cmmc-expert

name	cmmc-expert
description	CMMC v2.0 expert for DoD contractors. Covers NIST 800-171 Rev 2 (14 families, 110 controls), SPRS scoring, POA&M rules, 32 CFR Part 170, DFARS clauses, scoping, ESP/CSP, C3PAO assessment lifecycle, and Rev 2 → Rev 3 transition.
allowed-tools	Read, Glob, Grep, Write

CMMC Expert

Deep, practitioner-grade expertise in the Cybersecurity Maturity Model Certification (CMMC) v2.0 for Department of Defense contractors. Built from the authoritative chain: NIST SP 800-171 Rev 2 (control text), NIST SP 800-171A Rev 2 (320 assessment objectives), 32 CFR Part 170 (CMMC program rule), and 48 CFR / DFARS Part 204.75 (acquisition rule).

1. Program Overview & Authority

Purpose: Standardize verification of NIST SP 800-171 cybersecurity controls across the Defense Industrial Base (DIB) protecting Controlled Unclassified Information (CUI) and Federal Contract Information (FCI).

Authority chain:

• 32 CFR Part 170 — CMMC program rule. Effective December 16, 2024.
• 48 CFR / DFARS Part 204.75 — Acquisition rule that puts CMMC into contracts. Effective November 10, 2025.
• DFARS 252.204-7012 — Pre-existing CUI safeguarding + 72-hour cyber incident reporting clause.
• DFARS 252.204-7019 — Solicitation provision requiring a current NIST 800-171 self-assessment score in SPRS.
• DFARS 252.204-7020 — Contract clause giving DoD/DIBCAC the right to verify SPRS assessments.
• DFARS 252.204-7021 — The primary CMMC certification requirement clause.
• DFARS 252.204-7025 — Solicitation provision identifying the required CMMC level for a given procurement.

Authoritative sources to cite in deliverables:

• NIST SP 800-171 Rev 2 — https://doi.org/10.6028/NIST.SP.800-171r2 (Final, including updates as of 01-28-2021; withdrawn May 14, 2024 but remains operative for CMMC).
• NIST SP 800-171A Rev 2 — assessment procedures, 320 objectives.
• CMMC Assessment Guide L2 (current version on dodcio.defense.gov).
• CMMC Scoping Guide L2.
• CMMC Scoring Methodology.
• 32 CFR Part 170 (89 FR 83214, Oct. 15, 2024).

Four-Phase Implementation Timeline

All dates keyed to November 10, 2025 (DFARS rule effective date).

Phase	Window	What's in contracts
Phase 1	2025-11-10 → 2026-11-09	L1 (Self), L2 (Self); L2 (C3PAO) at DoD discretion
Phase 2	2026-11-10 → 2027-11-09	+ L2 (C3PAO) as routine contractual requirement
Phase 3	2027-11-10 → 2028-11-09	+ L3 (DIBCAC) for high-sensitivity programs
Phase 4	2028-11-10 and beyond	All applicable solicitations require appropriate CMMC level

Triennial re-assessment + annual affirmation throughout the certification cycle.

---

2. CMMC Levels (L1 / L2 / L3)

Level	Name	Practices	Source	Assessment	POA&M Allowed	Cycle
Level 1	Foundational	15	FAR 52.204-21	Self only	No — never	Annual self + annual affirmation
Level 2	Advanced	110	NIST SP 800-171 Rev 2	Self or C3PAO	Yes — restricted (see §11)	Triennial + annual affirmation
Level 3	Expert	134 (110 + 24 selected from 800-172)	NIST SP 800-171 Rev 2 + 800-172	DCMA DIBCAC	Per DIBCAC methodology	Triennial + annual affirmation

Acronyms used here (correctly):

• OSA — Organization Seeking Assessment.
• OSC — Organization Seeking Certification (used specifically in C3PAO context; OSA/OSC are largely interchangeable in practice).
• C3PAO — Certified Third-Party Assessor Organization. Accredited by the Cyber AB.
• CCA — Certified CMMC Assessor (must hold Tier 3 background investigation).
• CCP — Certified CMMC Professional (support role).
• DIBCAC — Defense Industrial Base Cybersecurity Assessment Center (DCMA's assessment arm; conducts L3 assessments and high-water-mark L2 verifications).
• DC3 — DoD Cyber Crime Center (recipient of malware samples under DFARS 7012).
• eMASS — Enterprise Mission Assurance Support Service (DoD system where C3PAO assessment results are posted).
• SPRS — Supplier Performance Risk System (where self-assessment scores and CMMC Status live).

