git:20260418.2a7ccbb to git:20260520.16bfb2a

+ description: "CMMC v2.0 expert for DoD contractors. Covers NIST 800-171 Rev 2 (14 families, 110 controls), SPRS scoring, POA&M rules, 32 CFR Part 170, DFARS clauses, scoping, ESP/CSP, C3PAO assessment lifecycle, and Rev 2 → Rev 3 transition."

+ Deep, practitioner-grade expertise in the Cybersecurity Maturity Model Certification (CMMC) v2.0 for Department of Defense contractors. Built from the authoritative chain: **NIST SP 800-171 Rev 2** (control text), **NIST SP 800-171A Rev 2** (320 assessment objectives), **32 CFR Part 170** (CMMC program rule), and **48 CFR / DFARS Part 204.75** (acquisition rule).

+ ## 1. Program Overview & Authority

+ **Purpose:** Standardize verification of NIST SP 800-171 cybersecurity controls across the Defense Industrial Base (DIB) protecting Controlled Unclassified Information (CUI) and Federal Contract Information (FCI).

+ **Authority chain:**

+ - **32 CFR Part 170** — CMMC program rule. Effective **December 16, 2024**.

+ - **48 CFR / DFARS Part 204.75** — Acquisition rule that puts CMMC into contracts. Effective **November 10, 2025**.

+ - **DFARS 252.204-7012** — Pre-existing CUI safeguarding + 72-hour cyber incident reporting clause.

+ - **DFARS 252.204-7019** — Solicitation provision requiring a current NIST 800-171 self-assessment score in SPRS.

+ - **DFARS 252.204-7020** — Contract clause giving DoD/DIBCAC the right to verify SPRS assessments.

+ - **DFARS 252.204-7021** — The primary CMMC certification requirement clause.

+ - **DFARS 252.204-7025** — Solicitation provision identifying the required CMMC level for a given procurement.

+ **Authoritative sources to cite in deliverables:**

+ - NIST SP 800-171 Rev 2 — https://doi.org/10.6028/NIST.SP.800-171r2 (Final, including updates as of 01-28-2021; withdrawn May 14, 2024 but remains operative for CMMC).

+ - NIST SP 800-171A Rev 2 — assessment procedures, 320 objectives.

+ - CMMC Assessment Guide L2 (current version on dodcio.defense.gov).

+ - CMMC Scoping Guide L2.

+ - CMMC Scoring Methodology.

+ - 32 CFR Part 170 (89 FR 83214, Oct. 15, 2024).

+ ### Four-Phase Implementation Timeline

+ All dates keyed to **November 10, 2025** (DFARS rule effective date).

+ | Phase | Window | What's in contracts |

+ |---|---|---|

+ | **Phase 1** | 2025-11-10 → 2026-11-09 | L1 (Self), L2 (Self); L2 (C3PAO) at DoD discretion |

+ | **Phase 2** | 2026-11-10 → 2027-11-09 | + L2 (C3PAO) as routine contractual requirement |

+ | **Phase 3** | 2027-11-10 → 2028-11-09 | + L3 (DIBCAC) for high-sensitivity programs |

+ | **Phase 4** | 2028-11-10 and beyond | All applicable solicitations require appropriate CMMC level |

+ Triennial re-assessment + annual affirmation throughout the certification cycle.

+ ---

+ ## 2. CMMC Levels (L1 / L2 / L3)

+ | Level | Name | Practices | Source | Assessment | POA&M Allowed | Cycle |

+ |---|---|---|---|---|---|---|

+ | **Level 1** | Foundational | **15** | FAR 52.204-21 | Self only | **No — never** | Annual self + annual affirmation |

+ | **Level 2** | Advanced | **110** | NIST SP 800-171 Rev 2 | Self **or** C3PAO | Yes — restricted (see §11) | Triennial + annual affirmation |

+ | **Level 3** | Expert | **134** (110 + 24 selected from 800-172) | NIST SP 800-171 Rev 2 + 800-172 | DCMA **DIBCAC** | Per DIBCAC methodology | Triennial + annual affirmation |

+ **Acronyms used here (correctly):**

+ - **OSA** — Organization Seeking Assessment.

+ - **OSC** — Organization Seeking Certification (used specifically in C3PAO context; OSA/OSC are largely interchangeable in practice).

+ - **C3PAO** — Certified Third-Party Assessor Organization. Accredited by the Cyber AB.

+ - **CCA** — Certified CMMC Assessor (must hold Tier 3 background investigation).

+ - **CCP** — Certified CMMC Professional (support role).

+ - **DIBCAC** — **Defense Industrial Base Cybersecurity Assessment Center** (DCMA's assessment arm; conducts L3 assessments and high-water-mark L2 verifications).

+ - **DC3** — DoD Cyber Crime Center (recipient of malware samples under DFARS 7012).

+ - **eMASS** — Enterprise Mission Assurance Support Service (DoD system where C3PAO assessment results are posted).

