ISACA CMMC Certified Assessor

Each requirement can be read more than one way. You study the NIST requirements, the assessment objectives and the official guides together, and learn how the program expects each practice to be interpreted.

• Requirements and assessment objectives together
• The official assessment guide for each practice
• Interpreting a requirement consistently
• Differences between the requirement and a good idea
• Inheritance and shared responsibility
• Resolving doubt with the program authorities

You build An interpretation notebook with the reading, objectives and evidence expected for twenty practices.

The assessment begins before any control is tested. You review the organization’s system security plan, policies, structure and providers to judge whether it is ready and whether its picture of itself is accurate.

• Reviewing a system security plan critically
• Policies and procedures as claims to be tested
• Organizational structure and responsibilities
• External service providers and inherited controls
• Cloud services and equivalency questions
• Readiness signals and warning signs

You build A readiness review of a sample organization’s security plan, with questions and risks noted.

Scope errors undo whole assessments. You trace CUI through systems and people, classify every asset in scope, handle enclaves, cloud and shared services, and settle disagreements about the boundary.

• Tracing CUI through systems and processes
• Classifying assets under the scoping guide
• Security protection assets and specialized assets
• Enclaves and segmentation claims
• Cloud, managed services and shared environments
• Resolving boundary disagreements and documenting the result

You build A scoping decision record for a complex sample environment, with asset table, boundary and reasoning.

A well-planned assessment finishes on time and withstands review. You build the plan, schedule interviews and demonstrations, prepare evidence requests and brief the team and the client.

• Assessment plan and logistics
• Evidence request lists
• Scheduling interviews and demonstrations
• Team assignments and workloads
• The kickoff meeting
• Handling information securely during the assessment

You build An assessment plan with schedule, evidence requests and interview list for a sample organization.

A verdict is only as good as its evidence. You use examination, interview and test methods, judge whether artifacts are adequate and authentic, observe systems directly and record evidence so others can verify it.

• Examine, interview and test as methods
• Judging authenticity and currency of artifacts
• Interview technique with administrators and executives
• Observing configurations and demonstrations
• Corroborating evidence across sources
• Evidence records and retention

You build An evidence file for ten practices showing method, artifact, interview notes and sufficiency judgment.

These practices turn on who can do what. You test how accounts are created, reviewed and removed, how people authenticate and are trained and screened, and how remote and privileged access is controlled.

• Account management and access enforcement
• Privileged access and separation of duties
• Authentication and multi-factor requirements
• Remote access and wireless controls
• Awareness, training and personnel screening
• Typical failures and how to find them

You build A test plan and sample determinations for the access, identity, awareness and personnel practices.

These practices are technical and evidence-heavy. You test logging and review, configuration baselines and change control, malware and monitoring, network boundaries and cryptographic protection.

• Audit logging and review
• Baselines, change control and least functionality
• Flaw remediation and malicious code protection
• Boundary protection and segmentation
• Encryption of CUI in transit and at rest
• Session and key management controls

You build A test plan and sample determinations for the audit, configuration, integrity and communications practices.

The remaining practices cover operations and governance. You test incident handling and exercises, risk assessments and scans, maintenance and media handling, and physical protection of areas where CUI lives.

• Incident handling capability and testing
• Risk assessments and vulnerability scanning
• Security assessment and plans of action
• Maintenance controls and remote maintenance
• Media marking, storage and sanitization
• Physical access and visitor controls

You build A test plan and sample determinations for the remaining Level 2 practice families.

Each practice ends in a decision that must be consistent and defensible. You apply the objectives to evidence, decide met, not met or not applicable, handle partial implementation and write the rationale.

• Applying every objective to the evidence
• Met, not met and not applicable
• Partial implementation and compensating measures
• Scoring rules and what they mean
• Consistency across assessors
• Writing a determination rationale

You build Determinations with rationale for fifteen practices, including three borderline cases.

Not every gap ends the assessment, but limits apply. You document weaknesses, understand what a plan of action may and may not cover, manage conditional outcomes and verify closure.

• Documenting a weakness clearly
• What a plan of action can and cannot include
• Conditional outcomes and deadlines
• Close-out assessments
• Disputes and how they are handled
• Quality review of findings

You build A findings register and a plan of action review for a sample assessment, with close-out criteria.

The report is the lasting record. You write results to the program’s requirements, handle submission and records, protect evidence and sensitive information after the assessment, and explain results to the client.

• Report content and structure
• Submitting results and certification steps
• Record keeping and retention
• Protecting evidence after the assessment
• Presenting results to the client
• Responding to review and queries

You build A completed assessment report with executive summary, determinations and findings.

One simulated assessment uses every skill. You scope the environment, plan the work, gather and judge evidence across the practices, record findings and issue a report you can defend.

• Scoping and planning the assessment
• Collecting evidence across the practices
• Making and recording determinations
• Handling findings and a plan of action
• Reporting and defending the result

You build A full simulated Level 2 assessment file: scope, plan, evidence, determinations and report.