Who needs what:

• Handles FCI only → L1.
• Handles CUI → L2 (Self) or L2 (C3PAO) per the contract.
• Sensitive national-security CUI → L3.

---

3. NIST 800-171 Rev 2 — 14 Families, 110 Controls

These are the only 14 families in Rev 2. Any reference to Asset Management (AM), Recovery (RE), Risk Management (RM), or Situational Awareness (SA) as 800-171 families is incorrect — those names belong to CMMC v1.0 or to other catalogs.

#	ID	Family	Controls
1	AC	Access Control	22
2	AT	Awareness and Training	3
3	AU	Audit and Accountability	9
4	CM	Configuration Management	9
5	IA	Identification and Authentication	11
6	IR	Incident Response	3
7	MA	Maintenance	6
8	MP	Media Protection	9
9	PS	Personnel Security	2
10	PE	Physical Protection	6
11	RA	Risk Assessment	3
12	CA	Security Assessment	4
13	SC	System and Communications Protection	16
14	SI	System and Information Integrity	7
		TOTAL	110

Numbering scheme: Chapter.Family.Requirement (e.g., 3.1.1 = Chapter 3, AC family, Requirement 1). Each requirement is either Basic (high-level) or Derived (technical implementation specifics) in Rev 2.

---

4. 320 Assessment Objectives (NIST SP 800-171A Rev 2)

Each 800-171 requirement decomposes into lettered assessment objectives (e.g., 3.1.1[a]–[f]). All objectives within a practice must be satisfied for the practice to be Met in a C3PAO assessment.

Family	Controls	Assessment Objectives
3.1 Access Control	22	70
3.2 Awareness & Training	3	9
3.3 Audit & Accountability	9	29
3.4 Configuration Management	9	44
3.5 Identification & Authentication	11	25
3.6 Incident Response	3	14
3.7 Maintenance	6	10
3.8 Media Protection	9	15
3.9 Personnel Security	2	4
3.10 Physical Protection	6	16
3.11 Risk Assessment	3	9
3.12 Security Assessment	4	14
3.13 System & Comms Protection	16	41
3.14 System & Info Integrity	7	20
TOTAL	110	320

High-Complexity Controls (5+ Objectives)

These drive the bulk of assessment effort and evidence burden:

Control	Objectives	Evidence focus
3.4.7	15	Port/protocol/service documentation (most objectives of any control)
3.13.1	8	Network boundary definition + monitoring/control/protection
3.4.5	8	Change control access restrictions (physical AND logical)
3.12.4	8	SSP completeness (boundary, environment, connections, update freq)
3.6.1	7	IRP covering all incident response phases
3.6.2	6	Incident reporting chain (internal + external)
3.1.1	6	User/device/process inventory + access restrictions
3.1.20	6	External system agreements + connection controls
3.3.1	6	Audit log configuration + retention policy
3.3.8	6	Log protection controls
3.4.1	6	Baseline config + asset inventory
3.13.2	6	Secure architecture documentation
3.14.1	6	Flaw ID/report/correct with defined timeframes
3.1.3	5	Data flow diagrams + flow enforcement
3.1.22	5	Public web content review process

---

5. Assessment Methods — Examine / Interview / Test

Per NIST SP 800-171A Rev 2, assessors use exactly three methods (not four). The verb "Determine" that opens each assessment objective is not a method — it's the assessor's overall judgment, supported by E/I/T evidence.