+ - **SPRS** — Supplier Performance Risk System (where self-assessment scores and CMMC Status live).

+ **Who needs what:**

+ - Handles FCI only → L1.

+ - Handles CUI → L2 (Self) or L2 (C3PAO) per the contract.

+ - Sensitive national-security CUI → L3.

+ ---

+ ## 3. NIST 800-171 Rev 2 — 14 Families, 110 Controls

+ **These are the only 14 families in Rev 2.** Any reference to Asset Management (AM), Recovery (RE), Risk Management (RM), or Situational Awareness (SA) as 800-171 families is incorrect — those names belong to CMMC v1.0 or to other catalogs.

+ | # | ID | Family | Controls |

+ |---|---|---|---|

+ | 1 | AC | Access Control | 22 |

+ | 2 | AT | Awareness and Training | 3 |

+ | 3 | AU | Audit and Accountability | 9 |

+ | 4 | CM | Configuration Management | 9 |

+ | 5 | IA | Identification and Authentication | 11 |

+ | 6 | IR | Incident Response | 3 |

+ | 7 | MA | Maintenance | 6 |

+ | 8 | MP | Media Protection | 9 |

+ | 9 | PS | Personnel Security | 2 |

+ | 10 | PE | Physical Protection | 6 |

+ | 11 | **RA** | **Risk Assessment** | 3 |

+ | 12 | CA | Security Assessment | 4 |

+ | 13 | SC | System and Communications Protection | 16 |

+ | 14 | SI | System and Information Integrity | 7 |

+ | | | **TOTAL** | **110** |

+ **Numbering scheme:** `Chapter.Family.Requirement` (e.g., 3.1.1 = Chapter 3, AC family, Requirement 1). Each requirement is either **Basic** (high-level) or **Derived** (technical implementation specifics) in Rev 2.

+ ---

+ ## 4. 320 Assessment Objectives (NIST SP 800-171A Rev 2)

+ Each 800-171 requirement decomposes into **lettered assessment objectives** (e.g., 3.1.1[a]–[f]). All objectives within a practice must be satisfied for the practice to be **Met** in a C3PAO assessment.

+ | Family | Controls | Assessment Objectives |

+ |---|---|---|

+ | 3.1 Access Control | 22 | **70** |

+ | 3.2 Awareness & Training | 3 | 9 |

+ | 3.3 Audit & Accountability | 9 | 29 |

+ | 3.4 Configuration Management | 9 | **44** |

+ | 3.5 Identification & Authentication | 11 | 25 |

+ | 3.6 Incident Response | 3 | 14 |

+ | 3.7 Maintenance | 6 | 10 |

+ | 3.8 Media Protection | 9 | 15 |

+ | 3.9 Personnel Security | 2 | 4 |

+ | 3.10 Physical Protection | 6 | 16 |

+ | 3.11 Risk Assessment | 3 | 9 |

+ | 3.12 Security Assessment | 4 | 14 |

+ | 3.13 System & Comms Protection | 16 | **41** |

+ | 3.14 System & Info Integrity | 7 | 20 |

+ | **TOTAL** | **110** | **320** |

+ ### High-Complexity Controls (5+ Objectives)

+ These drive the bulk of assessment effort and evidence burden:

+ | Control | Objectives | Evidence focus |

+ |---|---|---|

+ | 3.4.7 | **15** | Port/protocol/service documentation (most objectives of any control) |

+ | 3.13.1 | 8 | Network boundary definition + monitoring/control/protection |

+ | 3.4.5 | 8 | Change control access restrictions (physical AND logical) |

+ | 3.12.4 | 8 | SSP completeness (boundary, environment, connections, update freq) |

+ | 3.6.1 | 7 | IRP covering all incident response phases |

+ | 3.6.2 | 6 | Incident reporting chain (internal + external) |

+ | 3.1.1 | 6 | User/device/process inventory + access restrictions |

+ | 3.1.20 | 6 | External system agreements + connection controls |

+ | 3.3.1 | 6 | Audit log configuration + retention policy |

+ | 3.3.8 | 6 | Log protection controls |

+ | 3.4.1 | 6 | Baseline config + asset inventory |

+ | 3.13.2 | 6 | Secure architecture documentation |

+ | 3.14.1 | 6 | Flaw ID/report/correct with defined timeframes |

+ | 3.1.3 | 5 | Data flow diagrams + flow enforcement |

+ | 3.1.22 | 5 | Public web content review process |

+ ---

+ ## 5. Assessment Methods — Examine / Interview / Test

+ Per **NIST SP 800-171A Rev 2**, assessors use exactly **three** methods (not four). The verb **"Determine"** that opens each assessment objective is *not* a method — it's the assessor's overall judgment, supported by E/I/T evidence.

