CyberSecurity Maturity Model Certification (CMMC): Certified CMMC Professional (CCP)

Topic A: Identify Responsibilities of the CMMC CP

Identify responsibilities of a Certified Professional.

• CP Responsibilities – In-house or Consultant
• CP Responsibilities – Assessment Team
• Various Roles Performed by a CP
• Technical Opportunities
• External Consulting
• Assisting in Assessments
• How Contractors Are Expected to Administer Self-Assessments
• Separation of Duties
• Guidelines for Maintaining an Appropriate Separation of Duties
• Identifying Responsibilities of the CMMC Certified Professional
  

Topic B: Demonstrate Appropriate Ethics and Behavior

Demonstrate ethics and behavior that are appropriate for a CMMC Certified Professional, as outlined in the Code of Professional Conduct.

• Code of Professional Conduct (CoPC)
• Guidelines for Professional Conduct
• Demonstrating Appropriate Ethics and Behavior

Topic A: Identify Regulated Information

Define types of regulated information.

• Federal Contract Information (FCI)
• 48 CFR § 52.204-21 - Basic Safeguarding of Covered Contractor Information Systems
• Understanding CUI
• DFARS Clause 252.204-7012 -- Safeguarding Covered Defence Information and Cyber Incident Reporting
• NARA CUI Registry: CUI Types
• NARA CUI Registry: CUI Groupings
• NARA CUI Registry: CUI Defence Categories
• NARA CUI Registry: CUI Defence Covered Technical Information
• WORKING Covered Defence Information Definition
• DODI 8582.1 (FCI/CUI)
• Controlled Unclassified Information (CUI)
• Controlling Authorities
• DODI 5200.48 (CUI)
• 32 CFR Part 2002, Controlled Unclassified Information (CUI)
• Rules and Regulations Applying to CUI
• FCI vs CUI
• Controlled Technical Information (CTI)
• Guidelines for Identifying CTI
• Export Controlled Information (ECI)
• Guidelines for Protecting and Restricting ITAR and Export Controlled Data
• Guidelines for Determining the Type of Protected Information
• Guidelines for Protecting FCI
• Guidelines for Protecting CUI
• Guidelines for Protecting CTI
• Guidelines for Protecting ECI
• Identifying Regulated Information
  

Topic B: Establish the Certification and Assessment Scope Boundaries

Establish appropriate scope boundaries for a CMMC Assessment.

• Scoping
• Scope Boundaries
• How Does Scoping Affect Your Role as a CP?
• Scoping: Roles & Responsibilities During Assessments
• Scoping: Data-Centric Methodology
• Guidelines for Establishing the Certification and Assessment Scope Boundaries
• CMMC Level 1 Category A – In Scope
• CMMC Level 1 Category B – Out of Scope
• CMMC Level 1 Category C – Enabling Asset
• Excluded Assets
• Separation Techniques – Isolation
• Separation Technique – Controlled Access
• Separation Example: Guest Wireless – Logical Isolation
• Separation Example: Access Control – Logical Isolation
• Separation Example: Extended Untrusted User/System Access
• Evolution of Artifacts and Evaluation Methods in Relation to Maturity Level
• Identifying Appropriate Certification and Assessment Scope Boundaries

Topic A: Evaluate Readiness

Evaluate the readiness of an organization seeking to undergo the CMMC assessment process.

• Assessment as Partnership
• The Path to CMMC Certification
• Guidelines for Identifying the Scope of the Assessment
• Identify Desired Maturity Level
• Ways to Evaluate How Prepared You Are Before the Assessment
• Gap Analysis
• Closing Gaps
• Benefits of an Evidence Validation
• Guidelines for Evaluating Readiness
• Evaluating Readiness
  

Topic B: Determine Objective Evidence

Determine what objective evidence you intend to present in the assessment.

• Effective Assessments
• Objective Evidence
• CMMC Assessment Reference Documents
• Methods Assessors Will Use to Make Their Evaluation
• Limits on Assessors' Access to the Organization's CUI and FCI
• Evidence Collection, Preparation, and Generation
• Stakeholder Interviews
• Organization of Documents and Other Evidence to Prepare for an Assessment
• Guidelines for Determining Objective Evidence
• Determining Objective Evidence Categories

Topic A: Assess the NIST 800-171 Practices Using the 800-171A Methodology

Implement the NIST SP 800-171 requirements using the NIST SP 800-171A Assessment methodology.