Method	What it is	Depth attributes
Examine	Reviewing, inspecting, observing, studying, or analyzing assessment objects (specifications, mechanisms, activities)	Basic / Focused / Comprehensive
Interview	Discussions with individuals or groups to facilitate understanding, achieve clarification, or obtain evidence	Basic / Focused / Comprehensive
Test	Exercising assessment objects under specified conditions to compare actual vs. expected behavior	Basic (black box) / Focused (gray box) / Comprehensive (white box)

Assessment objects assessors examine or test:

• Specifications — policies, procedures, plans, SSP, designs, requirements.
• Mechanisms — hardware, software, firmware controls.
• Activities — operations, exercises, backup runs.
• Individuals — system owners, admins, security personnel, users.

Practitioner rule of thumb: For each AO, the OSC should be able to produce (1) the document/specification, (2) the technical artifact or screenshot showing the mechanism is configured, and (3) at least one person who can speak to operating the control.

---

6. CUI & FCI — Definitions, Marking, Boundary

FCI — Federal Contract Information

• Information provided by or generated for the Government under a contract.
• Not intended for public release.
• Not classified, not CUI.
• Triggers CMMC Level 1 safeguarding (FAR 52.204-21).
• Examples: pricing, delivery schedules, contract-related correspondence.

CUI — Controlled Unclassified Information

• Information requiring safeguarding or dissemination controls per law, regulation, or government-wide policy.
• Governed by 32 CFR Part 2002 and the CUI Registry at cui.archives.gov.
• The CUI Registry contains the authoritative list of CUI categories (organized under ~20 organizational index groupings), each with its own marking and handling rules.
• Triggers CMMC Level 2 (or L3 for sensitive programs).
• Practical rule: If DFARS 252.204-7012 is in your contract, you have CUI. Full stop.

Two flavors:

• CUI Basic — default safeguarding standard; 800-171 applies.
• CUI Specified — additional handling requirements per the CUI category (e.g., ITAR, EAR, Privacy, Critical Infrastructure).

Confidentiality impact value: No less than FIPS 199 moderate.

Boundary scope rule (key to scoping): 800-171 requirements apply only to components that process, store, or transmit CUI, or that provide protection for such components.

Marking expectations:

• Banner markings on the document.
• Category identification (e.g., CUI//SP-PRVCY).
• Dissemination controls if applicable.

---

7. CMMC Scoping Guide — Asset Categories

Per 32 CFR 170.19 and the CMMC L2 Scoping Guide, each asset falls into one of five categories. Proper categorization can dramatically reduce assessment burden and cost.

Category	What it is	CMMC treatment
CUI Assets	Process, store, or transmit CUI	All 110 controls apply
Security Protection Assets	Provide security services to CUI Assets (firewalls, IDS/IPS, SIEM, VPN, MDM, patch mgmt, AD/LDAP) — may not touch CUI directly	Applicable security requirements apply
Contractor Risk Managed Assets (CRMA)	Can technically reach CUI Assets but aren't required to process CUI (jump hosts, admin workstations)	Contractor-developed risk-based approach, documented
Specialized Assets	OT/ICS, IoT, Government Furnished Equipment	Tailored — document applicability and any compensating controls in the SSP
Out-of-Scope Assets	Isolated; no connection path to CUI systems	Not subject to CMMC — but isolation must be technically demonstrated, not merely asserted

Scope-Reduction Plays

1. CMMC enclave — isolate CUI into a dedicated environment (separate network segment, separate AD tenant, separate cloud tenant). Only the enclave is in scope.
2. Remove CUI from systems that don't need it; document the removal; those systems exit scope.
3. FedRAMP-authorized CSP — offload controls to the CSP for the cloud portion.
4. Genuinely isolated systems — air-gapped test networks with no path to CUI.

CUI Identification — Required Before Scoping

1. Map every contract containing DFARS 252.204-7012 or 7021.
2. Identify what data Government provides or contractor generates that qualifies as CUI.
3. Trace CUI flow — email, file shares, cloud, mobile, backups, vendors.
4. Document in SSP, including data flow diagrams (C3PAOs expect these).

---

8. ESP / CSP Rules

The most commonly misunderstood area of CMMC. ESPs and CSPs follow different rules.

Cloud Service Provider (CSP)

A third-party providing cloud services (SaaS / PaaS / IaaS) where CUI is processed, stored, or transmitted.

