CMMC Certified CMMC Assessor (CCA): key terms

Flashcards for this exam CMMC Certified CMMC Assessor (CCA) guide

• 32 CFR Part 170Federal regulation establishing the CMMC program, effective 16 December 2024.Advanced
• Assessment MethodsThe three NIST assessment methods: examine (review artifacts), interview (discuss with people), and test (exercise mechanisms).Intermediate
• Audit EvidenceInformation used by auditors to arrive at conclusions on which opinions are based.Foundational
• Audit FindingDocumented result of an audit describing a condition that deviates from criteria, with cause, effect, and recommendation.Foundational
• Audit SamplingApplying audit procedures to less than 100 percent of a population to draw conclusions about the whole.Foundational
• Authorization BoundaryAll components of a system authorized for operation by an authorizing official, excluding separately authorized connected systems.Advanced
• Certified Third-Party Assessment Organization (C3PAO)Organization authorized by the Cyber AB to conduct CMMC Level 2 certification assessments.Intermediate
• CMMC AffirmationAnnual statement in SPRS by an Affirming Official that the contractor continues to meet its CMMC level requirements.Advanced
• CMMC Asset CategoriesScoping categories for CMMC Level 2: CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets, and Out-of-Scope Assets.Advanced
• CMMC Conditional StatusTemporary CMMC status allowing award when a limited set of requirements remains on a POA&M to be closed within 180 days.Advanced
• CMMC Level 1CMMC level for contractors handling only FCI, requiring the 15 FAR 52.204-21 safeguarding requirements and an annual self-assessment.Intermediate
• CMMC Level 2CMMC level for contractors handling CUI, requiring the 110 NIST SP 800-171 Rev. 2 requirements.Intermediate
• CMMC Level 3Highest CMMC level, requiring Level 2 certification plus 24 selected NIST SP 800-172 requirements assessed by DIBCAC.Advanced
• Control InheritanceSituation where a system receives protection from controls implemented by another entity or system.Intermediate
• Controlled Unclassified Information (CUI)Government-created or -owned information requiring safeguarding or dissemination controls under law, regulation, or policy, but not classified.Intermediate
• CUI EnclaveSegmented environment designed to contain all CUI processing, limiting the scope of CMMC or NIST SP 800-171 compliance.Advanced
• Cyber ABThe official accreditation body for the CMMC ecosystem, formerly the CMMC Accreditation Body.Intermediate
• Cybersecurity Maturity Model Certification (CMMC)DoD program verifying that defense contractors protect FCI and CUI, with three levels of assessment requirements.Foundational
• Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)DCMA organization that performs DoD-led cybersecurity assessments of defense contractors, including CMMC Level 3.Advanced
• DFARS 252.204-7012Defense acquisition clause requiring contractors to safeguard covered defense information and report cyber incidents.Intermediate
• External Service Provider (ESP)CMMC term for an external organization providing IT or cybersecurity services that handle CUI or Security Protection Data.Advanced
• Federal Contract Information (FCI)Non-public information provided by or generated for the US government under a contract, not intended for public release.Intermediate
• NIST SP 800-171NIST requirements for protecting the confidentiality of CUI in nonfederal systems and organizations.Intermediate
• NIST SP 800-171ANIST assessment procedures for verifying the security requirements of NIST SP 800-171.Advanced
• NIST SP 800-172NIST enhanced security requirements for protecting CUI against advanced persistent threats.Advanced
• NIST SP 800-53ANIST guide for assessing security and privacy controls, defining assessment procedures and methods.Advanced
• Organization-Defined Parameter (ODP)Variable portion of a control that the organization sets, such as a frequency or time period.Advanced
• Plan of Action and Milestones (POA&M)Document tracking weaknesses, planned remediation actions, resources, and target completion dates.Intermediate
• ReperformanceAuditor independently executes a control or procedure to verify it operates as described.Intermediate
• ScopingDetermining which controls or requirements apply to a system, process, or assessment.Intermediate
• Supplier Performance Risk System (SPRS)DoD system where contractors post NIST SP 800-171 assessment scores and CMMC status and affirmations.Advanced
• System Security Plan (SSP)Formal document describing a system's boundary, environment, security requirements, and how controls are implemented.Intermediate