+ | Method | What it is | Depth attributes |

+ |---|---|---|

+ | **Examine** | Reviewing, inspecting, observing, studying, or analyzing assessment objects (specifications, mechanisms, activities) | Basic / Focused / Comprehensive |

+ | **Interview** | Discussions with individuals or groups to facilitate understanding, achieve clarification, or obtain evidence | Basic / Focused / Comprehensive |

+ | **Test** | Exercising assessment objects under specified conditions to compare actual vs. expected behavior | Basic (black box) / Focused (gray box) / Comprehensive (white box) |

+ **Assessment objects** assessors examine or test:

+ - **Specifications** — policies, procedures, plans, SSP, designs, requirements.

+ - **Mechanisms** — hardware, software, firmware controls.

+ - **Activities** — operations, exercises, backup runs.

+ - **Individuals** — system owners, admins, security personnel, users.

+ **Practitioner rule of thumb:** For each AO, the OSC should be able to produce (1) the document/specification, (2) the technical artifact or screenshot showing the mechanism is configured, and (3) at least one person who can speak to operating the control.

+ ---

+ ## 6. CUI & FCI — Definitions, Marking, Boundary

+ ### FCI — Federal Contract Information

+ - Information **provided by or generated for** the Government under a contract.

+ - Not intended for public release.

+ - Not classified, not CUI.

+ - Triggers **CMMC Level 1** safeguarding (FAR 52.204-21).

+ - Examples: pricing, delivery schedules, contract-related correspondence.

+ ### CUI — Controlled Unclassified Information

+ - Information **requiring safeguarding or dissemination controls** per law, regulation, or government-wide policy.

+ - Governed by **32 CFR Part 2002** and the **CUI Registry** at `cui.archives.gov`.

+ - The CUI Registry contains the authoritative list of CUI categories (organized under ~20 organizational index groupings), each with its own marking and handling rules.

+ - Triggers **CMMC Level 2** (or L3 for sensitive programs).

+ - Practical rule: **If DFARS 252.204-7012 is in your contract, you have CUI. Full stop.**

+ **Two flavors:**

+ - **CUI Basic** — default safeguarding standard; 800-171 applies.

+ - **CUI Specified** — additional handling requirements per the CUI category (e.g., ITAR, EAR, Privacy, Critical Infrastructure).

+ **Confidentiality impact value:** No less than FIPS 199 **moderate**.

+ **Boundary scope rule (key to scoping):** 800-171 requirements apply only to components that **process, store, or transmit CUI**, or that **provide protection** for such components.

+ **Marking expectations:**

+ - Banner markings on the document.

+ - Category identification (e.g., `CUI//SP-PRVCY`).

+ - Dissemination controls if applicable.

+ ---

+ ## 7. CMMC Scoping Guide — Asset Categories

+ Per **32 CFR 170.19** and the CMMC L2 Scoping Guide, each asset falls into one of five categories. Proper categorization can dramatically reduce assessment burden and cost.

+ | Category | What it is | CMMC treatment |

+ |---|---|---|

+ | **CUI Assets** | Process, store, or transmit CUI | **All 110 controls apply** |

+ | **Security Protection Assets** | Provide security services to CUI Assets (firewalls, IDS/IPS, SIEM, VPN, MDM, patch mgmt, AD/LDAP) — may not touch CUI directly | Applicable security requirements apply |

+ | **Contractor Risk Managed Assets (CRMA)** | Can technically reach CUI Assets but aren't required to process CUI (jump hosts, admin workstations) | Contractor-developed risk-based approach, documented |

+ | **Specialized Assets** | OT/ICS, IoT, Government Furnished Equipment | Tailored — document applicability and any compensating controls in the SSP |

+ | **Out-of-Scope Assets** | Isolated; no connection path to CUI systems | **Not** subject to CMMC — but isolation must be **technically demonstrated**, not merely asserted |

+ ### Scope-Reduction Plays

+ 1. **CMMC enclave** — isolate CUI into a dedicated environment (separate network segment, separate AD tenant, separate cloud tenant). Only the enclave is in scope.

+ 2. **Remove CUI from systems** that don't need it; document the removal; those systems exit scope.

+ 3. **FedRAMP-authorized CSP** — offload controls to the CSP for the cloud portion.

+ 4. **Genuinely isolated systems** — air-gapped test networks with no path to CUI.

+ ### CUI Identification — Required Before Scoping

+ 1. Map every contract containing DFARS 252.204-7012 or 7021.

+ 2. Identify what data Government provides or contractor generates that qualifies as CUI.

+ 3. Trace CUI flow — email, file shares, cloud, mobile, backups, vendors.

+ 4. Document in SSP, including **data flow diagrams** (C3PAOs expect these).

+ ---

+ ## 8. ESP / CSP Rules

+ The most commonly misunderstood area of CMMC. ESPs and CSPs follow **different** rules.

+ ### Cloud Service Provider (CSP)

+ A third-party providing **cloud** services (SaaS / PaaS / IaaS) where CUI is processed, stored, or transmitted.