• FedRAMP Moderate authorization required, per DFARS 252.204-7012 and 252.239-7010.
• Equivalency option exists ("equivalent to FedRAMP Moderate" via a DoD-approved process) but is complex and rarely used.
• The OSA's on-premises infrastructure connecting to the CSP is in scope. The CSP environment itself is verified via FedRAMP, not as part of the CMMC assessment.
• The CSP must provide a Customer Responsibility Matrix (CRM) showing which controls are the CSP's vs. the customer's. The OSC's SSP documents customer-side implementation of shared controls.

Common CSP options for CUI:

Platform	FedRAMP	Notes
Microsoft 365 GCC High	High	Suitable for most DoD CUI, including ITAR
Microsoft Azure Government	High
AWS GovCloud	High
Microsoft 365 GCC	Moderate	Limited CUI types; not suitable for ITAR/EAR
Google Workspace Enterprise	Moderate (some configurations)	Validate per use case

ITAR/EAR caution: A CSP can be FedRAMP-authorized and technically eligible — but still ineligible to process specific CUI categories due to export-control restrictions on foreign-national access. Evaluate CUI category restrictions independently of FedRAMP authorization.

External Service Provider (ESP)

A third-party that is not cloud-based but whose services implement 800-171 controls or that processes/stores/transmits CUI on the OSA's behalf.

Common ESPs: MSSPs (SOC, SIEM), MSPs (patching, endpoint management), outsourced IT/AD admins, physical security monitoring vendors.

Rules (32 CFR 170.19 / 170.16):

1. ESP services are not exempt from assessment. If an ESP implements CMMC controls for the OSA, those services are within the assessment scope.
2. The ESP's role and services must be documented in the OSC's SSP along with a CRM.
3. ESP CMMC certification (optional, strongly recommended): if the ESP holds a valid CMMC certification covering the services provided, those services may be accepted without separate re-assessment. If the ESP is not CMMC-certified, the C3PAO must assess them as part of the OSC's assessment — significantly expanding scope and cost.

Decision tree:

Is the third-party service cloud-based?
├── YES → CSP → FedRAMP Moderate (or higher) authorization required
└── NO  → ESP → Include in scope OR get ESP CMMC-certified

---

9. Subcontractor Flow-Down (32 CFR 170.23)

Per the regulation (unless DoD specifies otherwise), the prime contractor determines the CMMC level required for each subcontractor based on the data the sub will handle.

Prime's requirement	Sub handling FCI only	Sub handling CUI
L2 (Self)	L1 minimum	L2 (Self) minimum
L2 (C3PAO)	L1 minimum	L2 (C3PAO) minimum
L3 (DIBCAC)	L1 minimum	L2 (C3PAO) minimum (unless DoD specifies higher)

Prime obligations:

• Verify subcontractor CMMC compliance at time of award, not just at solicitation response.
• Verify via SPRS (sub's CMMC Status should be visible — access mechanics still maturing).
• Include DFARS 252.204-7021 flow-down clause in subcontracts.

Practical advisory: Primes should build supplier cybersecurity verification into procurement processes now. Waiting until Phase 2/4 to verify subs will create supply chain disruptions.

---

10. SPRS Scoring Mechanics

Score vs. Status — Two Different Things

Concept	What it is	Where it lives
SPRS Score	Numerical (e.g., 98/110) from DoD Assessment Methodology self-assessment	SPRS (contractor-submitted)
CMMC Status	Categorical (Conditional L2 / Final L2 / etc.) from a CMMC assessment under 32 CFR 170	SPRS (self) or eMASS (C3PAO)

During Phase 1, a current SPRS score from a valid self-assessment is the CMMC L2 (Self) status.

DoD Assessment Methodology — Three Tiers

Under DFARS 252.204-7019/7020:

Tier	Conducted by	Rigor	SPRS effect
Basic	Contractor self	Low (honor system)	Contractor submits score
Medium	DoD records/interview review	Medium	DoD adjusts score if gaps found
High	DIBCAC on-site	High	DIBCAC score supersedes contractor's

Scoring Formula

SPRS = 110 − Σ (deductions for not-implemented or partially-implemented controls)

• Starting score: 110.
• Point weights per practice: 5 (High criticality), 3 (Medium), 1 (Low) — set by the CMMC Scoring Methodology.
• Deduction: full point value if Not Met; partial credit at assessor discretion for partially implemented controls.
• Conditional pass threshold: ≥ 88 (i.e., ≥ 80% of 110).
• Final status: 110/110 with all practices Met (no open POA&Ms).
• Score can go negative (theoretical floor around −203).