• CMMC Assessment Requirements Map
• CMMC Source Documents
• NARA ISOO (Information Security Oversight Office)
• The Role of the Information Security Oversight Office (ISOO)
• ISOO CUI Notice 2020-04: Assessing Security Requirements for CUI in Non-Federal Information Systems (dated 16 June 2020) (4 slides)
• NIST SP 800-171A Assessment Depth & Coverage
• NIST SP 800-171A Assessment Procedure
• NIST SP 800-171A Assessment Methods (3 slides)
• Multi-Factor Authentication: Requirement
• Multi-Factor Authentication: Objectives
• Multi-Factor Authentication: Methods & Objects
• Requirement to Objectives to Systems
• CMMC Assessment Procedures
• Pass with Inheritance: Shared Service Responsibility Model
• How the Assessment Procedures Affect Your Role as a CP
• Guidelines for Assessing the NIST 800-171 Practices Using the 800-171A Methodology
• Assessing the NIST 800-171 Practices Using the 800-171A Methodology
  

Topic B: Assess Delta Practices

Use the CMMC Assessment Guide to assess practices not covered in NIST 800-171.

• The CMMC Delta Practices
• The CMMC Assessment Guide
• The CMMC Appendices
• Supplemental Resources
• Guidelines for Assessing Delta Practices
• Assessing Delta Practices
  

Topic C: Assess Processes

Use the CMMC Assessment Guide to assess processes.

• Processes in the Appendices
• Processes in the CMMC Assessment Guide
• CERT RMM v1.2 (Resilience Management Model)
• Guidelines for Assessing Processes
• Assessing a Process

Topic A: Maturity Level 1 Domains and Practices

Identify the domains and practices for basic cyber hygiene at ML1.

• Maturity Level 1 Processes
• CMMC vs FAR 52.204-21
• Maturity Level 1 Domains
• Maturity Level 1 Practices (Part 1)
• Maturity Level 1 Practices (Part 2)
• Identifying Maturity Level 1 Domains and Practices
  

Topic B: Determine Scope Boundaries at Maturity Level 1

Determine the scope boundaries at ML1.

• CMMC ML1 Assessment Preparation Steps
• Scenario: GrandMegaCorp
• Step 1: Identify the FCI and CUI
• Step 2.1: Determine the way FCI/CUI moves within the organization (5 slides)
• Step 2.2: Will FCI be generated by GrandMegaCorp?
• Step 2.3: Will FCI be shared with, or accessible by, others?
• Step 2.4 Who in GrandMegaCorp has Access to it?
• Step 2.5: Will FCI be sent to the government?
• Step 3: Identify the Systems with FCI
• Step 3: FCI and GrandMegaCorp End-user Devices
• Step 4: Evaluate the In-scope Systems Against the CMMC Model Requirements
• GrandMegaCorp Scope Boundaries
• Determining Scope Boundaries at CMMC Level 1
  

Topic C: Perform a Maturity Level 1 Gap Analysis

Perform a maturity level 1 gap analysis.

• NIST SP 800-171A – Assessments
• NIST SP 800-171A – Assessment Attributes
• CMMC ML1 Assessment Preparation Steps
• GrandMegaCorp
• Maturity Level 1 Practices we will Discuss
• Creating and Evaluating an ML1 Environment
• 1.001
• 1.002
• 1.131
• 1.132—PE.1.134
• 1.175
• 1.176
• Guidelines for Performing a Maturity Level 1 Gap Analysis
• Performing a Maturity Level 1 Gap Analysis

Topic D: Perform a Maturity Level 1 Evidence Validation

Perform a ML1 evidence validation.

• KB
• Guidelines for Performing a Maturity Level 1 Evidence Validation
• Performing a Maturity Level 1 Evidence Validation

Topic E: Perform a Maturity Level 1 Pre-Assessment Readiness Review

Perform a ML 1 pre-assessment readiness review.

• KB
• Guidelines for Performing a Maturity Level 1 Pre-Assessment Readiness Review
• Performing a Maturity Level 1 Pre-Assessment Readiness Review

Topic A: Maturity Level 2 Process Maturity Requirement

Identify the processes for intermediate cyber hygiene at ML2.

• Level 2 Processes
• Process Maturity
• Identifying Processes That Should Be Performed at CMMC Level 2

Topic B: Maturity Level 2 Practices

Identify the practices for intermediate cyber hygiene at ML2.