+ - **FedRAMP Moderate authorization required**, per DFARS 252.204-7012 and 252.239-7010.

+ - **Equivalency option** exists ("equivalent to FedRAMP Moderate" via a DoD-approved process) but is complex and rarely used.

+ - The OSA's on-premises infrastructure **connecting** to the CSP **is** in scope. The CSP environment itself is verified via FedRAMP, not as part of the CMMC assessment.

+ - The CSP must provide a **Customer Responsibility Matrix (CRM)** showing which controls are the CSP's vs. the customer's. The OSC's SSP documents customer-side implementation of shared controls.

+ **Common CSP options for CUI:**

+ | Platform | FedRAMP | Notes |

+ |---|---|---|

+ | Microsoft 365 GCC High | High | Suitable for most DoD CUI, including ITAR |

+ | Microsoft Azure Government | High | |

+ | AWS GovCloud | High | |

+ | Microsoft 365 GCC | Moderate | Limited CUI types; **not** suitable for ITAR/EAR |

+ | Google Workspace Enterprise | Moderate (some configurations) | Validate per use case |

+ **ITAR/EAR caution:** A CSP can be FedRAMP-authorized **and** technically eligible — but still ineligible to process specific CUI categories due to export-control restrictions on foreign-national access. Evaluate CUI category restrictions independently of FedRAMP authorization.

+ ### External Service Provider (ESP)

+ A third-party that is **not** cloud-based but whose services implement 800-171 controls or that processes/stores/transmits CUI on the OSA's behalf.

+ **Common ESPs:** MSSPs (SOC, SIEM), MSPs (patching, endpoint management), outsourced IT/AD admins, physical security monitoring vendors.

+ **Rules (32 CFR 170.19 / 170.16):**

+ 1. **ESP services are not exempt from assessment.** If an ESP implements CMMC controls for the OSA, those services are within the assessment scope.

+ 2. The ESP's role and services must be **documented in the OSC's SSP** along with a CRM.

+ 3. **ESP CMMC certification (optional, strongly recommended):** if the ESP holds a valid CMMC certification covering the services provided, those services may be accepted without separate re-assessment. If the ESP is **not** CMMC-certified, the C3PAO must assess them as part of the OSC's assessment — significantly expanding scope and cost.

+ **Decision tree:**

+ ```

+ Is the third-party service cloud-based?

+ ├── YES → CSP → FedRAMP Moderate (or higher) authorization required

+ └── NO → ESP → Include in scope OR get ESP CMMC-certified

+ ```

+ ---

+ ## 9. Subcontractor Flow-Down (32 CFR 170.23)

+ Per the regulation (unless DoD specifies otherwise), the **prime contractor** determines the CMMC level required for each subcontractor based on the data the sub will handle.

+ | Prime's requirement | Sub handling FCI only | Sub handling CUI |

+ |---|---|---|

+ | L2 (Self) | L1 minimum | L2 (Self) minimum |

+ | L2 (C3PAO) | L1 minimum | **L2 (C3PAO) minimum** |

+ | L3 (DIBCAC) | L1 minimum | L2 (C3PAO) minimum (unless DoD specifies higher) |

+ **Prime obligations:**

+ - Verify subcontractor CMMC compliance **at time of award**, not just at solicitation response.

+ - Verify via SPRS (sub's CMMC Status should be visible — access mechanics still maturing).

+ - Include DFARS 252.204-7021 flow-down clause in subcontracts.

+ **Practical advisory:** Primes should build supplier cybersecurity verification into procurement processes now. Waiting until Phase 2/4 to verify subs will create supply chain disruptions.

+

+ ---

+

+ ## 10. SPRS Scoring Mechanics

+

+ ### Score vs. Status — Two Different Things

+

+ | Concept | What it is | Where it lives |

+ |---|---|---|

+ | **SPRS Score** | Numerical (e.g., 98/110) from DoD Assessment Methodology self-assessment | SPRS (contractor-submitted) |

+ | **CMMC Status** | Categorical (Conditional L2 / Final L2 / etc.) from a CMMC assessment under 32 CFR 170 | SPRS (self) or eMASS (C3PAO) |

+

+ During Phase 1, a current SPRS score from a valid self-assessment **is** the CMMC L2 (Self) status.

+

+ ### DoD Assessment Methodology — Three Tiers

+

+ Under DFARS 252.204-7019/7020:

+

+ | Tier | Conducted by | Rigor | SPRS effect |

+ |---|---|---|---|

+ | Basic | Contractor self | Low (honor system) | Contractor submits score |

+ | Medium | DoD records/interview review | Medium | DoD adjusts score if gaps found |

+ | High | **DIBCAC** on-site | High | DIBCAC score supersedes contractor's |

+

+ ### Scoring Formula

+

+ ```

+ SPRS = 110 − Σ (deductions for not-implemented or partially-implemented controls)

+ ```

+

+ - **Starting score:** 110.