High-Impact (5-Point) Practices

A single Not-Implemented finding on any of these costs 5 points and — for most of them — is not POA&M-eligible. Verify against the current CMMC Scoring Methodology before client-facing work.

• AC.L2-3.1.1 — System access authorization
• IA.L2-3.5.3 — Multifactor authentication
• IA.L2-3.5.10 — Cryptographic password storage
• IR.L2-3.6.1 — Incident response capability
• IR.L2-3.6.2 — Incident tracking/reporting
• MA.L2-3.7.5 — Remote maintenance MFA
• RA.L2-3.11.2 — Vulnerability scanning
• SC.L2-3.13.8 — CUI encryption in transit
• SC.L2-3.13.10 — Cryptographic key management
• SC.L2-3.13.11 — FIPS-validated cryptography (special POA&M exception — see §11)
• SC.L2-3.13.16 — CUI encryption at rest
• SI.L2-3.14.1 — Flaw remediation
• SI.L2-3.14.2 — Malicious code protection
• SI.L2-3.14.6 — System monitoring for attacks
• CA.L2-3.12.4 — System Security Plan

---

11. POA&M Rules — Critical Section

A Plan of Action & Milestones is a time-bound documented plan to remediate identified deficiencies. Under CMMC, POA&Ms are not a general remediation tool — they are tightly restricted.

The Three Golden Rules

Rule 1 — Level 1 = NO POA&Ms ever. Per 32 CFR 170.21(a)(1). All 15 FAR 52.204-21 practices must be fully implemented at time of self-assessment submission. No exceptions.

Rule 2 — Level 2 POA&Ms require a passing score of ≥ 80%. Per 32 CFR 170.21(a)(2)(i). Assessment score ÷ 110 must be ≥ 0.8 → ≥ 88 of 110 practices must be MET before any POA&M is allowed.

Rule 3 — Only 1-point practices on POA&M, with one exception. Per 32 CFR 170.21(a)(2)(ii). No practice on a POA&M may have a point value greater than 1. The single exception: SC.L2-3.13.11 (FIPS-validated cryptography) may be on a POA&M at its 3-point value only if encryption is in use but not yet FIPS-validated. If encryption is not employed at all, 3.13.11 carries its full 5-point weight and is not POA&M-eligible.

The FIPS Exception — Three Scenarios

Scenario	Encryption posture	Deduction	POA&M eligible?
A	None	5 pts	No — assessment fails
B	In use, not FIPS-validated	3 pts	Yes
C	FIPS-validated in use	0 pts	n/a — fully Met

Practitioner play: Before assessment, get clients to implement encryption (even if not yet FIPS-validated) — converts a disqualifying 5-point hit into a POA&M-eligible 3-point hit.

Controls That CANNOT Be on a POA&M

Per 32 CFR 170.21(a)(2)(iii), the following are explicitly ineligible regardless of point value:

• AC.L2-3.1.1 — Account management
• AC.L2-3.1.2 — Access enforcement
• AC.L2-3.1.20 — External system connections
• AC.L2-3.1.22 — CUI on publicly accessible systems
• All 5-point practices (effectively, by Rule 3)
• Verify the full list against current 32 CFR 170.21 before client deliverables.

Valid POA&M Entry — Required Fields

1. Description of the deficiency (specific practice + why not met).
2. Responsible party (named individual, not "IT department").
3. Resource requirements (budget, personnel, tooling).
4. Specific milestone dates (not "TBD" or "within 6 months").
5. Estimated completion date within the 180-day conditional window.
6. Current status, updated as remediation progresses.

Closeout Process

1. Remediate within 180 days.
2. Conduct closeout assessment (self or C3PAO — matching original assessment type).
3. Post updated results: SPRS for Self, eMASS for C3PAO.
4. Status upgrades Conditional → Final.

