CMMC Compliance Professional

Sample question 1

You are the CMMC Compliance Professional at Halloway Fasteners, a small manufacturer that handles only Federal Contract Information (FCI) and holds no contracts involving Controlled Unclassified Information (CUI). Eleven months ago, Halloway completed its first Cybersecurity Maturity Model Certification (CMMC) Level 1 self-assessment, scored itself against the required safeguards, and posted the result in the Supplier Performance Risk System (SPRS). No new contract has changed Halloway's CMMC obligations since then. Reviewing the compliance calendar for the coming month, you need to identify what keeps Halloway's Level 1 status valid past the one-year mark. Which of the following correctly identifies it?

1. A.The Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) must review the safeguards, record its result in SPRS, and confirm the status at the one-year mark, because DIBCAC periodically re-verifies a Level 1 self-assessment once a full year has passed since the company posted it.
2. B.A CMMC Third-Party Assessment Organization (C3PAO) must assess the safeguards, post its result, and certify the status at the one-year mark, because a self-assessed Level 1 status converts after its first year into one that only a C3PAO can renew, as a Level 2 status eventually requires.
3. C.A new Level 1 self-assessment must be completed, its result posted in SPRS, and the affirming official's accompanying affirmation submitted, because Level 1 status is valid for only one year and each annual cycle needs both a fresh assessment and its affirmation, not a renewal of the score already on file.
4. D.The affirming official must review the prior score, confirm that no safeguard has changed, and submit an annual affirmation in SPRS restating that score, because an affirmation is what keeps a self-assessed status current between full assessments, the same mechanism that serves a Level 2 self-assessment across its multi-year cycle.

Sample question 2

You are the Cybersecurity Maturity Model Certification (CMMC) Compliance Professional at Kestrel Avionics, assembling a proposal in September 2026 for a new Department of Defense (DoD) contract that will carry the Defense Federal Acquisition Regulation Supplement (DFARS) clauses 252.204-7012, 252.204-7019, 252.204-7020, and 252.204-7021. The solicitation instructions state that an offeror must have a current assessment score on file at the time of contract award. You confirm that Kestrel's Basic Assessment summary score, completed fourteen months ago under the DoD Assessment Methodology for NIST SP 800-171, is still posted in the Supplier Performance Risk System (SPRS); no cyber incident has occurred, and the government has not requested an on-site assessment visit. Which clause obligation explains why that already-posted score is what satisfies the solicitation's condition?

1. A.The obligation under 252.204-7012, because that clause requires a contractor to safeguard covered defense information by implementing NIST SP 800-171, and a posted score reflecting that implementation is how an offeror demonstrates compliance with the clause before a new contract award.
2. B.The obligation under 252.204-7019, because that clause requires an offeror to have a current NIST SP 800-171 DoD Assessment score posted in SPRS at the time of contract award, and a score on file under three years old satisfies that condition without any new submission.
3. C.The obligation under 252.204-7020, because that clause requires an offeror's posted SPRS score to demonstrate the company is prepared to grant the government access for a Medium or High assessment, which is the condition the solicitation language is actually checking for.
4. D.The obligation under 252.204-7021, because that clause is what requires a contractor to hold the CMMC status a contract calls for as a condition of award, and a currently posted Basic Assessment score is how that status requirement is satisfied under this solicitation.

Sample question 3

You are the Cybersecurity Maturity Model Certification (CMMC) Compliance Professional at Corvid Systems. A Department of Defense (DoD) solicitation Corvid is preparing to bid on states that offerors must hold Level 2 (C3PAO) certified status at the time of contract award, because the work involves design specifications marked as Controlled Unclassified Information (CUI). You check Corvid's record and find a Level 2 (Self) self-assessment, completed five months ago, current within its validity period, with its most recent annual affirmation posted on schedule in the Supplier Performance Risk System (SPRS). No Level 2 certification issued by a CMMC Third-Party Assessment Organization (C3PAO) is on file. Which of the following best describes what you should conclude and do before the proposal is due?

1. A.The current Level 2 (Self) status satisfies the solicitation as posted. A self-assessment and a C3PAO certification are both scored against the same 110 requirements of NIST SP 800-171, so a solicitation naming Level 2 is satisfied by whichever assessment type the company already has on file.
2. B.The current status does not satisfy the solicitation, but because Corvid's Level 2 (Self) self-assessment is current, the affirming official can close the gap with a new SPRS affirmation attesting to certified status, since an affirmation is what keeps any Level 2 status current each year.
3. C.The current status does not satisfy the solicitation, but the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) will convert Corvid's self-assessment score into Level 2 (C3PAO) certified status once the underlying score is reviewed, so no further action is needed from Corvid.
4. D.The current Level 2 (Self) status does not satisfy the solicitation. A self-assessment scored by the company itself is a different assessment type from a certification issued by a C3PAO, so Corvid needs to schedule and complete a C3PAO certification assessment before the award decision.