ISACA CMMC Certified Professional

Many organizations take part in the program, and mixing up their roles causes mistakes. You learn the government bodies, the accreditation body, assessment organizations, training providers, practitioners and the contractors being assessed.

• The government program office and the assessment center
• The accreditation body and its role
• Third-party assessment organizations
• Assessors, practitioners and instructors
• Training providers and consultants
• Contractors seeking certification and their service providers

You build A relationship diagram of every role in a CMMC assessment, with who pays, who decides and who reviews.

Trust in the program depends on the people in it. You work through integrity, objectivity, confidentiality and conflicts of interest, and decide what to do when advice, assessment and sales begin to overlap.

• Integrity and objectivity
• Confidentiality and handling of sensitive information
• Conflicts of interest and how to disclose them
• Separating consulting from assessment
• Professional behavior and misuse of credentials
• Reporting breaches of the code

You build Written decisions on eight ethics scenarios, each citing the conduct principle that applies.

Every judgment in CMMC traces to a document. You learn the program rule, the contract clauses, the NIST publications and the official guides, and how to find which one answers a question.

• The program regulation and its structure
• Contract clauses for basic safeguarding and CUI
• NIST SP 800-171 and 800-171A
• NIST SP 800-172 for the highest level
• Official assessment and scoping guides
• The CUI registry and CUI program rule
• Keeping up with changes in guidance

You build A source map that routes ten typical questions to the document that answers them.

You cannot scope or assess without knowing what the information is. You learn to tell federal contract information from CUI, recognize markings and categories, and trace where each lives in a contractor’s systems and processes.

• Definitions of FCI and CUI
• CUI categories and the registry
• Markings and handling rules
• How CUI reaches a contractor and flows on
• Finding CUI in files, email and systems
• Flow-down to subcontractors

You build A data flow sketch tracing one contract’s CUI from receipt to storage, use and return.

The model’s structure decides how an assessment is organized. You learn the levels, the domains, the difference between practices and objectives, and how self-assessment, affirmation and third-party assessment fit the levels.

• The three levels and their purposes
• The domains and how practices are grouped
• Practices, objectives and determination statements
• Self-assessment and annual affirmation
• Third-party and government-led assessment
• Plans of action and the limits on them

You build A reference chart of the levels, domains and assessment types for one contractor’s situation.

Level 1 is the foundation and the first thing most contractors face. You work through its practices across the domains it covers, what each means in a small office, and the evidence that shows a practice is in place.

• Access control practices at Level 1
• Identification and authentication practices
• Media protection and physical protection
• System and communications protection
• System and information integrity
• Evidence for each Level 1 practice

You build A Level 1 practice worksheet for a small business, listing each practice, how it is met and the evidence.

Level 2 extends protection to CUI through the requirements of NIST SP 800-171. You examine the families that govern who gets in, how people are trained, what is logged and how systems are configured.

• Access control requirements
• Awareness and training requirements
• Audit and accountability requirements
• Configuration management requirements
• Identification and authentication requirements
• What an implementation looks like in practice

You build A practice-by-practice notebook for five families, with an implementation example and evidence list for each.

These families cover handling incidents, maintaining systems, protecting media and managing the people who touch CUI. You learn what each requires and the documents, records and interviews that show it.

• Incident response requirements
• Maintenance requirements
• Media protection requirements
• Personnel security requirements
• Physical protection requirements
• Typical weaknesses seen in each family

You build A notebook for these families with implementation examples, evidence lists and common gaps.

The remaining families are about knowing and watching the environment. You cover risk assessment, security assessment, protection of communications and system and information integrity.

• Risk assessment requirements
• Security assessment requirements and system security plans
• System and communications protection requirements
• System and information integrity requirements
• Encryption requirements and validated cryptography
• Typical weaknesses seen in each family

You build A notebook for the remaining families with implementation examples, evidence lists and common gaps.

Scope decides what is assessed, and mistakes there cause failed assessments. You learn the asset categories, how CUI, security protection assets and external providers define the boundary, and how to document it.

• Asset categories in the scoping guide
• CUI assets and security protection assets
• Contractor risk managed and specialized assets
• Out-of-scope assets and the reasons for them
• External service providers and cloud services
• Network and data flow diagrams for scope

You build A scoping package for a sample company: asset table, boundary diagram and written justification.

Evaluation is a disciplined test of evidence, not an impression. You learn the three assessment methods, judge whether evidence is sufficient, and decide when a practice is met, not met or not applicable.

• Assessment objectives and determination statements
• Examine, interview and test methods
• Sufficiency, reliability and consistency of evidence
• System security plans and policies as evidence
• Met, not met and not applicable
• Recording determinations and rationale

You build An evidence review of ten practices for a sample company, with a determination and rationale for each.

The assessment process is a defined sequence with roles and records. You follow it from planning through evidence collection, interviews, findings, reporting and close-out, and see where a CCP supports the team.

• Planning and preparation
• Conducting the assessment
• Reporting results
• Close-out and follow-up
• Roles on the assessment team
• Records and quality checks

You build A timeline of a full assessment, naming each activity, owner, input and output.

One scenario joins every area. You scope a sample organization, evaluate its Level 1 practices and a sample of Level 2 practices, record evidence and prepare materials a lead assessor could rely on.

• Understanding the organization and its contracts
• Scoping its assets and boundary
• Collecting and evaluating evidence
• Recording findings with conduct in mind
• Handing results to the assessment lead

You build An assessment support package: scope, evidence log and findings for a sample organization.