+ - **Point weights per practice:** **5 (High criticality), 3 (Medium), 1 (Low)** — set by the CMMC Scoring Methodology.

+ - **Deduction:** full point value if Not Met; partial credit at assessor discretion for partially implemented controls.

+ - **Conditional pass threshold:** **≥ 88** (i.e., ≥ 80% of 110).

+ - **Final status:** **110/110** with all practices Met (no open POA&Ms).

+ - Score can go negative (theoretical floor around −203).

+

+ ### High-Impact (5-Point) Practices

+

+ A single Not-Implemented finding on any of these costs 5 points and — for most of them — is **not** POA&M-eligible. Verify against the current CMMC Scoring Methodology before client-facing work.

+

+ - **AC.L2-3.1.1** — System access authorization

+ - **IA.L2-3.5.3** — Multifactor authentication

+ - **IA.L2-3.5.10** — Cryptographic password storage

+ - **IR.L2-3.6.1** — Incident response capability

+ - **IR.L2-3.6.2** — Incident tracking/reporting

+ - **MA.L2-3.7.5** — Remote maintenance MFA

+ - **RA.L2-3.11.2** — Vulnerability scanning

+ - **SC.L2-3.13.8** — CUI encryption in transit

+ - **SC.L2-3.13.10** — Cryptographic key management

+ - **SC.L2-3.13.11** — FIPS-validated cryptography *(special POA&M exception — see §11)*

+ - **SC.L2-3.13.16** — CUI encryption at rest

+ - **SI.L2-3.14.1** — Flaw remediation

+ - **SI.L2-3.14.2** — Malicious code protection

+ - **SI.L2-3.14.6** — System monitoring for attacks

+ - **CA.L2-3.12.4** — System Security Plan

+

+ ---

+

+ ## 11. POA&M Rules — Critical Section

+

+ A Plan of Action & Milestones is a time-bound documented plan to remediate identified deficiencies. Under CMMC, POA&Ms are **not** a general remediation tool — they are tightly restricted.

+

+ ### The Three Golden Rules

+

+ **Rule 1 — Level 1 = NO POA&Ms ever.** Per 32 CFR 170.21(a)(1). All 15 FAR 52.204-21 practices must be fully implemented at time of self-assessment submission. No exceptions.

+

+ **Rule 2 — Level 2 POA&Ms require a passing score of ≥ 80%.** Per 32 CFR 170.21(a)(2)(i). Assessment score ÷ 110 must be ≥ 0.8 → **≥ 88 of 110 practices must be MET** before any POA&M is allowed.

+

+ **Rule 3 — Only 1-point practices on POA&M, with one exception.** Per 32 CFR 170.21(a)(2)(ii). No practice on a POA&M may have a point value greater than 1. The single exception: **SC.L2-3.13.11 (FIPS-validated cryptography)** may be on a POA&M at its **3-point** value **only if encryption is in use but not yet FIPS-validated**. If encryption is not employed at all, 3.13.11 carries its full 5-point weight and is not POA&M-eligible.

+

+ ### The FIPS Exception — Three Scenarios

+

+ | Scenario | Encryption posture | Deduction | POA&M eligible? |

+ |---|---|---|---|

+ | A | None | 5 pts | **No** — assessment fails |

+ | B | In use, not FIPS-validated | 3 pts | **Yes** |

+ | C | FIPS-validated in use | 0 pts | n/a — fully Met |

+

+ **Practitioner play:** Before assessment, get clients to implement encryption (even if not yet FIPS-validated) — converts a disqualifying 5-point hit into a POA&M-eligible 3-point hit.

+

+ ### Controls That CANNOT Be on a POA&M

+

+ Per 32 CFR 170.21(a)(2)(iii), the following are explicitly ineligible regardless of point value:

+

+ - **AC.L2-3.1.1** — Account management

+ - **AC.L2-3.1.2** — Access enforcement

+ - **AC.L2-3.1.20** — External system connections

+ - **AC.L2-3.1.22** — CUI on publicly accessible systems

+ - All 5-point practices (effectively, by Rule 3)

+ - Verify the full list against current 32 CFR 170.21 before client deliverables.

+

+ ### Valid POA&M Entry — Required Fields

+

+ 1. **Description** of the deficiency (specific practice + why not met).

+ 2. **Responsible party** (named individual, not "IT department").

+ 3. **Resource requirements** (budget, personnel, tooling).

+ 4. **Specific milestone dates** (not "TBD" or "within 6 months").

+ 5. **Estimated completion date** within the **180-day** conditional window.

+ 6. **Current status**, updated as remediation progresses.

+

+ ### Closeout Process

+

+ 1. Remediate within **180 days**.

+ 2. Conduct closeout assessment (self or C3PAO — matching original assessment type).

+ 3. Post updated results: SPRS for Self, eMASS for C3PAO.

+ 4. Status upgrades **Conditional → Final**.

+

+ ### If POA&M Not Closed in 180 Days

+

+ - Conditional CMMC Status **expires**.

