CMMC Readiness Practitioner

Sample question 1

You are a Cyber AB Registered Practitioner (RP) assembling the body of evidence for Meridian Cable Assembly's upcoming Level 2 (Self) affirmation under the Department of Defense (DoD)'s Cybersecurity Maturity Model Certification (CMMC) program. Working through the evidence folder for NIST SP 800-171 Revision 2 requirement 3.11.2, periodic vulnerability scanning of organizational systems and applications, you find a vulnerability scan report dated fourteen months ago, generated before the company retired its remote-desktop gateway and replaced it with a new virtual private network (VPN) concentrator six months ago. No scan of the current VPN configuration exists anywhere in the folder, and interview rehearsals have not yet started. The affirmation review is scheduled for three weeks from now. What should you do?

1. A.Include the fourteen-month-old scan in the evidence folder as it stands, since it is the most recent scan report the company has on file and a scan report satisfies the requirement regardless of when the environment last changed.
2. B.Remove the outdated scan from the evidence folder without requesting a replacement, since a report that predates the current VPN concentrator gives no real support for the requirement and an empty folder is more honest than a stale one.
3. C.Tell the company the scan on file predates the current environment, and have them run and document a scan of the new VPN concentrator so the evidence folder reflects the environment before the review date.
4. D.Note the gap between the scan date and the VPN replacement in your working file, and leave the evidence folder and review schedule as they stand, since three weeks gives the company's routine scanning cycle ample time to produce a current report.

Sample question 2

Marcus Webb, the non-technical chief operating officer of Corrigan Fabrication, calls you, the Cyber AB Registered Practitioner (RP) who advised the company through last year's Level 2 (Self) affirmation. That affirmation and its system security plan (SSP) describe a boundary limited to the accounting enclave that handles Controlled Unclassified Information (CUI) for Corrigan's current contract. Webb wants to bid on a new solicitation that also requires a current Level 2 (Self) status, and tells you it is fine to submit the bid citing last year's affirmation, since the company is already shown at Level 2. The new contract's work would place CUI on Corrigan's manufacturing execution system, which sits outside the boundary described in the affirmed SSP. What should you tell Webb?

1. A.Tell Webb last year's affirmation covers the boundary described in the current SSP, so the manufacturing execution system needs its own assessment and its own affirmation before Corrigan can rely on Level 2 status for that system.
2. B.Tell Webb the existing affirmation is enough to bid, since Corrigan's Supplier Performance Risk System (SPRS) score already shows the company at Level 2 and one score covers the company as a whole, beyond whichever system handles the contract's information.
3. C.Tell Webb that bringing the manufacturing execution system into the boundary is optional paperwork that can wait until after contract award, since last year's affirmation already establishes Corrigan's eligibility for solicitations requiring Level 2 status.
4. D.Tell Webb last year's affirmation cannot support this bid, so Corrigan needs to repeat the self-assessment of the accounting enclave and post a new affirmation first, since an affirmation stops counting once a company pursues a different contract than the one it was made for.

Sample question 3

You are a Cyber AB Registered Practitioner (RP) at Thornhall Advisory Group, a Registered Provider Organization (RPO). The marketing lead sends you draft copy for a social media campaign aimed at prospective defense-supplier clients and asks you to sign off before it posts. The draft reads: 'As a Cyber AB Registered Provider Organization, Thornhall's readiness methodology has been reviewed and approved by the Cyber AB, and clients who complete our program are guaranteed to pass their certification assessment.' Thornhall's registration status with the Cyber AB is current and accurate. What should you tell the marketing lead?

1. A.Tell the marketing lead to post the copy as written, since Thornhall's registration status is accurate and describing the firm's own program in confident marketing language is a normal way for a registered firm to compete for clients.
2. B.Tell the marketing lead the review-and-approval sentence is accurate, since completing the Cyber AB's registration process for a Registered Provider Organization is itself a form of review and approval of the firm's methodology, so only the guarantee-of-outcome language needs to come out.
3. C.Tell the marketing lead to keep both claims but qualify each in a footnote, one explaining that the Cyber AB review refers to the registration process and one conditioning the guarantee on clients completing every step of the program, since a qualified claim no longer misleads.
4. D.Tell the marketing lead to remove both the claim that the Cyber AB reviewed and approved Thornhall's methodology and the guarantee that clients will pass, since registration does not amount to Cyber AB endorsement, and no RPO can promise an assessment outcome.