Evaluating Organizations Seeking Certification (OSC) Against CMMC Level 2 · CUI vs FCI Applicability
In the context of evaluating an Organization Seeking Certification (OSC) against CMMC Level 2, what is the fundamental difference between Federal Contract Information (FCI) and Controlled Unclassified Information (CUI)?
Answer and explanation
Correct answer: D
CUI requires stringent protection controls defined by NIST SP 800-171 (CMMC Level 2), as it involves specific safeguarding laws or regulations. FCI only requires the 15 basic safeguarding requirements outlined in FAR 52.204-21 (CMMC Level 1). Understanding this distinction is the first step in determining an OSC's readiness and applicability for a Level 2 assessment.
True or False: An Organization Seeking Certification (OSC) can undergo a formal CMMC Level 2 assessment even if their System Security Plan (SSP) is currently in draft format, provided they have a comprehensive Plan of Action and Milestones (POA&M).
Answer and explanation
Correct answer: B
False. A finalized, formally documented System Security Plan (SSP) is a fundamental prerequisite for any CMMC Level 2 assessment. The SSP describes the system boundary and how the security requirements are met. Without a finalized SSP, the assessor cannot establish the assessment scope or evaluate the baseline controls, making the OSC unready for an assessment.
Under DFARS 252.204-7012, which is foundational to CMMC Level 2 applicability, what is the strict timeframe an OSC must adhere to when reporting a discovered cyber incident to the Department of Defense (DoD)?
Answer and explanation
Correct answer: D
DFARS 252.204-7012 strictly mandates that defense contractors must rapidly report cyber incidents to the DoD (via DIBNet) within 72 hours of discovery. Assessing an OSC's incident response capability during a CMMC Level 2 assessment involves verifying that this 72-hour reporting mechanism is formally established and tested.
Before a CMMC Level 2 assessment can officially commence, an assessor must verify that the OSC has prepared specific mandatory documentation. Which TWO of the following documents are absolute prerequisites for initiating the assessment process? (Select TWO)
Answer and explanation
Correct answers: A, D
The Plan of Action and Milestones (POA&M) is required to document any unmet or planned security requirements. Even if no items are currently deficient, a formal POA&M process must exist and be provided to the assessment team.
The System Security Plan (SSP) is the foundational document that defines the assessment boundary and describes how the NIST SP 800-171 practices are implemented. Without it, the assessment cannot begin.
Question 5
Advanced
Evaluating Organizations Seeking Certification (OSC) Against CMMC Level 2 · CMMC Level 2 applicability and objectives
An Organization Seeking Certification (OSC) is preparing for a CMMC Level 2 assessment. During the readiness review, the Lead CCA analyzes the OSC's proposed data flow architecture for handling Controlled Unclassified Information (CUI).
Based on the architecture diagram provided, what represents the MOST critical readiness risk that would prevent the OSC from achieving CMMC Level 2 certification?
Under DFARS 252.204-7012 and CMMC Level 2 requirements, any Cloud Service Provider (CSP) used to store, process, or transmit CUI must meet security requirements equivalent to FedRAMP Moderate baseline. Using a standard commercial SaaS application without establishing this equivalency is a critical compliance failure and a major readiness risk.
Question 6
Advanced
Evaluating Organizations Seeking Certification (OSC) Against CMMC Level 2 · CMMC Level 2 applicability and objectives
An aerospace manufacturing subcontractor is reviewing their contractual obligations to determine their CMMC readiness. They hold multiple subcontracts. Subcontract A includes FAR 52.204-21 but no DFARS clauses. Subcontract B includes DFARS 252.204-7012 and involves the transmission of technical drawings marked as Controlled Unclassified Information (CUI). Subcontract C involves commercial off-the-shelf (COTS) items only.
To achieve compliance for all current obligations, what is the MINIMUM certification level the subcontractor must prepare for, and to which systems does it apply?
Answer and explanation
Correct answer: B
Because Subcontract B involves CUI and DFARS 7012, the organization must achieve CMMC Level 2. However, this requirement only applies to the systems within the assessment boundary (the CUI enclave) that process, store, or transmit that CUI, along with the Security Protection Assets that secure them. COTS contracts (Subcontract C) do not inherently require CMMC, and FAR 52.204-21 (Subcontract A) only requires Level 1 for those specific systems.
Register free for 6 more questions
Or unlock all 150 CCA questions with explanations, timed mode and flashcards.