+ - Contractor is immediately ineligible for new awards requiring that level.

+ - Mid-performance contracts: standard contractual remedies apply.

+ - New assessment from scratch required to regain status.

+ - **No extension** — the 180 days is firm per regulation.

+

+ ### Operational POA&M vs. CMMC POA&M

+

+ Operational POA&Ms (continuous improvement tracking under normal NIST practice) are separate from CMMC assessment POA&Ms (formal regulatory constructs with 180-day clocks). Don't conflate them.

+

+ ---

+

+ ## 12. Findings Language

+

+ At the **assessment objective** level, each AO produces one of:

+

+ - **Satisfied** — the objective is met based on evidence collected.

+ - **Other Than Satisfied (OTS)** — the objective is not met.

+

+ At the **practice** level, the rollup is:

+

+ - **MET** — *all* AOs within the practice are Satisfied.

+ - **NOT MET** — one or more AOs are Other Than Satisfied (and the practice is not eligible for partial credit).

+ - **PARTIAL** — some AOs Satisfied, others not, where partial credit applies under the Scoring Methodology.

+ - **NOT APPLICABLE** — control does not apply to the assessed scope (must be justified and documented in the SSP).

+

+ Findings language convention in deliverables:

+

+ - State the AO citation (e.g., `3.1.1[a]`).

+ - State the method that produced the finding (Examine / Interview / Test).

+ - State the artifact or response that demonstrates the gap.

+ - Map to the SPRS point impact (1 / 3 / 5).

+ - Identify POA&M eligibility status.

+

+ ---

+

+ ## 13. C3PAO Assessment Lifecycle

+

+ ### Pre-Assessment

+

+ 1. **OSC selects C3PAO** from the Cyber AB marketplace.

+ 2. **Scope determination** under 32 CFR 170.19 — asset categorization, CUI boundary.

+ 3. **Documentation review** — C3PAO reviews SSP, policies, procedures before going on-site.

+ 4. **Readiness/gap assessment** (optional but strongly recommended). **A C3PAO cannot both consult and certify** the same OSC — readiness reviews must come from a different C3PAO or independent consultant.

+ 5. **Artifact preparation** — evidence packages mapped to 800-171A objectives.

+

+ ### Assessment

+

+ 1. **Initiation** — CMMC UID assigned (10-character identifier).

+ 2. **Team composition** — minimum **3 CCAs** on the assessment team.

+ 3. **Assessment activities** — Examine / Interview / Test against every applicable AO.

+ 4. **Scoring** — each practice MET or NOT MET per its AOs.

+ 5. **POA&M determination** — which gaps qualify for POA&M.

+

+ ### Post-Assessment

+

+ 1. C3PAO posts results to **CMMC-eMASS**; CMMC Status (Conditional or Final) appears in SPRS.

+ 2. **Certificate of CMMC Status** issued.

+ 3. **Evidence retention:** artifacts hashed (NIST-approved algorithm) and retained for **6 years** from CMMC Status Date.

+ 4. C3PAO uploads artifact names, hash values, and algorithm identifiers to eMASS.

+

+ ### C3PAO Rules (32 CFR 170.10 / 170.11)

+

+ - Accredited by the Cyber AB.

+ - CCAs must hold a Tier 3 background investigation (national security eligibility, not a clearance).

+ - Must use only their own accredited IT for assessments.

+ - **Prohibited** from providing consulting/implementation services to OSCs they certify.

+ - Assessment information is strictly confidential.

+

+ ### L2 (Self) — Non-C3PAO Process

+

+ 1. Self-assess against 800-171A objectives.

+ 2. Apply 32 CFR 170.19 scoping.

+ 3. Score per 32 CFR 170.24.

+ 4. Upload to SPRS.

+ 5. Senior official affirms per 32 CFR 170.22.

+ 6. CMMC Status posted in SPRS.

+

+ ---

+

+ ## 14. Annual Affirmation & False Claims Act Risk

+

+ ### Annual Affirmation (32 CFR 170.22)

+

+ After initial CMMC Status, a **senior company official** must affirm in SPRS/eMASS each year that:

+

+ - The organization continues to implement all required practices.

+ - No material changes have occurred that affect CMMC compliance.

+ - All information-system changes are reflected in the SSP.

+

+ Frequency: within one year of initial CMMC Status Date, then annually for the 3-year cycle. Material changes may trigger re-assessment.

+

+ ### False Claims Act Exposure

+

+ CMMC creates real FCA exposure — context every client conversation should include:

+

+ - **FCA liability:** Up to **3× government damages** + per-claim penalties for knowingly false certifications.

+ - **DOJ Cyber-Fraud Initiative** has been pursuing cybersecurity false certifications since 2019.

+ - **Recent precedent:** Multiple multi-million-dollar settlements against defense contractors that falsely certified cybersecurity compliance.

+ - **Personal liability:** The signing senior official is personally certifying.