• CMMC Level 2 Scoping
• Level 2 Practices
• Level 2 Delta Practices
• Identifying Practices That Should Be Performed at CMMC Level 2

Topic C: Perform a Maturity Level 2 Gap Analysis

Perform a ML2 gap analysis.

• KB
• Guidelines for Performing a Maturity Level 2 Gap Analysis
• Performing a Maturity Level 2 Gap Analysis

Topic D: Perform a Maturity Level 2 Evidence Validation and a Pre-Assessment Readiness Review

Perform ML2 evidence validation and pre-assessment readiness review.

• KB
• Guidelines for Performing a Maturity Level 2 Evidence Validation and a Pre-Assessment Readiness Review
• Performing a Maturity Level 2 Evidence Validation and Pre-Assessment Readiness Review

Topic A: Maturity Level 3 Processes

Identify the processes for good cyber hygiene at ML3.

• Level 3 Processes
• Maintenance
• Resourcing
• Identifying Processes That Should Be Performed at CMMC Level 3

Topic B: Maturity Level 3 Practices

Identify the practices for good cyber hygiene at ML3.

• Level 3 Practices
• Level 3 Delta Practices
• Identifying Practices That Should Be Performed at CMMC Level 3

Topic C: Determine Scope Boundaries at Maturity Level 3

Determine the scope boundaries at ML3.

• CMMC Level 3 Scoping (5 slides)
• KB
• Guidelines for Determining Scope Boundaries at Maturity Level 3
• Determining Scope Boundaries at Maturity Level 3

Topic D: Perform a Maturity Level 3 Gap Analysis

Perform a ML3 gap analysis.

• KB
• Guidelines for Performing a Maturity Level 3 Gap Analysis
• Performing a Maturity Level 3 Gap Analysis
  

• KB
• Guidelines for Performing a Maturity Level 3 Evidence Validation and a Pre-Assessment Readiness Review
• Performing a Maturity Level 3 Evidence Validation and a Pre-Assessment Readiness Review

Topic A: Maturity Level 4 Processes and Practices

Identify the processes and practices for proactive cyber hygiene at ML4.

• CMMC Level 4Scoping
• Level 4 Processes
• Review and Measurement
• Level 4 Practices
• Level 4 Delta Practices
• Identifying Processes and Practices That Should Be Performed at CMMC Level 4

Topic B: Maturity Level 5 Processes and Practices

Identify the processes and practices for advanced/progressive cyber hygiene at ML5.

• CMMC Level 5 Scoping
• Level 5 Processes
• Standardization and Optimization
• Level 5 Practices
• Level 5 Delta Practices
• Identifying Processes and Practices That Should Be Performed at CMMC Level 5

Topic A: Define the Assessment Logistics

Define the logistics required to schedule, complete, and finalize a CMMC assessment as required to receive CMMC-AB certification.

• The Assessment Process
• Prep Work
• On-Site Work
• Pre-assessment Readiness Review
• Responsibilities of the OSC and the OSC Point of Contact (POC)
• Responsibilities of the Certified Assessor and the Assessment Team Members
• Access to Facilities and Resources Required by the Assessment Team
• Opening or Kick Off Briefing
• Daily Checkpoints
• Final Recommended Findings Briefing
• Post Assessment
• Guidelines for Defining the Assessment Logistics
• Defining the Assessment Logistics

Topic B: Resolve Assessment Related Issues

Describe the process for resolving assessment related issues.

• Assessment Related Issues
• Assessment Related Conflicts
• Post Assessment When Remediation is Required
• Remediation
• Assessor’s Withdrawal Due to Ethical or Other Violations
• Adjudication
• Process to Dispute CMMC-AB Decisions
• CMMC-AB Adjudication Process
• Guidelines for Resolving Assessment Related Issues
• Resolving Assessment Related Issues

• Perform the roles and characteristics of a good CP.
• Roles for a CP
• Characteristics of a Good Consultant
• Guidelines for Being a Professional Consultant
• CP on an Assessment Team
• Guidelines for Participating on an Assessment Team
• Following Best Practices

Topic B: Cybersecurity Beyond CMMC

Discuss security risks that go beyond the CMMC Model framework and professional resources and communities to help continued learning.

• Cybersecurity Culture Change
• Awareness of Evolving Risks
• Ways to Stay Informed