODPs — Organization-Defined Parameters

Introduced in Rev 3. Select requirements contain [Assignment: organization-defined X] values that must be defined by either the contracting federal agency or the contractor. Once defined, they become assessable scope.

ODP categories:

• Time periods — inactivity timeouts, audit failure response windows, scan frequency.
• Roles/personnel — who is authorized for privileged accounts, who responds to logon-attempt thresholds.
• Technical parameters — number of invalid logon attempts allowed, configuration settings, types of cryptography.
• Security requirements — requirements imposed on external systems, prohibited services/ports/protocols.

ODP planning for clients pre-adoption:

1. Stand up an ODP register (separate doc or SSP appendix).
2. Have management approve each value.
3. Implement controls using those defined values.
4. Be ready to be assessed against your own stated values — they become binding.

Why You Can't "Just Use Rev 3"

Some clients have implemented Rev 3-style controls and believe they're covered. Rev 2 has specific requirements that Rev 3 softened with ODPs — for current CMMC assessments, the Rev 2 language governs:

• 3.3.7 (clock sync) — Rev 2 requires NTP sync with an authoritative source; Rev 3 softened.
• 3.4.8 (allow/deny software) — Rev 2 requires an explicit policy choice and implementation.
• 3.5.3 (MFA) — Rev 2 requires MFA for network access to non-privileged accounts; no ODP wiggle room.
• 3.13.11 (FIPS crypto) — Rev 2 says "FIPS-validated", flat. Rev 3 uses ODP. For CMMC, FIPS validation is mandatory.

16. Common L2 Implementation Gaps (with AO citations)

Replaces the loose gap list with practitioner-confirmed patterns mapped to specific assessment objectives.

Controls Where "Policy Only" Always Fails

These require technical implementation evidence, not just a policy document:

• 3.1.8 (logon attempt limits)
• 3.1.10 (screen lock)
• 3.4.8 (allow/deny software policy)
• 3.5.3 (MFA)
• 3.13.8 (CUI in transit)
• 3.13.11 (FIPS-validated cryptography)
• 3.13.16 (CUI at rest)
• 3.14.2 (malicious code protection)

17. Authoritative Sources

Primary

• NIST SP 800-171 Rev 2 — https://doi.org/10.6028/NIST.SP.800-171r2
• NIST SP 800-171A Rev 2 — assessment procedures (320 objectives)
• NIST SP 800-172 — Enhanced Security Requirements (L3 source)
• 32 CFR Part 170 — CMMC program rule (89 FR 83214, Oct. 15, 2024; effective Dec. 16, 2024)
• 48 CFR Part 204.75 (DFARS) — CMMC acquisition rule (effective Nov. 10, 2025)
• DFARS 252.204-7012 / -7019 / -7020 / -7021 / -7025
• FAR 52.204-21 — Basic Safeguarding (CMMC L1 source)
• 32 CFR Part 2002 — CUI program rule
• CUI Registry — cui.archives.gov

CMMC Program Documents

• CMMC Model v2.0
• CMMC Assessment Guide — Level 1
• CMMC Assessment Guide — Level 2
• CMMC Assessment Guide — Level 3
• CMMC Scoping Guide — Level 1
• CMMC Scoping Guide — Level 2
• CMMC Scoring Methodology
• DoD Assessment Methodology (basis for SPRS scoring)

Authoritative locations: dodcio.defense.gov/CMMC/, cyber.mil, cyberab.org, sprs.csd.disa.mil, dibnet.dod.mil (incident reporting).

Capabilities

This skill supports:

• CMMC level selection and CUI boundary scoping
• Per-control (and per-AO) implementation guidance for all 110 800-171 Rev 2 practices
• SSP development, review, and gap mapping
• Assessment objective-level evidence planning
• C3PAO assessment readiness preparation
• POA&M development with eligibility validation against 32 CFR 170.21
• SPRS score calculation against the CMMC Scoring Methodology
• ESP/CSP scoping decisions and FedRAMP equivalency analysis
• Subcontractor flow-down planning
• Annual affirmation workflow and FCA-risk advisory
• Rev 2 → Rev 3 crosswalk and ODP planning
• DFARS clause interpretation across 7012, 7019, 7020, 7021, 7025