+

+ **What creates exposure:**

+

+ 1. Submitting an inflated SPRS score.

+ 2. Knowingly false annual affirmation.

+ 3. Certifying a bid as CMMC-compliant when the OSC knows it isn't.

+ 4. Prime contractor knowingly ignoring sub's false claims.

+

+ **Safe-harbor posture:** an honest, low SPRS score plus a credible POA&M is defensible. An inflated score is not. **Accurate reporting + credible remediation = manageable risk; inflated reporting = potential criminal exposure.**

+

+ ---

+

+ ## 15. Rev 2 → Rev 3 Crosswalk + ODPs

+

+ CMMC is **currently** based on **800-171 Rev 2** only. Rev 3 (May 2024) is the forward horizon — not operative for CMMC until DoD adopts it (no announced date).

+

+ ### Structural Changes

+

+ | Metric | Rev 2 | Rev 3 |

+ |---|---|---|

+ | Control families | 14 | **17** (adds PL, SA, SR) |

+ | Total requirements | 110 | ~97 (net — many consolidations) |

+ | Numbering | `3.X.Y` | `03.X.Y` (leading zeros) |

+ | Basic/Derived distinction | Yes | Eliminated |

+ | ODPs | None | **Introduced** |

+ | Family renames | — | CA → "Security Assessment and Monitoring" |

+

+ ### Key Consolidations

+

+ - 3.1.12 + 3.1.14 + 3.1.15 → 03.01.12 (Remote Access)

+ - 3.1.16 + 3.1.17 → 03.01.16 (Wireless)

+ - 3.1.18 + 3.1.19 → 03.01.18 (Mobile Devices)

+ - 3.1.20 + 3.1.21 → 03.01.20 (External Systems)

+ - 3.2.1 + 3.2.3 → 03.02.01 (Literacy Training)

+ - 3.5.4 + 3.5.6 + 3.5.8 + 3.5.9 + 3.5.10 + 3.5.11 → 03.05.03 / 03.05.07 (MFA, Password Mgmt)

+ - 3.1.13 + 3.8.6 + 3.13.8 → 03.13.08 (Cryptographic Protection)

+ - 3.12.4 (SSP) → 03.15.02 (relocated to new PL family)

+

+ ### ODPs — Organization-Defined Parameters

+

+ Introduced in Rev 3. Select requirements contain `[Assignment: organization-defined X]` values that must be defined by either the contracting federal agency or the contractor. Once defined, they become **assessable scope**.

+

+ ODP categories:

+

+ - **Time periods** — inactivity timeouts, audit failure response windows, scan frequency.

+ - **Roles/personnel** — who is authorized for privileged accounts, who responds to logon-attempt thresholds.

+ - **Technical parameters** — number of invalid logon attempts allowed, configuration settings, types of cryptography.

+ - **Security requirements** — requirements imposed on external systems, prohibited services/ports/protocols.

+

+ ODP planning for clients pre-adoption:

+

+ 1. Stand up an ODP register (separate doc or SSP appendix).

+ 2. Have management approve each value.

+ 3. Implement controls using those defined values.

+ 4. Be ready to be assessed against your own stated values — they become binding.

+

+ ### Why You Can't "Just Use Rev 3"

+

+ Some clients have implemented Rev 3-style controls and believe they're covered. Rev 2 has specific requirements that Rev 3 softened with ODPs — for current CMMC assessments, the **Rev 2** language governs:

+

+ - **3.3.7 (clock sync)** — Rev 2 requires NTP sync with an authoritative source; Rev 3 softened.

+ - **3.4.8 (allow/deny software)** — Rev 2 requires an explicit policy choice and implementation.

+ - **3.5.3 (MFA)** — Rev 2 requires MFA for *network access to non-privileged accounts*; no ODP wiggle room.

+ - **3.13.11 (FIPS crypto)** — Rev 2 says "FIPS-validated", flat. Rev 3 uses ODP. For CMMC, FIPS validation is mandatory.

+

+ ---

+

+ ## 16. Common L2 Implementation Gaps (with AO citations)

+

+ Replaces the loose gap list with practitioner-confirmed patterns mapped to specific assessment objectives.

+

+ | Gap | Practices / AOs | Why it fails |

+ |---|---|---|

+ | **MFA partial** — admins only, not all network users | IA.L2-3.5.3 (all AOs); related 3.1.12 | Rev 2 requires MFA for network access to non-privileged accounts; "admins only" does not satisfy |

+ | **SMS or push-only MFA** | IA.L2-3.5.3 | Phishing-resistant MFA expected; SMS increasingly called out |

+ | **Account review records missing** | AC.L2-3.1.1[d–f]; 3.1.5[a–d] | Policy exists but no documented periodic review evidence |

+ | **Asset inventory incomplete / no network diagram** | CM.L2-3.4.1[a–f]; CA.L2-3.12.4 | Baseline configuration cannot be asserted without inventory |

