CCP Blueprint: Difference between revisions
Jump to navigation
Jump to search
Line 97: | Line 97: | ||
== Domain 3. CMMC Governance and Source Documents == | == Domain 3. CMMC Governance and Source Documents == | ||
=== Task 1. Demonstrate understanding of Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) in non-federal unclassified networks. === | === Task 1. Demonstrate understanding of Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) in non-federal unclassified networks. === | ||
{|class="wikitable" | |||
|1. Current Department of Defense (DoD) Defense Industrial Base (DIB) Cybersecurity Efforts, Regulations, and Executive Orders pertaining to the CMMC program: | |||
:A. Part 32 of the Code of Federal Regulations (C.F.R.) | |||
1. Current Department of Defense (DoD) Defense Industrial Base (DIB) Cybersecurity Efforts, Regulations, | :B. Defense Federal Acquisition Regulation Supplement (DFARS) in Part 48 of the C.F.R | ||
and Executive Orders pertaining to the CMMC program: | :C. DFARS Clause 252.204-7012 | ||
A. Part 32 of the Code of Federal Regulations (C.F.R.) | ::(1) National Institute of Standards and Technology (NIST) SP 800-171 | ||
B. Defense Federal Acquisition Regulation Supplement (DFARS) in Part 48 of the C.F.R | ::(2) Technical Data (DFARS 252.227-7013) | ||
C. DFARS Clause 252.204-7012 | ::(3) FedRAMP | ||
(1) National Institute of Standards and Technology (NIST) SP 800-171 | |- | ||
(2) Technical Data (DFARS 252.227-7013) | |2. CMMC Framework Tenets: | ||
(3) FedRAMP | :A. Key aspects of CMMC v.20 program requirements | ||
::(1) Streamlined Model | |||
:::(a) Focused on the most critical requirements | |||
:::(b) Aligned with widely accepted standards | |||
::(2) Reliable Assessments | |||
:::(a) Reduced assessment costs | |||
:::(b) Higher accountability | |||
2. CMMC Framework Tenets: | ::(3) Flexible Implementation | ||
A. Key aspects of CMMC v.20 program requirements | :::(a) Spirit of collaboration | ||
(1) Streamlined Model | :::(b) Added flexibility and speed | ||
(a) Focused on the most critical requirements | :B. Rulemaking and timeline for CMMC v2.0 | ||
(b) Aligned with widely accepted standards | ::(1) Incentives, Assessments, and 9–24-month rule making | ||
:C. Levels of CMMC assessments and requirements | |||
::(1) Foundational/Level 1 (same as previous CMMC v1.0 level 1) | |||
:::(a) FAR Clause 52.204-21 | |||
(2) Reliable Assessments | ::::a. Provide overview of the 17 basic safeguarding requirements and how procedures are applied within the CMMC L1/L2 practices/assessment framework | ||
(a) Reduced assessment costs | ::(2) Advanced/Level 2 (previous level 3) | ||
(b) Higher accountability | :::(b) NIST SP 800-171 (Requirements) | ||
::::a. Provide overview of the 110 NIST SP 800-171 requirements and how they are applied within the CMMC Level 2 practices/assessment framework | |||
:D. Self-Assessments vs. Third-Party Assessments | |||
::(1) Define different criteria for various assessment type under CMMC v2.0 framework | |||
(3) Flexible Implementation | |- | ||
(a) Spirit of collaboration | |3. Consequences of non-compliance: | ||
(b) Added flexibility and speed | :A. Failure to receive an award of contract | ||
:B. Contractual liability | |||
:C. False Claims Act | |||
::(1) US Department of Justice, | |||
:::(a) Civil Cyber-Fraud Initiative | |||
|} | |||
B. Rulemaking and timeline for CMMC v2.0 | |||
(1) Incentives, Assessments, and 9–24-month rule making | |||
C. Levels of CMMC assessments and requirements | |||
(1) Foundational/Level 1 (same as previous CMMC v1.0 level 1) | |||
a | |||
a. Provide overview of the 17 basic safeguarding requirements and how | |||
procedures are applied within the CMMC L1/L2 practices/assessment | |||
framework | |||
(2) Advanced/Level 2 (previous level 3) | |||
b | |||
a. Provide overview of the 110 NIST SP 800-171 requirements and how they | |||
are applied within the CMMC Level 2 practices/assessment framework | |||
D. Self-Assessments vs. Third-Party Assessments | |||
(1) Define different criteria for various assessment type under CMMC v2.0 framework | |||
3. Consequences of non-compliance: | |||
A. Failure to receive an award of contract | |||
B. Contractual liability | |||
C. False Claims Act | |||
(1) US Department of Justice, | |||
(a) Civil Cyber-Fraud Initiative | |||
=== Task 2. Determine the appropriate roles/responsibilities/authority for Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). === | === Task 2. Determine the appropriate roles/responsibilities/authority for Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). === |
Revision as of 18:38, 4 August 2022
Source of Reference: The CCP blueprint from Cybersecurity Maturity Model Certification Accreditation Body, Inc.