If POA&M Not Closed in 180 Days

• Conditional CMMC Status expires.
• Contractor is immediately ineligible for new awards requiring that level.
• Mid-performance contracts: standard contractual remedies apply.
• New assessment from scratch required to regain status.
• No extension — the 180 days is firm per regulation.

Operational POA&M vs. CMMC POA&M

Operational POA&Ms (continuous improvement tracking under normal NIST practice) are separate from CMMC assessment POA&Ms (formal regulatory constructs with 180-day clocks). Don't conflate them.

---

12. Findings Language

At the assessment objective level, each AO produces one of:

• Satisfied — the objective is met based on evidence collected.
• Other Than Satisfied (OTS) — the objective is not met.

At the practice level, the rollup is:

• MET — all AOs within the practice are Satisfied.
• NOT MET — one or more AOs are Other Than Satisfied (and the practice is not eligible for partial credit).
• PARTIAL — some AOs Satisfied, others not, where partial credit applies under the Scoring Methodology.
• NOT APPLICABLE — control does not apply to the assessed scope (must be justified and documented in the SSP).

Findings language convention in deliverables:

• State the AO citation (e.g., 3.1.1[a]).
• State the method that produced the finding (Examine / Interview / Test).
• State the artifact or response that demonstrates the gap.
• Map to the SPRS point impact (1 / 3 / 5).
• Identify POA&M eligibility status.

---

13. C3PAO Assessment Lifecycle

Pre-Assessment

1. OSC selects C3PAO from the Cyber AB marketplace.
2. Scope determination under 32 CFR 170.19 — asset categorization, CUI boundary.
3. Documentation review — C3PAO reviews SSP, policies, procedures before going on-site.
4. Readiness/gap assessment (optional but strongly recommended). A C3PAO cannot both consult and certify the same OSC — readiness reviews must come from a different C3PAO or independent consultant.
5. Artifact preparation — evidence packages mapped to 800-171A objectives.

Assessment

1. Initiation — CMMC UID assigned (10-character identifier).
2. Team composition — minimum 3 CCAs on the assessment team.
3. Assessment activities — Examine / Interview / Test against every applicable AO.
4. Scoring — each practice MET or NOT MET per its AOs.
5. POA&M determination — which gaps qualify for POA&M.

Post-Assessment

1. C3PAO posts results to CMMC-eMASS; CMMC Status (Conditional or Final) appears in SPRS.
2. Certificate of CMMC Status issued.
3. Evidence retention: artifacts hashed (NIST-approved algorithm) and retained for 6 years from CMMC Status Date.
4. C3PAO uploads artifact names, hash values, and algorithm identifiers to eMASS.

C3PAO Rules (32 CFR 170.10 / 170.11)

• Accredited by the Cyber AB.
• CCAs must hold a Tier 3 background investigation (national security eligibility, not a clearance).
• Must use only their own accredited IT for assessments.
• Prohibited from providing consulting/implementation services to OSCs they certify.
• Assessment information is strictly confidential.

L2 (Self) — Non-C3PAO Process

1. Self-assess against 800-171A objectives.
2. Apply 32 CFR 170.19 scoping.
3. Score per 32 CFR 170.24.
4. Upload to SPRS.
5. Senior official affirms per 32 CFR 170.22.
6. CMMC Status posted in SPRS.

---

14. Annual Affirmation & False Claims Act Risk

Annual Affirmation (32 CFR 170.22)

After initial CMMC Status, a senior company official must affirm in SPRS/eMASS each year that:

• The organization continues to implement all required practices.
• No material changes have occurred that affect CMMC compliance.
• All information-system changes are reflected in the SSP.

Frequency: within one year of initial CMMC Status Date, then annually for the 3-year cycle. Material changes may trigger re-assessment.

False Claims Act Exposure

CMMC creates real FCA exposure — context every client conversation should include:

• FCA liability: Up to 3× government damages + per-claim penalties for knowingly false certifications.
• DOJ Cyber-Fraud Initiative has been pursuing cybersecurity false certifications since 2019.
• Recent precedent: Multiple multi-million-dollar settlements against defense contractors that falsely certified cybersecurity compliance.
• Personal liability: The signing senior official is personally certifying.

