CMMC Certified CMMC Professional (CCP): key terms

Flashcards for this exam CMMC Certified CMMC Professional (CCP) guide

• 32 CFR Part 170Federal regulation establishing the CMMC program, effective 16 December 2024.Advanced
• Assessment MethodsThe three NIST assessment methods: examine (review artifacts), interview (discuss with people), and test (exercise mechanisms).Intermediate
• Certified Third-Party Assessment Organization (C3PAO)Organization authorized by the Cyber AB to conduct CMMC Level 2 certification assessments.Intermediate
• CMMC AffirmationAnnual statement in SPRS by an Affirming Official that the contractor continues to meet its CMMC level requirements.Advanced
• CMMC Asset CategoriesScoping categories for CMMC Level 2: CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets, and Out-of-Scope Assets.Advanced
• CMMC Conditional StatusTemporary CMMC status allowing award when a limited set of requirements remains on a POA&M to be closed within 180 days.Advanced
• CMMC Level 1CMMC level for contractors handling only FCI, requiring the 15 FAR 52.204-21 safeguarding requirements and an annual self-assessment.Intermediate
• CMMC Level 2CMMC level for contractors handling CUI, requiring the 110 NIST SP 800-171 Rev. 2 requirements.Intermediate
• CMMC Level 3Highest CMMC level, requiring Level 2 certification plus 24 selected NIST SP 800-172 requirements assessed by DIBCAC.Advanced
• Control FamilyGrouping of related controls in a catalog such as NIST SP 800-53, identified by a two-letter code.Intermediate
• Controlled Unclassified Information (CUI)Government-created or -owned information requiring safeguarding or dissemination controls under law, regulation, or policy, but not classified.Intermediate
• CUI EnclaveSegmented environment designed to contain all CUI processing, limiting the scope of CMMC or NIST SP 800-171 compliance.Advanced
• Cyber ABThe official accreditation body for the CMMC ecosystem, formerly the CMMC Accreditation Body.Intermediate
• Cybersecurity Maturity Model Certification (CMMC)DoD program verifying that defense contractors protect FCI and CUI, with three levels of assessment requirements.Foundational
• Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)DCMA organization that performs DoD-led cybersecurity assessments of defense contractors, including CMMC Level 3.Advanced
• DFARS 252.204-7012Defense acquisition clause requiring contractors to safeguard covered defense information and report cyber incidents.Intermediate
• External Service Provider (ESP)CMMC term for an external organization providing IT or cybersecurity services that handle CUI or Security Protection Data.Advanced
• Federal Contract Information (FCI)Non-public information provided by or generated for the US government under a contract, not intended for public release.Intermediate
• Gap AnalysisComparison of current state with a desired state or requirement to identify deficiencies and actions.Foundational
• NIST SP 800-171NIST requirements for protecting the confidentiality of CUI in nonfederal systems and organizations.Intermediate
• NIST SP 800-171ANIST assessment procedures for verifying the security requirements of NIST SP 800-171.Advanced
• NIST SP 800-172NIST enhanced security requirements for protecting CUI against advanced persistent threats.Advanced
• Plan of Action and Milestones (POA&M)Document tracking weaknesses, planned remediation actions, resources, and target completion dates.Intermediate
• Supplier Performance Risk System (SPRS)DoD system where contractors post NIST SP 800-171 assessment scores and CMMC status and affirmations.Advanced
• System Security Plan (SSP)Formal document describing a system's boundary, environment, security requirements, and how controls are implemented.Intermediate