For inquiries and reporting errors on this wiki, please contact us. Thank you.
Domains
Upon successful completion of this exam, the candidate will be able to apply skills and knowledge to the below domains:
Domain | Exam Weight |
1. CMMC Ecosystem | 5% |
2. CMMC-AB Code of Professional Conduct (Ethics) | 5% |
3. CMMC Governance and Sources Documents | 15% |
4. CMMC Model Construct and Implementation Evaluation | 35% |
5. CMMC Assessment Process (CAP) | 25% |
6. Scoping | 15% |
Domain 1: CMMC Ecosystem
Task 1. Identify and compare roles/responsibilities/requirements of authorities across the CMMC Ecosystem.
1. Authorities: |
a. Office of the Undersecretary of Defense (OUSD)
|
b. CMMC Ecosystem and the different types of entities participating in it
|
Domain 2: CMMC-AB Code of Professional Conduct (Ethics)
Task 1. Identify and apply knowledge of the Guiding Principles and Practices of the CMMC-AB Code of Professional Conduct (CoPC)/ISO/IEC/DOD requirements.
# General ethics topics
|
Domain 3. CMMC Governance and Source Documents
Task 1. Demonstrate understanding of Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) in non-federal unclassified networks.
1. Current Department of Defense (DoD) Defense Industrial Base (DIB) Cybersecurity Efforts, Regulations, and Executive Orders pertaining to the CMMC program:
|
2. CMMC Framework Tenets:
|
3. Consequences of non-compliance:
|
Task 2. Determine the appropriate roles/responsibilities/authority for Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).
1. Importance of data classification, collection, and analysis
|
2. Contractor sensitive data categories
|
3. Government authority for identifying and marking CUI
|
4. Contractor/Authorized holders’ responsibilities in handling CUI
|
Task 3. Demonstrate understanding of the CMMC Source and Supplementary documents.
1. CMMC Source Documents
|
2. ISOO CUI Registry
|
3. DoD CUI Registry
|
Domain 4 - CMMC Model Construct and Implementation Evaluation
Task 1. Given a scenario, apply the appropriate CMMC Source Documents as an aid to evaluate the implementation/review of CMMC practices.
(At a minimum CCP candidate must be evaluated on CMMC L1 Practices during CCP exam)
1. Model Architecture |
2. Model Levels:
|
3. Practices:
|
4. Domains:
|
Task 2. Apply knowledge of the CMMC Assessment Criteria and Methodology to the appropriate CMMC practices.
|
Task 3. Analyze the adequacy/sufficiency around the location/collection/quality/usage of Evidence.
|
Domain 5: CMMC Assessment Process
Task 1. Choose the appropriate roles of the CCP in the CMMC Assessment Process when developing the assessment plan (Phase 1– Plan and Prepare Assessment).
|
Task 2. Apply CMMC Assessment Process requirements pertaining to the role of the CCP as an assessment team member while conducting a CMMC assessment (Phase 2 – Conduct Assessment).
|
Task 3. Demonstrate comprehension of the CCP role in the preparation of assessment report (Phase 3 – Report Assessment Results).
|
Task 4. Demonstrate comprehension of the CCP role in the process of evaluating outstanding assessment issues on Plan of Action and Milestones (POA&M) (Phase 4 – Evaluation of Outstanding Assessment POA&M Items).
1. The evaluation of assessment POA&M items
|
Task 5. Given a scenario, determine the appropriate phases/steps to assist in the preparation/conducting/ reporting on a CMMC Level 2 Assessment.
1. Plan and Prepare Assessments:
|
2. Conduct Assessment:
|
3. Report Recommended Assessment Results:
|
4. Remediate Outstanding Assessment Issues:
|
Domain 6: Scoping
Task 1. Understand CMMC High-Level Scoping as described in the CMMC Assessment Process.
1. Defining organizational scoping
|
Task 2. Given a Scenario, analyze the organization environment to generate an appropriate scope for FCI Assets.
1. Defining FCI data in the form of Assets that:
|
2. Out-of-Scope Assets |
3. Specialized Assets
|
4. Scoping Activities
|