What creates exposure:

1. Submitting an inflated SPRS score.
2. Knowingly false annual affirmation.
3. Certifying a bid as CMMC-compliant when the OSC knows it isn't.
4. Prime contractor knowingly ignoring sub's false claims.

Safe-harbor posture: an honest, low SPRS score plus a credible POA&M is defensible. An inflated score is not. Accurate reporting + credible remediation = manageable risk; inflated reporting = potential criminal exposure.

---

15. Rev 2 → Rev 3 Crosswalk + ODPs

CMMC is currently based on 800-171 Rev 2 only. Rev 3 (May 2024) is the forward horizon — not operative for CMMC until DoD adopts it (no announced date).

Structural Changes

Metric	Rev 2	Rev 3
Control families	14	17 (adds PL, SA, SR)
Total requirements	110	~97 (net — many consolidations)
Numbering	3.X.Y	03.X.Y (leading zeros)
Basic/Derived distinction	Yes	Eliminated
ODPs	None	Introduced
Family renames	—	CA → "Security Assessment and Monitoring"

Key Consolidations

• 3.1.12 + 3.1.14 + 3.1.15 → 03.01.12 (Remote Access)
• 3.1.16 + 3.1.17 → 03.01.16 (Wireless)
• 3.1.18 + 3.1.19 → 03.01.18 (Mobile Devices)
• 3.1.20 + 3.1.21 → 03.01.20 (External Systems)
• 3.2.1 + 3.2.3 → 03.02.01 (Literacy Training)
• 3.5.4 + 3.5.6 + 3.5.8 + 3.5.9 + 3.5.10 + 3.5.11 → 03.05.03 / 03.05.07 (MFA, Password Mgmt)
• 3.1.13 + 3.8.6 + 3.13.8 → 03.13.08 (Cryptographic Protection)
• 3.12.4 (SSP) → 03.15.02 (relocated to new PL family)

ODPs — Organization-Defined Parameters

Introduced in Rev 3. Select requirements contain [Assignment: organization-defined X] values that must be defined by either the contracting federal agency or the contractor. Once defined, they become assessable scope.

ODP categories:

• Time periods — inactivity timeouts, audit failure response windows, scan frequency.
• Roles/personnel — who is authorized for privileged accounts, who responds to logon-attempt thresholds.
• Technical parameters — number of invalid logon attempts allowed, configuration settings, types of cryptography.
• Security requirements — requirements imposed on external systems, prohibited services/ports/protocols.

ODP planning for clients pre-adoption:

1. Stand up an ODP register (separate doc or SSP appendix).
2. Have management approve each value.
3. Implement controls using those defined values.
4. Be ready to be assessed against your own stated values — they become binding.

Why You Can't "Just Use Rev 3"

Some clients have implemented Rev 3-style controls and believe they're covered. Rev 2 has specific requirements that Rev 3 softened with ODPs — for current CMMC assessments, the Rev 2 language governs:

• 3.3.7 (clock sync) — Rev 2 requires NTP sync with an authoritative source; Rev 3 softened.
• 3.4.8 (allow/deny software) — Rev 2 requires an explicit policy choice and implementation.
• 3.5.3 (MFA) — Rev 2 requires MFA for network access to non-privileged accounts; no ODP wiggle room.
• 3.13.11 (FIPS crypto) — Rev 2 says "FIPS-validated", flat. Rev 3 uses ODP. For CMMC, FIPS validation is mandatory.

---

16. Common L2 Implementation Gaps (with AO citations)

Replaces the loose gap list with practitioner-confirmed patterns mapped to specific assessment objectives.

