CCA CMMC Certification Levels & Requirements

Question 1

How many cybersecurity practices are required for CMMC Level 1 (Foundational)?

Accepted Answer

17

Answer

55

Answer

110

Answer

130

Question 2

Which NIST publication serves as the primary framework for CMMC Level 2 (Advanced) requirements?

Accepted Answer

NIST SP 800-171

Answer

NIST SP 800-53

Answer

NIST SP 800-172

Answer

NIST SP 800-137

Question 3

What type of assessment is required for a CMMC Level 1 certification?

Accepted Answer

Annual self-assessment affirmed by a senior official

Answer

Government-led assessment by DIBCAC

Answer

Third-party assessment by a C3PAO

Answer

Biennial independent verification by a CCA

Question 4

Which organization conducts government-led assessments for CMMC Level 3 (Expert)?

Accepted Answer

Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)

Answer

NSA Information Assurance Directorate

Answer

CMMC Accreditation Body (Cyber AB)

Answer

Defense Contract Audit Agency (DCAA)

Question 5

What type of sensitive information does CMMC Level 2 specifically aim to protect?

Accepted Answer

Controlled Unclassified Information (CUI)

Answer

Classified National Security Information (CNSI)

Answer

Federal Contract Information (FCI) only

Answer

Sensitive Compartmented Information (SCI)

Question 6

Under CMMC 2.0, how often must a CMMC Level 2 contractor that requires a third-party assessment renew their certification?

Accepted Answer

Every three years (triennially)

Answer

Annually

Answer

Every two years

Answer

Every five years

Question 7

Which DoD contract clause requires contractors to implement basic safeguarding requirements specifically for Federal Contract Information (FCI)?

Accepted Answer

FAR 52.204-21

Answer

DFARS 252.204-7012

Answer

DFARS 252.239-7009

Answer

FAR 52.239-1