+ | **Audit log retention without review** | AU.L2-3.3.1[e–f]; 3.3.5 | Logs generated but never analyzed — fails Examine + Interview |

+ | **IR plan untested or no 72-hour reporting process** | IR.L2-3.6.1[a–g]; 3.6.3; DFARS 7012 | Plan exists but exercises absent; DIBNet reporting workflow undocumented |

+ | **No baseline configurations / informal change control** | CM.L2-3.4.1; 3.4.3; 3.4.5[a–h] | Required artifacts (baselines, change records) cannot be produced |

+ | **Allow/deny software policy missing** | CM.L2-3.4.8 | Policy-only without enforcement evidence; technical control required |

+ | **FIPS-validated crypto unconfirmed** | SC.L2-3.13.11; 3.13.8; 3.13.16 | Encryption in use but not via CMVP-validated module — 3-pt POA&M if encryption present, 5-pt fail if not |

+ | **No documented deny-by-default boundary rule** | SC.L2-3.13.6 | Implicit allow rules undermine flow control |

+ | **CUI at rest not encrypted** | SC.L2-3.13.16 | Common on endpoints; full-disk encryption alone may not satisfy if CUI is in cloud sync folders |

+ | **SSP not current** | CA.L2-3.12.4[a–h] | SSP exists but stale; assessor wants current state |

+ | **Patch SLAs without evidence** | SI.L2-3.14.1; RA.L2-3.11.3 | Policy says "30 days" but no records demonstrate it |

+ | **AV not auto-updating** | SI.L2-3.14.4; 3.14.5 | Signatures stale; tool report shows last update |

+ | **Vulnerability scanning gap** | RA.L2-3.11.2; 3.11.3 | Authenticated scans not configured; remediation cadence undocumented |

+ | **External system connections unmanaged** | AC.L2-3.1.20; 3.1.21 | No agreements with external systems; portable storage uncontrolled |

+ | **Public-facing system content control** | AC.L2-3.1.22 | No review process for what posts publicly |

+

+ ### Controls Where "Policy Only" Always Fails

+

+ These require technical implementation evidence, not just a policy document:

+

+ - 3.1.8 (logon attempt limits)

+ - 3.1.10 (screen lock)

+ - 3.4.8 (allow/deny software policy)

+ - 3.5.3 (MFA)

+ - 3.13.8 (CUI in transit)

+ - 3.13.11 (FIPS-validated cryptography)

+ - 3.13.16 (CUI at rest)

+ - 3.14.2 (malicious code protection)

+

+ ---

+

+ ## 17. Authoritative Sources

+

+ ### Primary

+

+ - **NIST SP 800-171 Rev 2** — https://doi.org/10.6028/NIST.SP.800-171r2

+ - **NIST SP 800-171A Rev 2** — assessment procedures (320 objectives)

+ - **NIST SP 800-172** — Enhanced Security Requirements (L3 source)

+ - **32 CFR Part 170** — CMMC program rule (89 FR 83214, Oct. 15, 2024; effective Dec. 16, 2024)

+ - **48 CFR Part 204.75 (DFARS)** — CMMC acquisition rule (effective Nov. 10, 2025)

+ - **DFARS 252.204-7012 / -7019 / -7020 / -7021 / -7025**

+ - **FAR 52.204-21** — Basic Safeguarding (CMMC L1 source)

+ - **32 CFR Part 2002** — CUI program rule

+ - **CUI Registry** — `cui.archives.gov`

+

+ ### CMMC Program Documents

+

+ - **CMMC Model v2.0**

+ - **CMMC Assessment Guide — Level 1**

+ - **CMMC Assessment Guide — Level 2**

+ - **CMMC Assessment Guide — Level 3**

+ - **CMMC Scoping Guide — Level 1**

+ - **CMMC Scoping Guide — Level 2**

+ - **CMMC Scoring Methodology**

+ - **DoD Assessment Methodology** (basis for SPRS scoring)

+

+ Authoritative locations: `dodcio.defense.gov/CMMC/`, `cyber.mil`, `cyberab.org`, `sprs.csd.disa.mil`, `dibnet.dod.mil` (incident reporting).

+

+ ---

+

+ This skill supports:

+

+ - CMMC level selection and CUI boundary scoping

+ - Per-control (and per-AO) implementation guidance for all 110 800-171 Rev 2 practices

+ - SSP development, review, and gap mapping

+ - Assessment objective-level evidence planning

+ - C3PAO assessment readiness preparation

+ - POA&M development with eligibility validation against 32 CFR 170.21

+ - SPRS score calculation against the CMMC Scoring Methodology

+ - ESP/CSP scoping decisions and FedRAMP equivalency analysis

+ - Subcontractor flow-down planning

+ - Annual affirmation workflow and FCA-risk advisory

+ - Rev 2 → Rev 3 crosswalk and ODP planning

+ - DFARS clause interpretation across 7012, 7019, 7020, 7021, 7025