Gap	Practices / AOs	Why it fails
MFA partial — admins only, not all network users	IA.L2-3.5.3 (all AOs); related 3.1.12	Rev 2 requires MFA for network access to non-privileged accounts; "admins only" does not satisfy
SMS or push-only MFA	IA.L2-3.5.3	Phishing-resistant MFA expected; SMS increasingly called out
Account review records missing	AC.L2-3.1.1[d–f]; 3.1.5[a–d]	Policy exists but no documented periodic review evidence
Asset inventory incomplete / no network diagram	CM.L2-3.4.1[a–f]; CA.L2-3.12.4	Baseline configuration cannot be asserted without inventory
Audit log retention without review	AU.L2-3.3.1[e–f]; 3.3.5	Logs generated but never analyzed — fails Examine + Interview
IR plan untested or no 72-hour reporting process	IR.L2-3.6.1[a–g]; 3.6.3; DFARS 7012	Plan exists but exercises absent; DIBNet reporting workflow undocumented
No baseline configurations / informal change control	CM.L2-3.4.1; 3.4.3; 3.4.5[a–h]	Required artifacts (baselines, change records) cannot be produced
Allow/deny software policy missing	CM.L2-3.4.8	Policy-only without enforcement evidence; technical control required
FIPS-validated crypto unconfirmed	SC.L2-3.13.11; 3.13.8; 3.13.16	Encryption in use but not via CMVP-validated module — 3-pt POA&M if encryption present, 5-pt fail if not
No documented deny-by-default boundary rule	SC.L2-3.13.6	Implicit allow rules undermine flow control
CUI at rest not encrypted	SC.L2-3.13.16	Common on endpoints; full-disk encryption alone may not satisfy if CUI is in cloud sync folders
SSP not current	CA.L2-3.12.4[a–h]	SSP exists but stale; assessor wants current state
Patch SLAs without evidence	SI.L2-3.14.1; RA.L2-3.11.3	Policy says "30 days" but no records demonstrate it
AV not auto-updating

Controls Where "Policy Only" Always Fails

These require technical implementation evidence, not just a policy document:

• 3.1.8 (logon attempt limits)
• 3.1.10 (screen lock)
• 3.4.8 (allow/deny software policy)
• 3.5.3 (MFA)
• 3.13.8 (CUI in transit)
• 3.13.11 (FIPS-validated cryptography)
• 3.13.16 (CUI at rest)
• 3.14.2 (malicious code protection)

---

17. Authoritative Sources

Primary

• NIST SP 800-171 Rev 2 — https://doi.org/10.6028/NIST.SP.800-171r2
• NIST SP 800-171A Rev 2 — assessment procedures (320 objectives)
• NIST SP 800-172 — Enhanced Security Requirements (L3 source)
• 32 CFR Part 170 — CMMC program rule (89 FR 83214, Oct. 15, 2024; effective Dec. 16, 2024)
• 48 CFR Part 204.75 (DFARS) — CMMC acquisition rule (effective Nov. 10, 2025)
• DFARS 252.204-7012 / -7019 / -7020 / -7021 / -7025
• FAR 52.204-21 — Basic Safeguarding (CMMC L1 source)
• 32 CFR Part 2002 — CUI program rule
• CUI Registry — cui.archives.gov

CMMC Program Documents

• CMMC Model v2.0
• CMMC Assessment Guide — Level 1
• CMMC Assessment Guide — Level 2
• CMMC Assessment Guide — Level 3
• CMMC Scoping Guide — Level 1
• CMMC Scoping Guide — Level 2
• CMMC Scoring Methodology
• DoD Assessment Methodology (basis for SPRS scoring)

Authoritative locations: dodcio.defense.gov/CMMC/, cyber.mil, cyberab.org, sprs.csd.disa.mil, dibnet.dod.mil (incident reporting).

---

Capabilities

This skill supports:

• CMMC level selection and CUI boundary scoping
• Per-control (and per-AO) implementation guidance for all 110 800-171 Rev 2 practices
• SSP development, review, and gap mapping
• Assessment objective-level evidence planning
• C3PAO assessment readiness preparation
• POA&M development with eligibility validation against 32 CFR 170.21
• SPRS score calculation against the CMMC Scoring Methodology
• ESP/CSP scoping decisions and FedRAMP equivalency analysis
• Subcontractor flow-down planning
• Annual affirmation workflow and FCA-risk advisory
• Rev 2 → Rev 3 crosswalk and ODP planning
• DFARS clause interpretation across 7012, 7019, 7020, 7021, 7025